In this course, you will dive into the workstation. You will be introduced to the Windows OS where you will learn how to detect what’s in plain sight, and whether it is normal or potentially malicious. Also introduced are techniques on how to track malicious behavior on the endpoint/s through lateral movement and how to use certain tools to assist you with this task across thousands of endpoints. You will learn to detect Mimikatz, malicious macros, code injection, Kerberos attacks and more, using various detection methods. Finally, you will also get familiar with how malware operates and how you can detect their operations in memory. During endpoint hunting, you will leverage numerous endpoint detection solutions as well as popular SIEM such as Splunk and the ELK stack.
This course is part of the Threat Hunting Professional Learning path which prepares you for the eCTHPv2 exam and certification.
