|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/learning-to-attck-and-defend-with-powershell/
课程评论：没有评论
课程名称：学习使用 PowerShell 进行 ATT&CK 和防御 课程概述：本课程的核心思想源自孙子所言：“知己知彼，百战不殆。”本课程旨在教授基本的进攻战术概念，通过 PowerShell 进行实操。您将了解攻击者使用 PowerShell 的各种选项，并通过 MITRE ATT&CK 框架来分类和 contextualize 各种攻击和战术。课程还将帮助学员了解自己和环境，识别 PowerShell 执行的可用选项。在看过各种进攻战术后，您将学习如何在 Windows 环境中使用本地工具监测和检测这些战术。 学习目标： 1. 了解 PowerShell 如何在 Windows 系统中执行，与进攻和防御技术的关系。 2. 掌握如何使用 PowerShell 进行攻击生命周期中的各个环节。 3. 理解并能够检测和减轻 PowerShell 执行的防御策略。 课程结束时，学员将能够描述攻击者如何利用 PowerShell 危害组织，并能够解释和实施针对这些攻击的防御措施。 课程具体涵盖的技术和战术包括： - PowerShell 在 Windows 系统中的执行过程 - 如何使用 PowerShell 执行本地 Windows 命令和程序 - 下载 Cradles 及其用途 - 将可执行文件注入内存并通过 PowerShell 执行 - 使用 PowerShell 创建持久化机制 - 通过 Windows 服务滥用进行特权升级 - 使用 PowerShell 进行主机级和网络级侦察 - 使用 PowerShell 查找文件、Windows Credential Manager 和进程内存中的凭证 - 使用 PS-Remoting 从非域加入的 Linux 机器远程登录到 Windows 机器（进行中） - 使用 PowerShell 通过 TCP、UDP、HTTP 等协议进行数据外泄 - 识别上述攻击的同时启用本地 Windows 日志机制以跟踪这些攻击 本课程专注于检测而非完全禁用 PowerShell，因此建议学员集中精力于检测技术的学习。
As Sun Tzu said: "Know thy enemy and know yourself; in a hundred battles, you will never be defeated. When you are ignorant of the enemy but know yourself, your chances of winning or losing are equal. If ignorant both of your enemy and of yourself, you are sure to be defeated in every battle."This course aims to teach basic, offensive tactical concepts, using PowerShell to do so.Know your adversary. Become familiar with what options are available to an attacker with the ability to execute PowerShell. Using the MITRE ATT & CK framework as a vehicle to help categorize and contextualize the various attacks and tactics performed by adversaries. Know your self and your environment by knowing what options are available for identifying PowerShell execution within your environment. After having seen various offensive tactics, see how these tactics can be detected and monitored for within a Windows environment, using all native (to Windows) tooling.To be clear, the only way to completely disable PowerShell is through application whitelisting. As such, I recommend focusing your efforts on detection.The expected learning outcomes for this course are as follows:Gain a high-medium level understanding of how PowerShell execution occurs on Windows systems in relation to offensive and defensive techniques.Gain the ability and understanding of how to use PowerShell to perform the various portions of an Attack Lifecycle.Gain the ability and understanding of detecting and mitigating PowerShell Execution from the position of a defender.By the end of the course, one should be able to describe how an attacker may use PowerShell to compromise an organization, as well as being able to explain and implement defenses against such attacks and attackers.This course specifically covers the following techniques and tactics:How is PowerShell executed on a Windows system? (What happens beyond the scenes to make PowerShell work?)How to execute native Windows commands and programs using PowerShell;Download Cradles, and how they can be used;Injecting a executable binary into memory and then executing it using PowerShell;Creating a persistence mechanism using PowerShell Profiles;Performing Privilege Escalation through Windows service abuse using PowerShell;Performing Host-based reconnaissance using PowerShell;Performing Network-based reconnaissance using PowerShell;Looking for credentials in files, in Windows Credential Manager, and in process memory using PowerShell;(In-Progress)Using PS-Remoting to remotely login to a Windows machine from a non-domain joined Linux machine;Using PowerShell to exfiltrate data over the network using TCP, UDP, HTTP and other protocols;(In-Progress)How to identify the above attacks, while also enabling native-to-Windows logging mechanisms to track the above attacks.
