1
1

00:00:00,360  -->  00:00:01,770
<v ->In this section of the course,</v>
2

2

00:00:01,770  -->  00:00:03,390
we're going to discuss how we can detect
3

3

00:00:03,390  -->  00:00:05,010
and analyze lateral movement
4

4

00:00:05,010  -->  00:00:08,820
and pivoting indicators of compromise, known as IOCs.
5

5

00:00:08,820  -->  00:00:11,040
Now we're again going to be focused on domain one,
6

6

00:00:11,040  -->  00:00:13,590
Security Operations, in this section of the course
7

7

00:00:13,590  -->  00:00:15,333
and specifically, objective 1.2.
8

8

00:00:16,200  -->  00:00:18,810
Objective 1.2 states that given a scenario,
9

9

00:00:18,810  -->  00:00:20,700
you must be able to analyze indicators
10

10

00:00:20,700  -->  00:00:22,650
of potentially malicious activity
11

11

00:00:22,650  -->  00:00:24,420
and we're going to be focused specifically
12

12

00:00:24,420  -->  00:00:26,790
on the lateral movement and pivoting indicators
13

13

00:00:26,790  -->  00:00:29,430
of compromise in this section of the course.
14

14

00:00:29,430  -->  00:00:31,620
Now as we move through this section, we're going to start
15

15

00:00:31,620  -->  00:00:33,120
out with a look at what lateral movement
16

16

00:00:33,120  -->  00:00:35,820
and pivoting really are and how we can detect them
17

17

00:00:35,820  -->  00:00:37,770
to be able to identify malicious activity
18

18

00:00:37,770  -->  00:00:40,230
within our workstations and our servers.
19

19

00:00:40,230  -->  00:00:42,750
Then we're going to move into some common IOCs
20

20

00:00:42,750  -->  00:00:44,280
or indicators of compromise
21

21

00:00:44,280  -->  00:00:45,300
as well as all the different types
22

22

00:00:45,300  -->  00:00:47,490
of them and how we can identify them.
23

23

00:00:47,490  -->  00:00:49,590
This includes things like identifying attacks
24

24

00:00:49,590  -->  00:00:52,410
like passing the hash, using a golden ticket,
25

25

00:00:52,410  -->  00:00:55,320
or other lateral movement and pivoting techniques.
26

26

00:00:55,320  -->  00:00:57,420
Finally, we're going to take a short quiz to see
27

27

00:00:57,420  -->  00:00:59,340
what you learned during this section of the course
28

28

00:00:59,340  -->  00:01:01,140
and review each of those questions fully
29

29

00:01:01,140  -->  00:01:04,380
to ensure you can explain why the right answers are right.
30

30

00:01:04,380  -->  00:01:06,720
So let's go ahead and analyze our workstations
31

31

00:01:06,720  -->  00:01:09,090
and servers to see if we find any lateral movement
32

32

00:01:09,090  -->  00:01:10,830
and pivoting indicators of compromise
33

33

00:01:10,830  -->  00:01:13,833
across your systems inside this section of the course.