Download the Full Cybrscore Lab Library
Total Page：16
File Type：pdf, Size：1020Kb
Lab Name Lab Description Lab Series NSA CAE KU's Platform Expected Duration Maximum Duration Average Duration Average Startup Duration Active Directory's are an important part of many organizations' IT structure. Thus, Active Directory security is just as important and there are several best practices to follow. This Active Directory Security Checkup Capstone CYBRScore Capstones Windows System Administration (WSA), Topics: 13 Cybersecurity Principles (CSP), Topics: j; Hyper-V 1 Hour, 30 Minutes 1 Hour, 30 Minutes 28 minutes, 44 seconds 1 minute, 41 seconds capstone tests a student's ability to manage an Active Directory while implementing Operating System Concepts (OSC), Topics: 1, 9 those best practices. Students will leverage Nmap, a network discovery and mapping tool, to identify the Additional Scanning Options systems on a network of responsibility. Students will utilize non-traditional scans to CYBRScore Scored Labs Penetration Testing (PTT), Topics: 3, 4, 5, 6, 8, 9, 10 Hyper-V 45 Minutes 45 Minutes 22 minutes, 36 seconds 1 minute, 40 seconds attempt avoiding an Intrusion Detection System (IDS). Students will leverage Nmap, a network discovery and mapping tool, to identify the Additional Scanning Options systems on a network of responsibility. Students will utilize non-traditional scans to CYBRScore Labs Penetration Testing (PTT), Topics: 3, 4, 5, 6, 8, 9, 10 Hyper-V 45 Minutes 45 Minutes 37 minutes, 46 seconds 34 seconds attempt avoiding an Intrusion Detection System (IDS). Students will leverage Nmap, a network discovery and mapping tool, to identify the Additional Scanning Options systems on a network of responsibility. Students will utilize non-traditional scans to CYBRScore Network Forensics Penetration Testing (PTT), Topics: 3, 4, 5, 6, 8, 9, 10 Hyper-V 45 Minutes 45 Minutes 19 minutes, 14 seconds 44 seconds attempt avoiding an Intrusion Detection System (IDS). MAL600 exposes students to the theoretical knowledge and hands-on techniques to reverse engineer malware that was designed to thwart the most common reverse engineering techniques. The students learn how to identify and analyze the presence of advanced packers, polymorphic malware, encrypted malware, and malicious code armored with anti-debugging and anti-reverse engineering techniques. Students gain a high-level understanding of complex malware analysis techniques and spend a significant amount of time solving hands-on challenges throughout the course. This course is for Advanced Malware Analysis Labs malware analysts, or aspiring analysts, who have already taken CYBRScore’s MAL400 CYBRScore Labs Software Security Analysis (SSA); Topics: 1, 2, 3, 4, 5 vSphere 40 Hours 41 Hours, 40 Minutes 6 minutes, 59 seconds 12 seconds (Fundamentals of Malware Analysis) and MAL500 (Reverse Engineering Malware) courses. Those who have encountered malware analysis as part of incident response, research, or secure development and want to improve upon their knowledge and skills may also find this course beneficial. Students should have intermediate malware analysis skills, the ability to read and understand moderately complex high-level language code constructs in assembly, familiarity with Windows API, networking, and scripting, and finally, experience with IDA Pro, Olly, Immunity, or another similar application. Students will use the SysInternals Suite of utilities to analyze processes, DLLs, registry Advanced Techniques for Malware Recovery edits and other auto start functions to locate and remove malicious software from an CYBRScore Scored Labs Software Security Analysis (SSA); Topics: 1, 2, 3, 4, 5 Hyper-V 1 Hour, 5 Minutes 2 Hours 44 minutes, 11 seconds 1 minute, 21 seconds infected Windows 7 victim machine. Students will use the SysInternals Suite of utilities to analyze processes, DLLs, registry Advanced Techniques for Malware Recovery edits and other auto start functions to locate and remove malicious software from an CYBRScore Labs Software Security Analysis (SSA); Topics: 1, 2, 3, 4, 5 Hyper-V 1 Hour, 5 Minutes 2 Hours 23 minutes, 23 seconds 35 seconds infected Windows 7 victim machine. Students will do a Vulnerability Assessment on a network. Students will then analyze the Analysis and Recommendation Report CYBRScore Labs Operating Systems Hardening (OSH), Topics: 11; IT Systems Components (ISC), Topics: 13 Hyper-V 2 Hours 2 Hours 38 minutes, 42 seconds 33 seconds results and place them in a Recommendation Report. Students will do a Vulnerability Assessment on a network. Students will then analyze the Analysis and Recommendation Report CYBRScore Scored Labs Operating Systems Hardening (OSH), Topics: 11; IT Systems Components (ISC), Topics: 13 Hyper-V 2 Hours 2 Hours 1 minute, 49 seconds 1 minute, 9 seconds results and place them in a Recommendation Report. In this lab you will attempt to conduct basic analysis on some malware samples that were Analyze and Classify Malware CYBRScore Labs Software Security Analysis (SSA); Topics: 1, 2, 3, 4, 5 Hyper-V 1 Hour 1 Hour 29 minutes, 14 seconds 20 seconds found on the internal network. In this lab you will attempt to conduct basic analysis on some malware samples that were Analyze and Classify Malware CYBRScore Scored Labs Software Security Analysis (SSA); Topics: 1, 2, 3, 4, 5 Hyper-V 1 Hour 1 Hour 20 minutes, 12 seconds 1 minute, 37 seconds found on the internal network. Students will become familiar with the Business Continuity Plan (BCP), Business Impact Assessment (BIA), Disaster Recovery Plan (DRP) and Computer Incident Response Plan (CIRP). Each of these documents are used to address different, but related, aspects of Analyze and Update a Company BCP/BIA/DRP/CIRP continuing or recovering business functionality during/after an incident. CYBRScore Labs Cybersecurity Planning and Management (CPM); Topics: 2, 4, 5, 6, 8, 9 Hyper-V 1 Hour, 30 Minutes 2 Hours 13 minutes, 14 seconds 28 seconds During the course of the lab, students will perform a gap analysis using the provided BCP, BIAs and DRP, and make the necessary fixes to the DRP. Students will become familiar with the Business Continuity Plan (BCP), Business Impact Assessment (BIA), Disaster Recovery Plan (DRP) and Computer Incident Response Plan (CIRP). Each of these documents are used to address different, but related, aspects of Analyze and Update a Company BCP/BIA/DRP/CIRP continuing or recovering business functionality during/after an incident. CYBRScore Scored Labs Cybersecurity Planning and Management (CPM); Topics: 2, 4, 5, 6, 8, 9 Hyper-V 1 Hour, 30 Minutes 2 Hours 38 minutes, 6 seconds 1 minute, 15 seconds During the course of the lab, students will perform a gap analysis using the provided BCP, BIAs and DRP, and make the necessary fixes to the DRP. Students will identify a browser-based attack used against a corporate asset using a Analyze Browser-based Heap Spray Attack network protocol analyzer. Students will determine the type of attack used and pinpoint CYBRScore Labs Penetration Testing (PTT), Topics: 3, 4, 5, 6, 8, 9, 10 Hyper-V 43 Minutes 1 Hour 53 minutes, 50 seconds 17 seconds exploit code in network traffic. Students will use popular system analysis tools on an infected machine in order to Analyze DoomJuice Infection to Identify Attack Vector and Payload identify signs of infection. Afterwards, students will manually remove malware from the CYBRScore Labs Penetration Testing (PTT), Topics: 3, 4, 5, 6, 8, 9, 10 Hyper-V 45 Minutes 1 Hour, 30 Minutes 11 minutes, 30 seconds 57 seconds system. Students will use the open source Volatility tool to analyze a memory snapshot and Analyze Malicious Activity in Memory Using Volatility CYBRScore Scored Labs Software Security Analysis (SSA); Topics: 1, 2, 3, 4, 5 Hyper-V 1 Hour 2 Hours 26 minutes, 23 seconds 1 minute determine what malicious software has infected the victim machine. Students will use the open source Volatility tool to analyze a memory snapshot and Analyze Malicious Activity in Memory Using Volatility CYBRScore Labs Software Security Analysis (SSA); Topics: 1, 2, 3, 4, 5 Hyper-V 1 Hour 2 Hours 11 minutes, 11 seconds 20 seconds determine what malicious software has infected the victim machine. Students will take some time to review malicious traffic within a controlled environment. Using Wireshark and some pointers from a previous technical report on the FlashPack Analyze Malicious Network Traffic CYBRScore Labs Network Defense (NDF), Topics: 1a, 1c, 1d, 2a, 2b, 4a Hyper-V 1 Hour, 30 Minutes 3 Hours 37 minutes, 30 seconds 28 seconds Exploit Kit, they will focus their attention on finding (in two traffic captures) evidence of when and how a victim system was infected with the exploit kit. Students will use the CFF Explorer and Hacker Process tools in order to perform an initial Analyze Packed Executable to Identify Attack Vector and Payload CYBRScore Labs Software Security Analysis (SSA); Topics: 1, 2, 3, 4, 5 Hyper-V 45 Minutes 1 Hour, 30 Minutes 1 minute, 5 seconds 18 seconds analysis of a suspicious executable. Students will use a handful of tools to analyze a provided suspicious file. Using CFF Explorer, they will modify how the suspicious program stores variables in memory, detect what packer it was packed with, unpack that file and then save it in an unpacked state. Using ExeinfoPE, they will double-check and ensure that the processed version of the Analyze Packed Executable to Identify Attack Vector and Payload CYBRScore Scored Labs Software Security Analysis (SSA); Topics: 1, 2, 3, 4, 5 Hyper-V 45 Minutes 1 Hour 31 minutes, 38 seconds 1 minute, 37 seconds program has been successfully unpacked. The students will then run the suspicious program while Process Hacker is running and then dump all strings associated with the suspicious process to a text file. Using the dumped strings they will piece together what the program was designed to do. Students will Identify the use of an SQL Injection through the use of Wireshark. The Analyze SQL Injection Attack students will also isolate the different aspects of the SQL Injection and execute the CYBRScore Labs Software Security Analysis (SSA); Topics: 1, 2, 3, 4, 5 Hyper-V 1 Hour 2 Hours 20 minutes, 43 seconds 21 seconds selected code.