-: In this section of the course, 2 2
we're going to discuss how you can detect 3 3
and analyze host-related indicators of compromise. 4 4
We're going to continue to focus on domain one, 5 5
security operations in this section of the course 6 6
and specifically, on objective 1.2. 7 7
Objective 1.2 states that given a scenario, 8 8
you must be able to analyze indicators 9 9
of potentially malicious activity. 10 10
So in this section of the course, we're going to be focused 11 11
on host-related IOCs or indicators of compromise. 12 12
As we move through this section, we're going to be looking 13 13
at exactly what a host-related indicator of compromise is 14 14
and how they can be used to detect malicious activity 15 15
within our workstations and servers. 16 16
After that, we're going to be moving 17 17
into some common IOC types and how do identify them. 18 18
This includes things like malicious processes, 19 19
conducting memory forensics, 20 20
analyzing processor consumption, 21 21
analyzing disk or file system consumption, 22 22
identifying unauthorized privileges in use, 23 23
scanning for unauthorized software, 24 24
detecting unauthorized changes or hardware additions, 25 25
and a concept of maintaining persistence. 26 26
Finally, we're going to take a short quiz 27 27
to see what you learned during this section of the course 28 28
and review each of those quiz questions 29 29
to ensure you understand why the right answers were right. 30 30
So let's start analyzing our workstations and servers to see 31 31
if we can identify some host-related IOCs 32 32
in this section of the course.