A Process is No One - Hunting for Token Manipulation

This course presents a hypothesis-driven approach to threat hunting and applies it to detecting Windows access token manipulation. It covers authentication and logon sessions, MITRE ATT&CK tactics and procedures, targeted forensic collection, and analysis of suspicious processes and Kerberos activity.

Syllabus

Introduction
What is Hunting
Normal Hunt Cycle
Hypothesis Driven Hunting
Benefits
HypothesisDriven Hunting
Hacker Lifecycle
Mitre Attack Framework
Tactics Techniques Procedures
Tactics
Procedures
Why is this useful
What is this process
Building the hunt hypothesis
Identifying the tactic
Identifying the procedures
Scope
Documentation
Conclusion
Benefit
Tactics and Techniques
Access Token Manipulation
Windows Authentication
Access tokens
Token types
General overview
Token impersonation
Visualization
Create a Process
Make an Impostor Token
Create a New logon session
Collection Requirements
Collecting Access Tokens
Get Access Token
Impersonation
GetSystem
Kerberos ticket granting ticket
Get Kerberos ticket granting ticket
Make token attack
Scope of analysis
Excluded factors
Demo
Questions