Cyber Threat Hunting

Overview

Class Central Tips

This course teaches you the necessary skills to becoming a successful threat hunter. As you progress through the modules, you'll build core hunting skills such as intelligence gathering, investigation techniques and remediation methods. Upon completion, you'll have the knowledge and skills to carry out cyber threat hunting activities with an organization that will ultimately deliver proactive defenses against possible debilitating data compromise.

Syllabus

Cyber threat hunting introduction

In this introductory module with Keatron Evans, you'll explore cyber threat hunting: defining it, skills required, hunt modeling with hypotheses, implementation benefits and more.

Threat hunting artifacts and types

In this module, you'll explore what's needed for a really effective threat-hunting program. You'll also learn about artifacts, indicators of compromise, tactics, techniques and procedures, the Pyramid of Pain and many more insights from Keatron.

Threat hunting techniques and generative AI

Explore the concepts of anomalous activity and investigation. The purpose of this module is to help the threat hunter identify whether an anomalous activity is a threat. Explore how to investigate, walking through the information and identifying any issues right away. In this course, Keatron uses generative AI to quickly find malicious activity.

Threat hunting methodologies

In this module, you'll explore the differences between structured and unstructured hunts with Keatron. You will also get into entity-driven hunting.

Threat hunting data and technologies

In this course, Keatron will take you through different data sources that you may hunt through. These include SIEMs, EDR and XDR logs, threat intelligence platforms and several other data sources.

Cyber threat hunting process

In this course, you will learn how to build a hunt. Keatron gets into the details of all the things the learner must consider when building out a hunt and scoping. We also discuss lessons learned and proper execution.

Cyber threat hunting scenarios

In this course, you'll see how different threat hunting scenarios play out. We will use real-world examples to illustrate how we form a hypothesis all the way through lessons learned.

Hunting for network-based threats

In this course, we will go on a deep dive with Keatron concerning network-based threats, including DNS, DDoS and irregular traffic, plus more. This course will include some labs and demonstrations. Locate even the hardest-to-find malware with these techniques.

Hunting for host-based threats

In this course, Keatron will walk through various host-based threats and indicators. There will be labs and demonstrations that include memory forensics, PowerShell and Windows event log parsing.