Module 04 · Dhexe

Windows & Active Directory ee SOC Analyst-ka

Windows & Active Directory for SOC Analysts

Waxaad si adag u fahmi doontaa Windows internals, Event Logs, Active Directory, PowerShell iyo sida SOC analyst uga baaro weerarrada ku dhacaan environments-ka Windows/AD-ga.

9 cashar 2 saac 0/9 dhammaystiran

Casharrada

1Windows Fundamentals ee SOC-gaWindows Fundamentals for SOC AnalystsBaro qaybaha muhiimka ah ee Windows oo SOC analyst la xiriira: Task Manager, Event Viewer, Services iyo Registry.10 daq 2Windows Event Logs & Event IDsWindows Event Logs and Key Event IDsXifdiso Event IDs-ka ugu muhiimsan ee SOC analyst isticmaalo si uu u ogaado login activity, user changes iyo privilege changes.12 daq 3Active Directory FundamentalsActive Directory FundamentalsFaham sida Active Directory u maamusho users, computers iyo permissions shirkad dhexdeeda.13 daq 4Authentication: Kerberos & NTLMWindows Authentication: Kerberos and NTLMFaham sida Windows authentication u shaqeeyo iyagoo isticmaalaya Kerberos iyo NTLM, iyo sababta ay muhiim ugu yihiin attack detection.15 daq 5Windows Services & Scheduled TasksWindows Services and Scheduled TasksBaro sida services iyo scheduled tasks Windows u shaqeeyaan, iyo sida attackers ay u isticmaalaan persistence.11 daq 6Windows Registry & PersistenceWindows Registry and Persistence TechniquesFaham structure-ka Registry-ga iyo meelaha ugu caansan ee malware isticmaalo si uu ugu sii jiro system-ka.14 daq 7PowerShell ee SOC Analyst-kaPowerShell for SOC AnalystsBaro aasaaska PowerShell, cmdlets caan ah iyo sababta ay tahay hab caan ah oo attackers isticmaalaan.12 daq 8Weerarrada Caanka ah ee Windows & ADCommon Windows and Active Directory AttacksFaham weerarrada AD ugu caansan sida Pass-the-Hash, Kerberoasting iyo Golden Ticket — iyo sida loo ogaado.10 daq 9Windows Investigation — Full Capstone LabWindows Investigation Capstone LabKu dar dhammaan waxa aad baratay module-kan — samee investigation buuxa oo Windows/AD environment ah oo laga yaabo in la jebiyay.15 daq