Combined Windows-Linux Enterprise Incident Response

After completing this course, learners should be able to: • Describe the incident response process, including the threat landscape, targeted attack life cycle, initial attack vectors used by different threat actors, and phases of an effective incident response process • Conduct system triage to answer key questions about what transpired across the enterprise during an incident • Apply lessons learned to proactively investigate an entire windows environment (including metadata, registry, event logs, services, persistence mechanisms and artifacts of execution) at scale for signs of compromise • Identify and use critical sources of evidence to investigate and analyze a compromised Linux system including EXT3/EXT4 file systems, syslog, audit logs, memory, VPN and web shells • Audit common Linux applications for databases and web servers including Oracle, MySQL, PostgreSQL, Apache and nginx • Know how attackers move from system-to-system in a compromised Linux environment through their use of data including credentials, logons, remote command execution and shell artifacts • Analyze web logs to recognize and interpret common attacker techniques including obfuscation and encoding methods