Visão Geral

Este curso aborda técnicas avançadas de Threat Hunting para investigação de ameaças sofisticadas, correlação de TTPs, análise comportamental, hunting em múltiplas fontes e desenvolvimento de detecções avançadas.

Objetivo

Após realizar este curso, você será capaz de:

• Desenvolver hunts avançados
• Correlacionar múltiplas fontes
• Investigar TTPs complexos
• Criar detecções comportamentais

Publico Alvo

• Threat Hunters
• Senior SOC Analysts
• Detection Engineers
• Blue Team

Pre-Requisitos

• Experiência com Threat Hunting
• Conhecimentos de SIEM
• Conhecimentos de Windows e Active Directory
• Familiaridade com MITRE ATT&CK
• Conhecimentos de incident response

Conteúdo Programatico

Module 1: Advanced Threat Hunting Methodology

1. Advanced hunting methodology
2. Threat-driven hunting
3. Intelligence-driven hunting
4. Hypothesis engineering
5. Adversary-centric hunting
6. Behavioral analytics
7. Hunt prioritization
8. Investigation depth
9. Hunt maturity
10. Advanced hunt documentation

Module 2: Advanced Data Analysis

1. Multi-source telemetry
2. Cross-platform correlation
3. Identity telemetry
4. Endpoint telemetry
5. Network telemetry
6. Cloud telemetry
7. Behavioral baselines
8. Anomaly detection
9. Statistical hunting
10. Advanced data correlation

Module 3: Advanced Credential and Identity Hunting

1. Credential Dumping
2. Kerberos attacks
3. NTLM attacks
4. DCSync
5. Golden Ticket
6. Silver Ticket
7. Privileged identity abuse
8. Authentication anomalies
9. Identity attack paths
10. Advanced credential hunting

Module 4: Advanced Endpoint Hunting

1. Process injection
2. DLL activity
3. PowerShell abuse
4. LOLBins
5. Persistence mechanisms
6. Defense Evasion
7. Suspicious execution
8. EDR telemetry
9. Behavioral detection
10. Advanced endpoint hunting

Module 5: Advanced Network Hunting

1. Command and Control
2. Beaconing
3. DNS anomalies
4. Encrypted traffic metadata
5. Network tunneling
6. Data exfiltration
7. Lateral Movement
8. Network behavior analytics
9. Network attack paths
10. Advanced network hunting

Module 6: Threat Actor and TTP Hunting

1. Threat actor profiling
2. TTP analysis
3. MITRE ATT&CK
4. Campaign analysis
5. Threat intelligence integration
6. Adversary behavior
7. Attack chain modeling
8. TTP correlation
9. Hunt prioritization
10. Threat actor hunting

Module 7: Advanced Detection Engineering

1. Behavioral detection
2. Multi-event correlation
3. Sequence-based detection
4. Anomaly detection
5. Detection engineering
6. Detection tuning
7. False positive reduction
8. ATT&CK coverage
9. Detection validation
10. Advanced detection strategy

Module 8: Advanced Threat Hunting Operations

1. Advanced hunt planning
2. Multi-source investigation
3. Attack reconstruction
4. Threat actor tracking
5. Detection development
6. Hunt automation
7. Investigation reporting
8. Defensive recommendations
9. Hunt maturity assessment
10. Advanced threat hunting case studies