C)TIA: Threat Intelligence Analyst

Modules: 

• Module 01: Threat Intelligence Basics
• Module 02: Security Analysis Basics
• Module 03: Cyber Threats
• Module 04: Threat Actors
• Module 05: Case Studies
• Module 06: Threat Identification
• Module 07: Proactive Approach

Hands-On Labs:

• Lab 01: Setting up SIEM Environment
• Lab 02: Practical Threat Analysis          
• Lab 03: Hunting for Active Threats through Collected Logs       
• Lab 04: Defensive Threat Intelligence Development     
• Lab 05: Threat Intelligence Data Integration with SIEM 
• Lab 06: Leveraging MISP for Threat Intelligence
• Lab 07: OSINT Methodology to Identify Threats
• Lab 08: Exploitation, Analyzing, and Research  
• Lab 09: Integrating Elastic & MISP

Detailed Outline:

Course Introduction

Module 1:  Threat Intelligence Basics     

1. Threat Intelligence Basics
2. Threat Intelligence Use Cases
3. Threat Intelligence Development
4. Types of Threat Intelligence
5. Tools of the Trade

Module 2:  Security Analysis Basics       

1. What is Security Analysis
2. How Security Analysis support Threat Intelligence
3. Static Analysis
4. Dynamic Analysis
5. Rule Based Detection

Module 3:  Cyber Threats

1. Cyber Threat Overview
2. Cyber Threats Classification
3. Prevention Against Cyber Threats
4. Examples of Cyber Threats in History

Module 4:  Threat Actors

1. Threat Actors Overview
2. Threat Actors Classification
3. Examples of threat Actors in History

Module 5: Cyber Threats & Malicious Actors Case Studies                 

1. Stuxnet
2. EternalBlue
3. WannaCry
4. Wizard Spider Group
5. Operation Aurora
6. Zerologon
7. MOVEit

Module 6: Threats Identification

1. Threat Hunting
2. Threats Analysis Frameworks
3. Leveraging Tools for Threat Discovery

Module 7: Implementing a Proactive Threat Intelligence Approach

1. Foundations of Proactive Threat Intelligence
2. Operationalizing Threat Intelligence in an Organization
3. Threat Intelligence Sharing & Exchange Standards
4. Rule Creation for Threat Hunting & Automation

Detailed Lab Outline:

Lab 1 – Setting up SIEM Environment

Section 1 – Setup Elastic Search    

Lab 2 – Practical Threat Analysis 

Section 1 – Static Analysis on WannaCry Threat   

Section 2 – Dynamic Analysis on WannaCry Threat          

Section 3 – Perform an Analysis on your own        

Lab 3 – Hunting for Active Threats through Collected Logs    

Section 1 – Hunting for Backdoors  

Section 2 – Hunting for Intrusions    

Section 3 – Threat Actor Profiling using MITRE ATT&CK. 

Lab 4 – Defensive Threat Intelligence Development     

Section 1 – YARA Rules Usage, Development, and Improvement

Section 2 – Snort Rules Usage, Development, and Improvement 

Lab 5 – Threat Intelligence Data Integration with SIEM

Section 1 – Implement Real-Time Threat Intelligence within SIEM

Lab 6 – Leveraging MISP for Threat Intelligence

Section 1 – Analyzing an Attack by adding an Event         

Section 2 – Add an event based on actual attack   

Section 3 – Decay and Warning Lists          

Section 4 – MISP feeds        

Lab 7 – OSINT Methodology to Identify Threats

Section 1 – Discovering Threats through Google Dorks OSINT    

Section 2 – Discovering Threats through Social Media OSINT     

Section 3 – Discovering Threats through Intelligence Sharing

Section 4 – Discovering Threats through Dark Web OSINT          

Section 5 – Discovering Threats through Vulnerabilities Databases OSINT         

Lab 8 – Exploitation, Analyzing, and Research  

Section 1 – Exploitation and Analysis of SIEM Logs          

Section 2 – Analyzing Exported SIEM logs 

Section 3 – Researching OTX for threats affecting a specific industry      

Lab 9 – Integrating Elastic and MISP       

Section 1 – Manual Ingestion of MISP Events into Elastic 

Section 2 – Visualize Threat Feeds in Elasticsearch          

Section 3 – Ingesting MISP Events to Elastic Defender Rules      

Section 4 – Automate IOC Ingestion into Elastic’s Detection Rules