Detecting Windows attacks
You study the traces real attack techniques leave in Windows and Sysmon logs and write tested detection rules for credential theft, lateral movement and persistence.
Level 401 · 15 lessons · 15 practice labs
Lessons
Initial access and execution
- Suspicious processes started by Office
- PowerShell abuse: encoded commands, downloads, AMSI
- Execution with legitimate tools: rundll32, mshta, certutil
- Short task: write a rule catching a chain that starts from a macro document
Credentials and lateral movement
- Detecting LSASS memory dumping
- Traces of pass-the-hash
- Remote execution: service creation, WMI, WinRM
- Lateral movement over RDP
- Short task: link the sessions spreading from one host to three others
Persistence and defence evasion
- Persistence through services and scheduled tasks
- Persistence through WMI event subscriptions
- Log clearing and disabled auditing
- Tampering with Defender settings
- Short task: catch three persistence techniques in one rule pack
Capstone
- Capstone: catch a recorded attack day from start to finish with your rules
Practice labs
- Find the shell launched by Office in the SIEM: Query cmd and PowerShell processes whose parent is Office and extract the document name.
- Decode an encoded PowerShell command and write a rule: Decode the command in the record, identify the download pattern and test a detection that catches it.
- Tell rundll32 and mshta abuse from legitimate use: Group a week of usage by command line and catch calls containing a remote address or script.
- Find the certutil variant this rule misses: Find the call with abbreviated parameters and a renamed binary and fix the rule to use the original file name.
- Find remote service creation in 7045 records: Filter new service events and note the one with an unusual binary path and the account that created it.
- Extract the trace of pass-the-hash from logon events: Find 4624 records with logon type 9 and NTLM and match their source and target.
- Link the sessions spreading from one host to three others: Combine logon, service and process events in time order and draw the lateral movement graph.
- Tell an LSASS dump from an admin tool: Filter LSASS access events by access rights and calling process and find the dumping tool.
- Catch a new scheduled task in a 4698 record: Filter task creation events and extract the command of the task running from a user folder.
- Detect persistence through a WMI event subscription: Combine Sysmon 19, 20 and 21 records and find the command the subscription runs.
- Catch tampering with Defender settings: Find the commands disabling real-time protection and adding exclusions from registry and process events.
- Catch log clearing and audit disabling in one rule: Write a rule covering 1102, 104 and auditpol use and exclude scheduled admin maintenance.
- Catch three persistence techniques in one rule pack: Write rules for a Run key, a service and the startup folder and trigger all three on recorded attack data.
- Recognise normal use of an admin tool from the records: Collect certutil command lines from a week of process records and separate normal certificate work from file downloads.
- Write the rule that catches a cleared event log: Write a rule looking for events 1102 and 104 and show from sample data which account cleared the log.
About this course
You study the traces real attack techniques leave in Windows and Sysmon logs and write tested detection rules for credential theft, lateral movement and persistence.
What you will learn
- Initial access and execution
- Credentials and lateral movement
- Persistence and defence evasion
- Capstone
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.