-: In this section of the course, 2 2
we're going to discuss how you can detect 3 3
and analyze network indicators or compromise. 4 4
We're going to continue to focus 5 5
on Domain One, Security Operations 6 6
in this section of the course, 7 7
and specifically we'll be looking at Objective 1.2. 8 8
Objective 1.2 states that given a scenario, 9 9
you must be able to analyze indicators 10 10
of potentially malicious activity. 11 11
Now, in this section of the course, 12 12
we're going to focus only on network-based IOCs, 13 13
but we are going to be moving into host-based IOCs 14 14
and application-based IOCs, as well as lateral movement 15 15
and pivoting IOCs in the next few sections of this course. 16 16
But as we move through this section of the course, 17 17
we are going to start by looking at what exactly is 18 18
a network-based IOC and how they're going to be used. 19 19
Then we're going to move 20 20
into some common IOC types and identify those as well. 21 21
This includes things like traffic spikes, beaconing, 22 22
irregular peer-to-peer communication channels, 23 23
rogue devices, scans and sweeps, 24 24
and non-standard port usage. 25 25
Next, we're going to spend a little bit 26 26
of time discussing some common TCP and UDP ports 27 27
because, after all, if you don't know what a normal port is, 28 28
it's going to be really hard to understand what might be 29 29
considered to be a non-standard port usage, right? 30 30
Well, then we're going to move 31 31
into looking at the data exfiltration techniques 32 32
and covert channels that could be used by attackers 33 33
and we'll figure out how we can identify indicators 34 34
or compromise based around these techniques. 35 35
After that, I'm going to be performing a demonstration 36 36
where we're going to analyze some network-based IOCs 37 37
inside of my lab environment, 38 38
so you can better understand what various attacks look like 39 39
when you're working as a cybersecurity analyst. 40 40
Finally, we're going to take a short quiz to see 41 41
what you learned during this section of the course 42 42
and review each of those quiz questions fully to ensure 43 43
you can explain why the right answers were correct. 44 44
So let's start analyzing networks to see 45 45
if we can find any indicators 46 46
or compromise in this section of the course.