English | Size: 6.41 GB
Genre: eLearning
This course provides advanced purple team training, with a focus on adversary emulation for data breach prevention and detection. Throughout this course, students will learn how real-life threat actors can be emulated in a realistic enterprise environment, including multiple AD forests. In true purple fashion, the goal of the course is to educate students on how adversarial techniques can be emulated (manual and automated) and detected (use cases/rules and anomaly-based detection). A natural follow-up to SEC599, this is an advanced SANS course offering, with 60 percent of class time spent in 29 hands-on labs!
What You Will Learn
SEC699 is SANS’s advanced purple team offering, with a key focus on adversary emulation for data breach prevention and detection. Throughout this course, students will learn how real-life threat actors can be emulated in a realistic enterprise environment. In true purple fashion, the goal of the course is to educate students on how adversarial techniques can be emulated and detected.
A natural follow-up to SEC599, this is an advanced SANS course offering, with 60 percent of class time spent on labs. Highlights of class activities include:
A course section on typical automation strategies such as Ansible, Docker and Terraform. These can be used to deploy a full multi-domain enterprise environment for adversary emulation at the press of a button
Building a proper process, tooling, and planning for purple teaming
Building adversary emulation plans that mimic real-life threat actors such as APT-28, APT-34, and Turla in order to execute these plans using tools such as Covenant and Caldera
In-depth techniques such as Kerberos Delegation attacks, Attack Surface Reduction / Applocker bypasses, AMSI, Process Injection, COM Object Hi-jacking and many more…
SIGMA rule-building to detect the above techniques
Course authors Erik Van Buggenhout (the lead author SEC599) and James Shewmaker (the co-author SEC660) are both certified GIAC Security Experts (GSEs) and are hands-on practitioners who have built a deep understanding of how cyber attacks work through both red team (penetration testing) and blue team (incident response, security monitoring, threat hunting) activities. In this course, they combine these skill sets to educate students on adversary emulation methods for data breach prevention and detection.
The SEC699 journey is structured as follows:
In Section one, we will lay the foundations that are required to perform successful adversary emulation and purple teaming. As this is an advanced course, we will go in-depth on several tools that we’ll be using and learn how to further extend existing tools.
Sections two through four will be heavily hands-on lecturing a number of advanced techniques and their defenses (focused on detection strategies). Section two focuses on Initial Access techniques, section three covers Lateral Movement and Privilege Escalation, while section four deals with Persistence.
Finally, in section five, we will build an emulation plan for a variety of threat actors. These emulation plans will be executed in Covenant, Caldera, and Prelude Operator.
Business Takeaways:
Build realistic adversary emulation plans to better protect your organization
Deliver advanced attacks, including application whitelisting bypasses, cross-forest attacks (abusing delegation), and stealth persistence strategies
Building SIGMA rules to detect advanced adversary techniques
If any links die or problem unrar, send request to
forms.gle/e557HbjJ5vatekDV9
SANS-699-Purple-Team-Tactics