OffSec SOC-200 (OSDA)

Course Outline & Schedule
Call US 408-759-5074 or UK +44 20 7620 0033
OffSec SOC-200 (OSDA)

Course Code QAOFSECOSDA
Duration 5 Day Course
Price Available on request
Course Description
Learn the foundations of cybersecurity defense with Foundational Security Operations and Defensive Analysis
(SOC-200), a course designed for job roles such as Security Operations Center (SOC) Analysts and Threat
Hunters. Learners gain hands-on experience with a SIEM, identifying and assessing a variety of live, end-to-end
attacks against a number of different network architectures. Learners who complete the course and pass the
exam earn the OffSec Defense Analyst (OSDA) certification, demonstrating their ability to detect and assess
security incidents.
Objectives
Learners will learn how to:
Recognize common methodologies for end-to-end attack chains (MITRE ATT&CK® framework)
Conduct guided audits of compromised systems across multiple operating systems
Use a SIEM to identify and assess an attack as it unfolds live
Target Audience
Security Operations Center (SOC) Tier 1, Tier 2 and Tier 3 Analysts, Jr. roles in Threat Hunting and Threat
Intelligence Analysts, Jr. roles in Digital Forensics and Incident Response (DFIR). Anyone interested in detection
and security operations, and/or committed to the defense or security of enterprise networks.
Perpetual Solutions - Page 1 of 7

Call US 408-759-5074 or UK +44 20 7620 0033
Additional Information
About the Exam:
The OSDA Exam Scheduling Open Now

The SOC-200 course prepares you for the OSDA certification
Exam is Proctored
Learn more about the exam here
Course Modules
Module 1 Attacker Methodology (14 topics)
◾ The Network as a Whole

◾ Gain a basic understanding of an enterprise network's DMZ
◾ Learn about deployment environments
◾ Understand the difference between core and edge network devices
◾ Study virtual private networks and remote sites
◾ The Lockheed-Martin Cyber Kill-Chain
◾ Learn the parts of the Lockheed-Martin Cyber Kill-Chain
◾ Apply the Kill-Chain to malware that performed cryptomining
◾ Apply the Kill-Chain to three iterations of ransomware
◾ MITRE ATT&CK Framework
◾ Learn the classifications of the MITRE ATT&CK Framework
◾ Review a case study of OilRig campaigns with MITRE ATT&CK principles
◾ Review a case study of APT3 campaigns with MITRE ATT&CK principles
◾ Review a case study of APT28 campaigns with MITRE ATT&CK principles
Module 2 Windows Endpoint Introduction (25 topics)
◾ Windows Processes
◾ Gain a basic understanding of programs running within Windows
◾ Learn about Windows Services and their relationship with processes
◾ Review the common states of Windows Services
◾ Windows Registry
◾ Review the configuration structure of theWindows Registry
◾ Learn about the key-value pair relationship within the Windows Registry
◾ Understand the value types and formats for Windows Registry keys

Call US 408-759-5074 or UK +44 20 7620 0033
◾ Command Prompt, VBScript, and PowerShell

◾ Review the non-graphical means of interacting with Windows
◾ Build batch scripts used for the command prompt to run local commands
◾ Write a Visual Basic Script for collecting operating system
◾ Build custom PowerShell functions
◾ Programming on Windows
◾ Review the Component Object Model in Windows
◾ Learn about the development of the .NET Framework and .NET Core
◾ Windows Event Log
◾ Gain a basic understanding of Windows Event logs and sources
◾ Review several Windows Event logs using the Windows Event Viewer
◾ Use PowerShell to query Windows Event logs
◾ Empowering the Logs
◾ Gain a basic understanding of System Monitor Sysmon)
◾ Review Sysmon events using the Windows Event Viewer
◾ Review Sysmon events using PowerShell
◾ Use PowerShell Core in Kali Linux to query event logs remotely
Module 3 Windows Server Side Attacks (13 topics)
◾ Credential Abuse
◾ Learn about the Windows Security Account Manager
◾ Learn about Windows Authentication
◾ Understand the concept of suspicious login activity
◾ Evaluate the behavior of brute-force login activity
◾ Web Application Attacks
◾ Learn about the configuration of Internet Information Services IIS in Windows
◾ Evaluate logging artifacts of local file inclusion for attacking web servers
◾ Evaluate logging artifacts of command injection and file upload for attacking web servers
◾ Binary Exploitation
◾ Learn about binary attacks through buffer overflows, and the artifacts they create
◾ Study the use of Windows Defender Exploit Guard and how it protects against binary exploitation
◾ Evaluate logging artifacts generated by the Windows Defender Exploit Guard
Module 4 Windows Client Side Attacks (11 topics)
◾ Attacking Microsoft Office

◾ Review social engineering and spearphishing techniques
◾ Evaluate the use of Microsoft Office products to deploy phishing attacks

Call US 408-759-5074 or UK +44 20 7620 0033
◾ Review logging artifacts generated from a phishing attack

◾ Monitoring Windows PowerShell
◾ Gain a basic understanding of extended PowerShell logging capabilities
◾ Understand the use of PowerShell module logging
◾ Understand the use of PowerShell script block logging
◾ Understand the use of PowerShell transcription
◾ Review PowerShell logging artifacts generated from a phishing attack
◾ Learn about PowerShell obfuscation and deobfuscation
Module 5 Windows Privilege Escalation (8 topics)
◾ Privilege Escalation Introduction

◾ Gain a basic understanding of Windows integrity levels and enumeration
◾ Learn about Windows' User Account Control UAC
◾ Evaluate a UAC bypass technique and the logging artifacts it creates
◾ Escalations to SYSTEM
◾ Perform an elevation using UAC Bypass and review the logging artifacts created
◾ Learn about service permissions for privilege escalation along with relevant logging artifacts
◾ Learn about unquoted service paths for privilege escalat
Module 6 Linux Endpoint Introduction (9 topics)
◾ Linux Applications and Daemons

◾ Understand what Linux daemons are
◾ Understand the Syslog Framework components
◾ Understand how the syslog and the journal daemon work together
◾ Understand Linux web logging
◾ Automating the Defensive Analysis
◾ Understand how scripting can aid log analysis
◾ Understand how to scale further scripting with DevOps tools
◾ Understand how to put together what we learned in a real-life hunting scenario
Module 7 Linux Server-Side Attacks (6 topics)
◾ Credential Abuse
◾ Understand suspicious logins and how to detect them in logs
◾ Understand brute-force password attacks and their log footprints
◾ Web Application Attacks
◾ Understand command injection attacks and their log footprint and detections

Call US 408-759-5074 or UK +44 20 7620 0033
◾ Understand SQL injection attacks and their log footprint and detections
Module 8 Linux Privilege Escalation (6 topics)
◾ User-side privilege escalation attack detections

◾ Understand how Linux privileges works
◾ Understand how to detect privilege escalation attacks on user's configuration files
◾ System-side privilege escalation attack detections
◾ Understand how Linux privileges works
◾ Understand how to detect privilege escalation attacks on user's configuration files
Module 9 Windows Persistence (7 topics)
◾ Persistence on Disk
◾ Understand and recognize Persisting via Windows Service
◾ Understand and recognize Persisting via Scheduled Tasks
◾ Understand and recognize Persisting by DLLSideloading/Hijacking
◾ Persistence in Registry
◾ Understand Using Run Keys
◾ Understand Using Winlogon Helper
Module 10 Network Detections (10 topics)
◾ Intrusion Detection Systems

◾ Understand theory and methodologies behind IPS and IDS
◾ Understand Snort rule syntax
◾ Learn how to craft basic Snort rules
◾ Detecting Attacks
◾ Learn how to detect known vulnerabilities with Snort rules
◾ Learn how to detect novel vulnerabilities with Snort rules
◾ Detecting C2 Infrastructure
◾ Understand the components of a C2 framework
◾ Learn how to detect a well-known C2 communication through Snort rule sets
Module 11 Antivirus Detections (16 topics)
◾ Antivirus Basics
◾ Understand an Overview of Antivirus

Call US 408-759-5074 or UK +44 20 7620 0033
◾ Understand Signature-Based Detection

◾ Understand Heuristic and Behavioral-Based Detection
◾ Antimalware Scan Interface AMSI
◾ Understand the basics of AMSI
◾ Understand how attackers bypass AMSI
◾ Active Directory Enumeration
◾ Abusing Lightweight Directory Access Protocol
◾ Understand LDAP
◾ Interact with LDAP
◾ Enumerate Active Directory with PowerView
◾ Detecting Active Directory Enumeration
◾ Audit Object Access
◾ Perform Baseline Monitoring
◾ Use Honey Tokens
Module 12 Network Evasion and Tunneling (12 topics)
◾ Network Segmentation
◾ Understand the concept of network segmentation
◾ Learn the benefits of network segmentation
◾ Understand possible methods of implementing network segmentation in an enterprise
◾ Detecting Egress Busting
◾ Understanding the concept of egress filtering
◾ Understanding an iptables firewall setup and application of egress filtering
◾ Evaluate an 'egress busting' technique and the logging artifacts it creates
◾ Port Forwarding and Tunneling
◾ Understand the concept of tunneling and port forwarding
◾ Learn how attackers use it to compromise additional machines in the network
◾ Understand the possible methods and tools attackers use to tunnel into the network and how to detect
them
Module 13 Windows Lateral Movement (12 topics)
◾ Windows Authentication
◾ Understanding Pass the Hash
◾ Understanding Brute Forcing Domain Credentials
◾ Understanding Terminal Services
◾ Abusing Kerberos Tickets
◾ Understanding Pass the Ticket

Call US 408-759-5074 or UK +44 20 7620 0033
◾ Understanding Kerberoasting
◾ Active Directory Persistence
◾ Keeping Domain Access
◾ Understanding Domain Group Memberships
◾ Understanding Domain User Modifications
◾ Understanding Golden Tickets
Module 14 SIEM Part One: Intro to ELK (7 topics)
◾ Log Management Introduction

◾ Understand SIEM Concepts
◾ Learn about the ELK Stack
◾ Use ELK Integrations with OSQuery
◾ ELK Security
◾ Understand Rules and Alerts
◾ Understand Timelines and Cases
Module 15 SIEM Part Two: Combining the Logs (12 topics)
◾ Phase One: Web Server Initial Access

◾ Detect enumeration and command injection
◾ Implement Phase One detection rules
◾ Phase Two: Lateral Movement to Application Server
◾ Discover brute forcing and authentication
◾ Create Phase Two detection rules
◾ Phase Three: Persistence and Privilege Escalation on Application Server
◾ Understand persistence and privilege escalation
◾ Build Phase Three detection rules
◾ Phase Four: Perform Actions on the Domain Controller
◾ Identify dumping the AD database
◾ Create Phase Four detection rules
Prerequisites
Learners are required to have basic knolwedge in Networking, Linux and Windows OS.

OffSec SOC-200 (OSDA)

Uploaded by

Copyright:

Available Formats

OffSec SOC-200 (OSDA)

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

OffSec SOC-200 (OSDA)

Uploaded by

Copyright:

Available Formats

Course Outline & Schedule

Call US 408-759-5074 or UK +44 20 7620 0033

OffSec SOC-200 (OSDA)

Duration 5 Day Course

Price Available on request

Learners will learn how to:

Perpetual Solutions - Page 1 of 7

About the Exam:

The OSDA Exam Scheduling Open Now

Module 1 Attacker Methodology (14 topics)

◾ The Network as a Whole

Module 2 Windows Endpoint Introduction (25 topics)

Perpetual Solutions - Page 2 of 7

◾ Command Prompt, VBScript, and PowerShell

Module 3 Windows Server Side Attacks (13 topics)

Module 4 Windows Client Side Attacks (11 topics)

◾ Attacking Microsoft Office

Perpetual Solutions - Page 3 of 7

◾ Review logging artifacts generated from a phishing attack

Module 5 Windows Privilege Escalation (8 topics)

◾ Privilege Escalation Introduction

Module 6 Linux Endpoint Introduction (9 topics)

◾ Linux Applications and Daemons

Module 7 Linux Server-Side Attacks (6 topics)

Perpetual Solutions - Page 4 of 7

Module 8 Linux Privilege Escalation (6 topics)

◾ User-side privilege escalation attack detections

Module 9 Windows Persistence (7 topics)

Module 10 Network Detections (10 topics)

◾ Intrusion Detection Systems

Module 11 Antivirus Detections (16 topics)

Perpetual Solutions - Page 5 of 7

◾ Understand Signature-Based Detection

Module 12 Network Evasion and Tunneling (12 topics)

Module 13 Windows Lateral Movement (12 topics)

Perpetual Solutions - Page 6 of 7

Module 14 SIEM Part One: Intro to ELK (7 topics)

◾ Log Management Introduction

Module 15 SIEM Part Two: Combining the Logs (12 topics)

◾ Phase One: Web Server Initial Access

Perpetual Solutions - Page 7 of 7

You might also like