Course-Introduction-(5-13) hide01.ir

About-the-Instructor-(2-30) hide01.ir

The-SOC-201-Methodology-(4-23) hide01.ir

The-Modern-Adversary-(10-17) hide01.ir

Course-Support-(3-05) hide01.ir

Lab-Setup-(3-31) hide01.ir

Installing-a-Hypervisor-(7-26) hide01.ir

Installing-Ubuntu-(13-20) hide01.ir

Configuring-Ubuntu-(8-17) hide01.ir

Installing-Windows-(11-15) hide01.ir

Configuring-Windows-(7-52) hide01.ir

Installing-Splunk-(16-16) hide01.ir

Configuring-the-Lab-Network-(10-10) hide01.ir

Introduction-to-Incident-Response-(5-59) hide01.ir

The-Incident-Response-Process-(14-04) hide01.ir

Incident-Response--Preparation-(14-44) hide01.ir

Incident-Response--Identification-(5-39) hide01.ir

Incident-Response--Containment-(10-45) hide01.ir

Incident-Response--Eradication-(6-05) hide01.ir

Incident-Response--Recovery-(7-43) hide01.ir

Incident-Response--Lessons-Learned-(5-15) hide01.ir

Incident-Response-vs.-Threat-Hunting-(11-39) hide01.ir

The-OODA-Loop-(18-32) hide01.ir

Introduction-to-Threat-Hunting-(8-58) hide01.ir

The-Argument-for-Threat-Hunting-(13-14) hide01.ir

Threat-Hunting-Teams-(16-55) hide01.ir

Threat-Hunting-Data-Sources-(19-30) hide01.ir

Cyber-Threat-Intelligence-(6-22) hide01.ir

The-Cyber-Kill-Chain-(16-52) hide01.ir

The-MITRE-ATT&CK-Framework-(15-05) hide01.ir

Exploring-MITRE-ATT&CK-(12-37) hide01.ir

Structured-Threat-Hunting-(16-01) hide01.ir

Unstructured-Threat-Hunting-(9-21) hide01.ir

MITRE-ATT&CK-Navigator-(21-48) hide01.ir

MITRE-ATT&CK-Navigator--Gap-Analysis-and-Threat-Hunting-(19-02) hide01.ir

Data-Transformation-(5-36) hide01.ir

Data-Transformation--Searching-(14-16) hide01.ir

Searching-in-the-Command-Line-(19-19) hide01.ir

Searching-in-PowerShell-(27-29) hide01.ir

Data-Transformation--Aggregations-(9-24) hide01.ir

Searching-in-Splunk-(21-54) hide01.ir

Aggregations-in-the-Command-Line-(25-36) hide01.ir

Aggregations-in-PowerShell-(10-24) hide01.ir

Data-Transformation--Statistics-(9-38) hide01.ir

Aggregations-in-Splunk-(34-43) hide01.ir

Statistics-in-the-Command-Line-(22-04) hide01.ir

Statistics-in-PowerShell-(13-24) hide01.ir

Statistics-in-Splunk-(15-23) hide01.ir

Data-Transformation--Visualizations-(5-00) hide01.ir

Visualizations-in-Splunk-(25-31) hide01.ir

Understanding-Anomalies-(20-33) hide01.ir

Categorizing-Anomalies-(1-11) hide01.ir

Masquerading-(10-39) hide01.ir

Ambiguous-Identifiers-(11-13) hide01.ir

Frequency-&-Volume-Anomalies-(16-14) hide01.ir

Temporal-Anomalies-(14-53) hide01.ir

Location-&-Environment-Anomalies-(14-25) hide01.ir

Obfuscated-PowerShell-Analysis-(6-34) hide01.ir

Structure-&-Format-Anomalies-(16-16) hide01.ir

Alternate-Data-Stream-(ADS)-Analysis-(19-26) hide01.ir

Entropy-Analysis-(4-56) hide01.ir

Absence-&-Suppression-Anomalies-(7-57) hide01.ir

Mapping-Steps-to-Artifacts-(4-40) hide01.ir

Breaking-Down-Attack-Steps-(5-05) hide01.ir

Dissecting-Threat-Reports-(18-54) hide01.ir

Mapping-Artifacts-to-Evidence-Sources-(7-51) hide01.ir

Visualizing-with-MITRE-ATT&CK-Navigator-(4-34) hide01.ir

Intrusion-Analysis-Resources-(5-56) hide01.ir

Hunting-Execution-Artifacts-(9-46) hide01.ir

Tracing-an-Attack-Chain-(27-04) hide01.ir

Hunting-Cmd-Execution-(20-20) hide01.ir

Hunting-Persistence-Artifacts-(7-33) hide01.ir

Hunting-PowerShell-Execution-(36-09) hide01.ir

Hunting-Process-Trees-(9-26) hide01.ir

Hunting-Persistence--Registry-Run-Keys-(17-20) hide01.ir

Hunting-Persistence--Lookup-Tables-(27-30) hide01.ir

Hunting-Defense-Evasion-Artifacts-(16-39) hide01.ir

Hunting-Command-and-Control-(C2)-Artifacts-(7-40) hide01.ir

Hunting-C2--Ingress-Tool-Transfer-(LOLBAS)-(7-35) hide01.ir

Hunting-C2--Ingress-Tool-Transfer-(Network-Connection-Events)-(4-21) hide01.ir

Hunting-Lateral-Movement-Artifacts-(8-27) hide01.ir

Hunting-C2--Ingress-Tool-Transfer-(File-System-Events)-(12-57) hide01.ir

Hunting-Lateral-Movement--PsExec-(Service-Creation)-(9-38) hide01.ir

Hunting-Lateral-Movement--PsExec-(Reversing-Regex)-(14-25) hide01.ir

Hunting-Lateral-Movement--PsExec-(Named-Pipes)-(4-12) hide01.ir

Module-Recap-(5-46) hide01.ir

Introduction-to-Collection-(3-24) hide01.ir

Introduction-to-WMI-(11-11) hide01.ir

WMIC-Collection-and-Filter-Examples-(5-51) hide01.ir

Collection-with-WMIC-(18-56) hide01.ir

Remote-Collection-with-WMIC-(5-38) hide01.ir

Scripting-WMI-Collection-(10-31) hide01.ir

WMI-Automated-Collection-Frameworks-(6-57) hide01.ir

Introduction-to-PowerShell-(4-58) hide01.ir

PowerShell-101-(1-55) hide01.ir

PowerShell-101--Cmdlets-(6-09) hide01.ir

PowerShell-101--Aliases-(6-45) hide01.ir

PowerShell-101--Objects-and-the-Pipeline-(9-08) hide01.ir

PowerShell 101 - Providers hide01.ir

PowerShell-101--Selecting,-Sorting,-and-Formatting-(17-35) hide01.ir

PowerShell 101 - Variables and Data Types hide01.ir

PowerShell 101 - Control Flow hide01.ir

Working with WMI and CIM hide01.ir

Live Incident Response Using PowerShell hide01.ir

PowerShell Remoting hide01.ir

PS Remoting - One-to-One Remoting hide01.ir

PS Remoting - One-to-Many Remoting hide01.ir

PowerShell Authentication hide01.ir

PS Remoting - Script Execution at Scale hide01.ir

Malicious PowerShell Usage hide01.ir

Introduction to the Kansa IR Framework hide01.ir

Kansa - Remote Collection (Part 1) hide01.ir

Kansa - Modules hide01.ir

Kansa - Remote Collection (Part 2) hide01.ir

Collection and Analysis Challenge hide01.ir

Kansa - Collection Analysis hide01.ir

Collection Analysis Challenge Walkthrough hide01.ir

Course Wrap Up hide01.ir