SANS SEC699 - Purple Team Tactics - Adversary Emulation for Breach Prevention & Detection Free Download

SANS SEC699 – Purple Team Tactics – Adversary Emulation for Breach Prevention & Detection
English | Tutorial | Size: 6.08 GB

This course provides advanced purple team training, with a focus on adversary emulation for data breach prevention and detection. Throughout this course, students will learn how real-life threat actors can be emulated in a realistic enterprise environment, including multiple AD forests. In true purple fashion, the goal of the course is to educate students on how adversarial techniques can be emulated (manual and automated) and detected (use cases/rules and anomaly-based detection). A natural follow-up to SEC599, this is an advanced SANS course offering, with 60 percent of class time spent in 29 hands-on labs!

What You Will Learn
SEC699 is SANS’s advanced purple team offering, with a key focus on adversary emulation for data breach prevention and detection. Throughout this course, students will learn how real-life threat actors can be emulated in a realistic enterprise environment. In true purple fashion, the goal of the course is to educate students on how adversarial techniques can be emulated and detected.

A natural follow-up to SEC599, this is an advanced SANS course offering, with 60 percent of class time spent on labs. Highlights of class activities include:

A course section on typical automation strategies such as Ansible, Docker and Terraform. These can be used to deploy a full multi-domain enterprise environment for adversary emulation at the press of a button
Building a proper process, tooling, and planning for purple teaming
Building adversary emulation plans that mimic real-life threat actors such as APT-28, APT-34, and Turla in order to execute these plans using tools such as Covenant and Caldera
In-depth techniques such as Kerberos Delegation attacks, Attack Surface Reduction / Applocker bypasses, AMSI, Process Injection, COM Object Hi-jacking and many more…
SIGMA rule-building to detect the above techniques
Course authors Erik Van Buggenhout (the lead author SEC599) and James Shewmaker (the co-author SEC660) are both certified GIAC Security Experts (GSEs) and are hands-on practitioners who have built a deep understanding of how cyber attacks work through both red team (penetration testing) and blue team (incident response, security monitoring, threat hunting) activities. In this course, they combine these skill sets to educate students on adversary emulation methods for data breach prevention and detection.

The SEC699 journey is structured as follows:

In Section one, we will lay the foundations that are required to perform successful adversary emulation and purple teaming. As this is an advanced course, we will go in-depth on several tools that we’ll be using and learn how to further extend existing tools.
Sections two through four will be heavily hands-on lecturing a number of advanced techniques and their defenses (focused on detection strategies). Section two focuses on Initial Access techniques, section three covers Lateral Movement and Privilege Escalation, while section four deals with Persistence.
Finally, in section five, we will build an emulation plan for a variety of threat actors. These emulation plans will be executed in Covenant, Caldera, and Prelude Operator.
Business Takeaways:

Build realistic adversary emulation plans to better protect your organization
Deliver advanced attacks, including application whitelisting bypasses, cross-forest attacks (abusing delegation), and stealth persistence strategies
Building SIGMA rules to detect advanced adversary techniques

Prerequisites
This is a fast-paced, advanced course that requires a strong desire to learn advanced red and blue team techniques. The following SANS courses are recommended either prior to or as a companion to taking this course:

SEC599
SEC560
Experience with programming in any language is highly recommended. At a minimum, students are advised to read up on basic programming concepts.

You should also be well versed with the fundamentals of penetration testing prior to taking this course. Familiarity with Linux and Windows is mandatory. A solid understanding of TCP/IP and networking concepts is required. Please contact the author at [email protected] if you have any questions or concerns about the prerequisites.

Laptop Requirements
Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course. You can also watch a series of short videos on these topics at the following web link: sansurl.com/sans-setup-videos

Mandatory System Requirements

System running Windows, Linux, or Mac OS X 64-bit version – Note: Apple systems using the M1 processor cannot perform the necessary virtualization at this time and cannot be used for this course.
At least 8 GB RAM
60 GB of available disk space (more space is recommended)
Administrator access to the operating system
Anti-virus software will need to be disabled in order to install some of the tools
An available USB port
Wireless NIC for network connectivity
Machines should NOT contain any personal or company data
Verify that under BIOS, Virtual Support is ENABLED
Disable Windows 10 Credential Guard and Device Guard
Mandatory Preparation steps Prior to Coming to Class:

Installed 64-bit host operating systems (Windows is recommended)
Download and install VM Workstation Pro 15.5 or higher, VMware Fusion 11.5 or higher, or VMware Workstation Player 15.5 or higher versions on your system prior to the start of class
Adobe Acrobat or other PDF reader application
An AWS account is required to do hands-on exercises during this course. SANS provides an account for the duration of LIVE events, but for use beyond the classroom and OnDemand access, an AWS account is NOT provided. If needed, the AWS account must be created prior beginning the course. Your ability to execute the hands-on exercises will be delayed if you do not have access to a usable AWS account in class.
If a personal AWS account is used for this class, estimate additional costs for the week of AWS account usage to be $50 or more if you deviate from the instructions.
For detailed instructions on these preparation steps, please refer to Lab Zero in your MyLabs area of sans.org/.

It is critical that your CPU and operating system support 64-bits so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows and Linux that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.

Please download and install VM Workstation Pro 15.5 or higher, VMware Fusion 11.5 or higher, or VMware Workstation Player 15.5 or higher versions on your system prior to the start of the class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial on its website.

Other virtualization software, such as VirtualBox and Hyper-V, are not appropriate because of compatibility and troubleshooting problems you might encounter during class.

VMware Workstation Pro and VMware Player on Windows 10 is not compatible with Windows 10 Credential Guard and Device Guard technologies. Please disable these capabilities for the duration of the class, if they’re enabled on your system, by following instructions in this document.

Your course media will now be delivered via download. The media files for class can be large, some in the 40 – 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

Author Statement
After the success of SEC599, I’m very excited to unleash this course offering upon the SANS audience! SEC699 is an amazing course that came about because we listened to student requests for a hands-on adversary emulation class leveraging an enterprise lab environment. This is it!

SEC699 attendees will learn advanced red and blue team techniques for proper purple teaming in an enterprise environment. Throughout the week we do not just focus on explaining tips and tricks, but also empower students to build and adapt their own tooling for proper adversary emulation. This includes, for example, custom Caldera, SIGMA and Velociraptor development.

The SEC699 lab environment is fully built using Teraform playbooks and covers multiple domains and forests that can be attacked! Students spin up the lab environment in their own AWS account and can thus keep on practicing months (and years) after they took the class!

– Erik Van Buggenhout

Buy Long-term Premium Accounts To Support Me & Max Speed

If any links die or problem unrar, send request to goo.gl/aUHSZc

Leave a Comment Cancel reply