Visão Geral

Este curso aprofunda técnicas de investigação e resposta a incidentes complexos, incluindo ataques avançados, comprometimento de identidades, persistência, movimentação lateral e investigação de ameaças.

Objetivo

Após realizar este curso, você será capaz de:

• Investigar incidentes complexos
• Reconstruir cadeias de ataque
• Analisar evidências avançadas
• Conduzir contenção e recuperação

Publico Alvo

• Incident Responders
• DFIR Professionals
• SOC e Blue Team
• Cybersecurity Professionals

Pre-Requisitos

• Experiência com incident response
• Conhecimentos de Windows e Linux
• Conhecimentos de redes
• Familiaridade com SIEM e EDR
• Conhecimentos básicos de Digital Forensics

Conteúdo Programatico

Module 1: Advanced Incident Response

1. Advanced incident response methodology
2. Complex incident scenarios
3. Multi-stage attacks
4. Advanced threat actors
5. Incident scoping
6. Investigation prioritization
7. Response coordination
8. Advanced evidence sources
9. Incident command
10. Advanced response planning

Module 2: Advanced Threat Investigation

1. Attack chain reconstruction
2. Timeline analysis
3. Threat actor behavior
4. Initial Access analysis
5. Persistence analysis
6. Credential Access
7. Privilege Escalation
8. Lateral Movement
9. Command and Control
10. Impact assessment

Module 3: Advanced Identity Investigation

1. Identity compromise
2. Credential theft
3. Kerberos investigation
4. NTLM investigation
5. Privileged account abuse
6. Active Directory compromise
7. DCSync indicators
8. Golden Ticket investigation
9. Authentication timeline
10. Identity remediation

Module 4: Endpoint Investigation

1. Endpoint telemetry
2. Process analysis
3. PowerShell investigation
4. Persistence mechanisms
5. Malware analysis
6. EDR investigation
7. Memory analysis concepts
8. File system investigation
9. Registry analysis
10. Endpoint compromise assessment

Module 5: Network Investigation

1. Network attack analysis
2. DNS investigation
3. HTTP and HTTPS traffic
4. Network connections
5. Command and Control
6. Lateral Movement
7. Network anomalies
8. Traffic correlation
9. Network containment
10. Network evidence analysis

Module 6: Advanced Containment and Eradication

1. Enterprise containment
2. Identity containment
3. Network containment
4. Endpoint containment
5. Credential revocation
6. Persistence eradication
7. Threat actor removal
8. Security control reinforcement
9. Eradication validation
10. Recovery planning

Module 7: Threat Intelligence and Attribution

1. Threat intelligence
2. Threat actor profiling
3. Campaign analysis
4. IOC enrichment
5. TTP analysis
6. MITRE ATT&CK
7. Intelligence correlation
8. Attribution limitations
9. Intelligence reporting
10. Threat intelligence integration

Module 8: Advanced Incident Simulation

1. Complex incident scenario
2. Initial triage
3. Evidence collection
4. Attack reconstruction
5. Threat hunting
6. Containment
7. Eradication
8. Recovery
9. Executive reporting
10. Advanced incident response case study