Mô tả

Welcome to the "Red Team Operations-Initial Access to Ransomware Deployment".  In this course, you will Start as a beginner with no previous knowledge, & by the end of the course, you will be at the beginner to Advanced level in Red Teaming activities. This course is full of practical sessions and you will see all the attacks in real-time

We have started our course with the basic section on LOLBAS and how threat actors will use LOLBAS for their attacks. This course is highly practical

The course is divided into a number of sections, each section covers Red and Blue team skills. By the end of the course, you will have a strong foundation in Red and Blue teaming activities. How TA will compromise the environment, Real-time Attacks How Threat actors deploy Ransomware in organizations

The course is divided into 18 sections

  • LOLBin for Red Teamers and  Threat Hunters

  • Working with Windows Processes
    MITRE ATT&CK framework discussion

  • Open source intelligence (OSINT) for Red and Blue Teamers

  • Persistence techniques for Red and Blue Teamers

  • Investigating defensive mechanisms and methods to evade antivirus and EDR

  • Red + Blue Team Operation - Initial Access Phase

  • Red + Blue Team Operation - Defense Evasion Phase

  • Red + Blue Team Operation - Post Exploitation Phase

  • Red + Blue Team Operation - Persistence phase

  • Red + Blue Team Operation - Privilege Escalation

  • Red + Blue Team Operation - Credential Access

  • Red + Blue Team Operation - Lateral Movement

  • Red + Blue Team Operation - Exfiltration

  • Red + Blue Team Operation - Impact

  • Blue Team Operations - Investigation

  • History of Ransomwares

At the end of each section, you will learn how to detect, prevent, and secure systems and yourself from the discussed attacks.

With this course you'll get 24/7 support, so if you have any questions you can post them in the Q&A section and we'll respond to you within 8 hours.


Notes:

  • This course is created for educational purposes only, all the attacks are launched in my own lab

Bạn sẽ học được gì

Yêu cầu

Nội dung khoá học

19 sections

Introduction(Red Team Operations)

2 lectures
Introduction to the course
13:45
Disclaimer
01:26

LOLBin for Red Teamers and Threat Hunters

12 lectures
What Is LOLBin ?
03:27
Abusing Rundll32.exe
05:10
Abusing Certutil.exe
08:12
Abusing BITSAdmin.exe
10:57
Abusing Conhost.exe
04:53
Abusing MSHTA.exe
07:07
Abusing Reg.exe
06:11
Abusing Wscript.exe
04:07
Abusing PowerShell.exe
05:40
Abusing WMIC.exe
06:43
Abusing Rclone and Vssadmin
08:38
Attack flow using LOLBin
04:47

Working with Windows Processes

4 lectures
Overview about Process and Threads
07:37
Overview about DLL's and API's
16:09
Process Creation Step by Step
07:46
Process chain for Malware's
05:55

MITRE ATT&CK® framework discussion

1 lectures
MITRE ATT&CK framework and its Origin
46:08

Open source intelligence (OSINT) for Red and Blue Teamers

1 lectures
Comprehensive exploration of OSINT for Red and Blue Teamers
40:13

Persistence techniques for Red and Blue Teamers

5 lectures
Persistence – Registry Run Keys
11:01
Persistence – Startup Folder
06:20
Persistence – Windows Management Instrumentation (WMI)
16:56
Persistence – Scheduled tasks
10:55
Persistence - Services
13:36

Investigating defensive mechanisms and methods to evade antivirus and EDR

7 lectures
Exploring research on static, dynamic, and heuristic engines
29:03
Process Injection | Dll Injection | Process Hollowing attacks
21:45
DLL Hijacking
17:09
Refining the obfuscation technique through the method of renaming
04:05
Control flow Obfuscation
04:30
Hooking and Unhooking
11:24
Understanding AMSI: Overview and Methods to Bypass
18:58

Red + Blue Team Operation - Initial Access Phase

8 lectures
Developing Shellcode for Process Injection Techniques.
05:17
Process Injection Code Overview
05:57
Gaining Initial Access via Process Injection Techniques.
08:30
Investigating Reverse Connection
03:04
Leveraging External Remote Services for Initial Access.
08:15
Gaining Initial Access via Phishing Tactics.
04:54
Leveraging Public-Facing Applications for Initial Access.
13:15
Utilizing Supply Chain Attacks for Initial Access.
02:45

Red + Blue Team Operation - Defence Evasion Phase

4 lectures
Disabling Windows Defender Protection.
12:21
Configuring Exclusions in Windows Defender.
07:34
Bypassing Windows Defender and EDR with an Anti-Rootkit Tool.
08:29
Using DISM to Deactivate Windows Defender.
02:42

Red + Blue Team Operation - Post Exploitation Phase

4 lectures
Exploration of Cobalt Strike and Reversing Encoded Compressed Obfuscated Script
20:34
Payload Delivery Utilizing bitsadmin.exe.
04:15
Elimination of Indicators - Time Stomping Attack
09:10
Execution through Command and Scripting Interpreter
06:05

Red + Blue Team Operation - Persistence phase

6 lectures
Adding a Cobalt Strike Payload in the Run Key Registry.
05:50
Placing the Payload in the Start-up Folder.
04:29
Adopting a Threat Actor's Perspective for Scheduled Task Placement
09:02
Create an account to maintain access
06:25
Manipulate user accounts to maintain access
06:30
Enable and Disable the account
06:26

Red + Blue Team Operation - Privilege Escalation

9 lectures
UAC Bypass and Elevate from Medium to High Integrity.
14:18
Utilizing the LUA Registry Key for UAC Deactivation.
05:28
UAC token Duplication Attack
12:13
Comprehensive Exploration of Windows Named Pipes.
11:39
Named Pipe Impersonation Attack
06:53
Elevate Privilege through Service Control Manager
21:03
Exploiting vulnerabilities to elevate the Privilege
09:09
Unquoted Service Paths misconfiguration
16:18
Hunting password files in a target machine
07:40

Red + Blue Team Operation - Credential Access

7 lectures
What is LSASS.exe
05:46
Obtaining credentials via the WDigest protocol.
10:48
Extracting data from lsass.exe process and retrieving confidential information
12:37
Diverse Approaches for Extracting Data from the lsass.exe Process
14:28
NTLM Password cracking
09:29
Stealing Browser login data's
06:45
Credential Access through SAM and SYSTEM Hives
09:18

Red + Blue Team Operation - Lateral Movement

4 lectures
RDP enable Via Registry
06:03
Modify System firewall to enable the RDP Connections
02:09
Laterally Move Through Impacket
13:20
Investigation and IR plan for a lateral movement
04:03

Red + Blue Team Operation - Exfiltration

3 lectures
Exfiltrating Confidential Information
14:43
Exfiltration through third party Application
07:00
The Stealbit Exfiltration Tool
02:54

Red + Blue Team Operation - Impact

5 lectures
Deleting Shadow copies from the Machine
06:54
Modify Boot Status policies
04:27
Deleting Event Logs from the target Machine
03:05
Executing Ransomware Binary to the Target Machine
08:00
IR plan for a Ransomware Attack
09:52

Blue Team Operations - Investigation

6 lectures
Investigating 4624 and 4625 Events
14:43
Investigating 7045 and 7034 Events
05:00
Investigating Scheduled task creation Events
02:33
Investigating SMB and RDP Activity
02:44
Investigating SRUM Data
10:04
Investigating Browser History
04:18

History of Ransomwares

3 lectures
Akira Ransomware
15:41
Ryuk Ransomware
13:33
Lockbit Ransomware
12:48

Conclusion

1 lectures
Red + Blue Teamers - Course Conclusion
04:21

Đánh giá của học viên

Chưa có đánh giá
Course Rating
5
0%
4
0%
3
0%
2
0%
1
0%

Bình luận khách hàng

Viết Bình Luận

Bạn đánh giá khoá học này thế nào?

image

Đăng ký get khoá học Udemy - Unica - Gitiho giá chỉ 50k!

Get khoá học giá rẻ ngay trước khi bị fix.