トピック

TCP/IPのコンセプト

• TCP/IP communications model
• Data encapsulation/de-encapsulation
• Discussion of bits, bytes, binary, and hex

Introduction to Wireshark

• Navigating around Wireshark
• Examination of Wireshark statistics
• Stream reassembly
• Finding content in packets

ネットワークアクセス/リンクレイヤー：Layer 2

• Introduction to 802.x link layer
• Address resolution protocol
• ARP spoofing

IPレイヤー： Layer 3

• IPv4
  • Examination of fields in theory and practice
  • Checksums and their importance, especially for an IDS/IPS
  • Fragmentation: IP header fields involved in fragmentation, composition of the fragments, fragmentation attacks
• IPv6
  • Comparison with IPv4
  • IPv6 addresses
  • Neighbor discovery protocol
  • Extension headers
  • IPv6 in transition

トピック

Wireshark Display Filters

• Examination of some of the many ways that Wireshark facilitates creating display filters
• Composition of display filters

Writing tcpdump Filters

• Format of tcpdump filters
• Use of bit masking

TCP

• Examination of fields in theory and practice
• Packet dissection
• Checksums
• Normal and abnormal TCP stimulus and response
• Importance of TCP reassembly for IDS/IPS

UDP

• Examination of fields in theory and practice
• UDP stimulus and response

ICMP

• Examination of fields in theory and practice
• When ICMP messages should not be sent
• Use in mapping and reconnaissance
• Normal ICMP
• Malicious ICMP

トピック

Advanced Wireshark

• Exporting web objects
• Extracting SMTP attachment content
• Sample Wireshark investigation of an incident
• Tshark

Detection Methods for Application Protocols

• Pattern matching, protocol decode, and anomaly detection
• Detection challenges

Microsoft Protocols

• SMB/CIFS
• MSRPC
• Detection challenges

HTTP

• Protocol format
• Sample of attacks
• Detection challenges

SMTP

• Protocol format
• Sample of attacks
• Detection challenges

DNS

• Its vital role in the Internet
• The resolution process
• Caching
• DNSSEC
• Malicious DNS, including Cache poisoning

IDS/IPS Evasion Theory

• Theory and implications of evasions at different protocol layers
• Sampling of evasions
• Necessity for target-based detection

Real-World Traffic Analysis

• Client attacks
• DDoS attacks
• Four-way handshake
• TCP reset attack
• Malformed DNS DoS

トピック

Operational Lifecycle of Open-Source IDS

• Planning, installation, configuration, running, customization, auditing, refinement, and updating

Introduction

• Function of an IDS
• The analyst's role in detection
• Flow process for Snort and Bro
• Similarities and differences between Snort and Bro

Snort

• Introduction to Snort
• Planning, including deployment scenarios
• Running
  • Modes of operation: sniffer, packet logger, NIDS
  • Plug-ins
• Customization
  • Writing Snort rules
• Refining
  • Solutions for dealing with false negatives and positives
  • Writing a rule for a vulnerability
  • Tips for writing efficient rules

Bro

• Introduction to Bro
• Planning
  • Operational modes
    • Standalone on a single host
    • Cluster on multiple hosts/cores
• Running
  • BroControl to manage Bro
  • Running in standalone mode
  • Running in cluster mode
• Customization
  • Understanding and deploying Bro's policy neutral features
    • Bro scripting
    • Signatures

Comparing Snort and Bro to Analyze Same Traffic

• Examination of output from each - Snort alerts and Bro logs
• Tips for performing Bro log correlation
• Customizing Bro to add a new signature and raise a notice about malicious traffic

トピック

Analyst Toolkit

• Ngrep, tcpflow, p0f, Chaosreader, tcpreplay

SiLK

• Introduction of concept of network flow
• Understand the uses for flow

Packet Crafting

• Using Scapy to craft,read/write from to pcaps, alter, and send packets

Command and Control (C2)

• Discussion of two common C2 methods, Tor and dnscat2
  • Introduce theory behind the methods
  • Examine traffic generated by them
  • Learn detection strategies

Network Forensics

• Learn what it is
  • Become aware of indicators of network issues
  • Learn to investigate incidents using some sample traffic of:
    • Exploited host
    • Phishing attack

Network Architecture for Monitoring

• Become familiar with hardware used with and for monitoring

Correlation of Indicators

• Examination of log files
• OSSEC
• Understand different methods of correlation

5日間の演習を通じて学習したスキル、ツールを駆使して、脆弱なハニーネットホストのトラフィックを分析します。この総合的な演習を存分に楽しんでください。様々な発見と驚きがあるはずです。作業は単独でもグループでもできますし、教材に書かれていない方法もあるかもしれません。最終日は、本コースで習得したスキルを実社会で実践するための準備をする1日です。