-: In this section of the course, 2 2
we're going to discuss how we can detect and analyze 3 3
application-related indicators of compromise, known as IOCs. 4 4
We're going to continue to focus on domain one, 5 5
security operations, in this section of the course, 6 6
and specifically objective 1.2. 7 7
Objective 1.2 states that given a scenario, 8 8
you must be able to analyze indicators 9 9
of potentially malicious activity. 10 10
So in this section, we're going to focus solely 11 11
on the application-related indicators of compromise 12 12
that are listed underneath this objective. 13 13
As we begin to move throughout this section, 14 14
we're going to start out 15 15
by looking at exactly what an application-related IOC is 16 16
and how they're used to detect malicious activity 17 17
within our workstations and our servers. 18 18
Then, we're going to move into some common IOC types 19 19
and how to identify them. 20 20
This includes identifying anomalous activity, 21 21
service interruptions, analyzing application logs, 22 22
and how to detect new accounts that have been created 23 23
on your systems. 24 24
Next, we're going to cover forensics for virtualized systems, 25 25
applications, and mobile devices 26 26
during this section of the course as well, 27 27
because these are more focused on application-related IOCs 28 28
in your forensic efforts on these types of systems, 29 29
then looking at them from a purely network 30 30
or host-based perspective. 31 31
And finally, we're going to take a short quiz 32 32
to see what you learned during this section of the course 33 33
and review each of those quiz questions fully, 34 34
to ensure you can explain why the right answers were right. 35 35
So, let's start analyzing our applications 36 36
to see if we can find indicators of compromise 37 37
in this section of the course.