Overview
SANS SEC541 Cloud Security Attacker Techniques, Monitoring, and Threat Detection is a crucial course focused on cloud threat detection, security monitoring, and analysis. Throughout the course, you’ll dive deep into attacker techniques and gain insights into how they operate within cloud environments. You’ll also explore the capabilities of cloud logging and security tools, learning how to utilize them effectively to detect and respond to potential threats. The course covers detection engineering in the cloud, providing a comprehensive understanding of how to design strong, efficient threat detection systems. By the end, you’ll be equipped with the skills and knowledge to analyze attacks and build a solid security engineering program.
At the start of each section, SEC541 includes an in-depth examination of real-world attack campaigns targeting AWS or Azure cloud infrastructure. This breakdown of tactics and techniques will help you understand how the attack unfolded and what could have been done to detect it. Following the analysis, you’ll learn how to use cloud-native and cloud-integrated tools to detect, hunt, and investigate similar attacks in real environments. The course emphasizes building analytics, detections, and best practices, focusing on AWS and Azure services to analyze logs and behaviors. By the end, you’ll have a solid understanding of how to detect and analyze cloud-based threats, along with practical skills you can apply directly to your cloud infrastructure.
The course contains must-have knowledge to start with the threat hunting job in AWS/Azure.” – Mikolaj Staniucha, PepsiCo
Business Takeaways
- Decrease the average time an attacker is in your cloud environment.
- Help your organization properly set up logging and configuration for improved detection engineering.
- Decreases the risk of costly attacks by understanding and leveraging cloud-specific security services.
- Lessen the impact of breaches that do happen.
- Learn how to fly the plane, not just the ability to read the manual.
Skills Learned
- How to research attacks and threats to cloud infrastructure
- Break down a threat into detectable components.
- Understand approaches for improved detection engineering.
- Effectively use AWS and Azure core logging services to detect suspicious behaviors.
- Use cloud-native API logging as the newest defense mechanism in cloud services.
- Move beyond the cloud-provided web consoles to perform complex analysis.
- Perform network analysis with cloud network logging.
- Understand how application logs can be collected and analyzed inside the cloud environment.
- Effectively put into practice the AWS and Azure security-specific services.
- Integrate container, operating system, and deployed application logging into cloud logging services for more cohesive analysis.
- Perform an inventory of cloud resources and sensitive data using scripts and cloud-native tooling.
- Analyzing Microsoft 365 activity to uncover threats.
- Ability to leverage cloud-native architecture to automate response actions to attacks.
Click to AWS Certified SysOps Administrator Official Study Guide
Hands-on Training
The labs in this course are hands-on explorations into AWS and Azure logging and monitoring services. About 75% of labs are AWS and 25% Azure.
Each lab will start by researching a particular threat and the data needed to detect it. In most labs, the students will conduct the attack against their accounts, generating the logs and data needed to perform analysis. Students will use native AWS & Azure services and open-source products to extract, transform, and analyze the threat. The course lecture coupled with the labs will give students a full picture of how those services within AWS & Azure work, the data they produce, common ways to analyze the data, and walk away with the ability to discern and analyze similar attacks in their own cloud environment.
- Section 1: SEC541 environment deployment, analyzing cloud API logs with CloudTrail, parsing JSON-formatted logs with JQ, network analysis
- Section2: Environment setup, application/OS log lab with OpenCanary, CloudWatch agent and customization, strange ECS behavior, finding data exfiltration
- Section 3: Metadata services and GuardDuty, cloud inventory, discovering sensitive data in unapproved location with Macie, vulnerability assessment with Inspector, data centralization with Graylog
- Section 4: Microsoft 365 Exchange investigation, introduction to Kusto Query Language, log analytics analysis using Azure CLI, Microsoft Defender for Cloud and Sentinel, Azure network traffic analysis
- Section 5: Setup the automate forensics workflow, analyze the results, participate in the CloudWars Challenge
“Using the labs was easy with well documented instructions. I like the fact that I could easily copy and paste the commands. This helps me to get through the lab fast but I also know that I can come back later after the course and take the time to review each command.” – Ludek Suk, Accenture
“Labs are awesome, and they all work! Learning a ton from these.” – Joe Cultrara
“The lab guide is very detailed. Allowing me to learn and understand what I was doing. They also provided us with sufficient time to complete the labs and we were never rushed into doing anything.” – Sambit Sarkar, ICE Data Services
Syllabus Summary
- Section 1: Detecting adversarial activity in your cloud environment through management plane and network logging & analysis.
- Section 2: Dig deeper into your applications and compute systems running within the cloud environment.
- Section 3: Understanding your deployed cloud environment to easily identify deviation from organizational policy and potential malice.
- Section 4: Deep dive into Azure’s ecosystem and the unique threats that can occur.
- Section 5: Learn to automate response actions in your cloud environment and put your new skills to the test in a Capture the Flag event.
Download Links
Download ebook
Download Part1
Download Part2
Download Part3
Download Part4
Download Part5
Download Part6
Download Part7
Download Part8
Download Part9
- Design