In this course we will learn about an approach to collect events from windows devices in both normal operations and when an intrusion is suspected. We will use Windows Event Forwarding (WEF) natively built into Windows for Incident detection while sharing our learnings and step-by- step instructions with WEF configuration and management workflows.
Learning Objectives
By the end of the course, students should be able to:
- Configure Windows Event Logging to capture malicious activity like Lateral Movement
- Collect events from Windows servers and workstations using Windows Event Collector (WEC)
- Use a threat detection framework from MITRE to perform hunt for malicious activity like - Lateral Movement
Framework Connections
The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):
Specialty Areas
- All-Source Analysis
- Threat Analysis
- Collection Operations
- Incident Response