-: In this section of the course, 2 2
we're going to cover endpoint monitoring. 3 3
Now, our focus in this section of the course 4 4
is going to continue to be 5 5
in Domain One with Security Operations, 6 6
and specifically Objectives, 1.1 and 1.3. 7 7
Objective 1.1 states 8 8
that you must be able to explain the importance 9 9
of system and network architecture concepts 10 10
in security operations, 11 11
with our focus here being on the Windows Registry, 12 12
system processes and file structures of a system 13 13
whenever malware is attacking that system. 14 14
Objective 1.3 on the other hand, 15 15
states that given a scenario, 16 16
you must be able to use appropriate tools or techniques 17 17
to determine malicious activity. 18 18
This includes things like sandboxing, 19 19
EDR, or endpoint detection response, 20 20
creating a allow list and block list 21 21
to be able to control access and permissions 22 22
to execute various files and things like that. 23 23
Now, as we move through this section, 24 24
we're going to start out with a discussion 25 25
of the methods of endpoint data collection and analysis 26 26
that we're going to be able to use within our organizations. 27 27
Then, we're going to explore the concept of sandboxing 28 28
and how it's used for malware analysis. 29 29
Speaking of malware analysis, 30 30
we're also going to cover the idea of reverse engineering, 31 31
where an analyst tries to take a compiled piece of software 32 32
and determine how it really operates underneath its code. 33 33
Next, we're going to discuss 34 34
the different types of malware exploitation techniques 35 35
such as droppers, downloaders, shell code, code injection 36 36
and Living off the Land. 37 37
After that, we're going to cover the use of behavioral analysis 38 38
to identify known good and anomalous behavior, 39 39
as well as performing a hands-on demonstration 40 40
to show you how to conduct malware analysis using tools 41 41
like Process Explorer, netstat, Process Monitor, 42 42
System Monitor, auto-runs, and many others. 43 43
Next, we're going to discuss the configuration changes 44 44
used with EDR, or endpoint detection and response systems, 45 45
to increase the security of your endpoints, 46 46
as well as how you can use 47 47
block list and allow list in your configurations 48 48
to better protect your devices. 49 49
Finally, we're going to take a short quiz 50 50
to see what you learned during this section of the course, 51 51
and, of course, we're going to review 52 52
the answers to those quiz questions 53 53
to ensure you understand why the right answers were right. 54 54
As you can see, it's going to be a really busy section, 55 55
with a lot of stuff for us to cover, 56 56
so let's go ahead and get started 57 57
in this section of the course.