View difference between Paste ID: Uu2yyxhT and axGi2aih

 SOC Core Skills w/ John Strand (16 Hours)
-Day 1 - Mon, Dec 14, 2020 4-9PM UCT
+Mon, Dec 14, 2020 4-9PM UCT
-Day 2 - Tue, Dec 15, 2020 5-9PM UCT
+
-Day 3 - Wed, Dec 16, 2020 5-9PM UCT
+
-Day 4 - Thu, Dec 17, 2020 5-9PM UCT
+
 [email protected]
-Bonus Job Hunting talk w/ Jason Blanchard:
+
-Tue, Dec 15, 2020 9-10PM UCT
+
 Dedicated SOC Core Skills Discord Server:
-Extra bonus links from (at the end of this document):
+
-The SOC Age Or, A Young SOC Analyst's Illustrated Primer | John Strand | 1 Hour (26 Oct 2020)
+
 Preparation instructions and hands-on labs installation guide:
 https://wildwesthackinfest.com/training/soc-core-skills-instructions/
 
 Slides:
 https://handouts-live.s3.amazonaws.com/b0b53ddc19754bb7b2e376b85646a1ae?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20201214T160824Z&X-Amz-SignedHeaders=host&X-Amz-Expires=86400&X-Amz-Credential=AKIAJICNIQWVMWBRIUMQ%2F20201214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=a0c42d706063156eaf7aa6e368dd7e333d1d7fa32ac23852b4785f474d33d207
 
 ADHD Win VM:
 https://introclassjs.s3.us-east-1.amazonaws.com/WINADHD.7z
 Checksums:
 Algorithm: SHA256
 Hash: 54C461A0BFC6E9599B0A9BC92D3BD16CB21E5020100D4C2532FE7C43B1807129
 https://www.activecountermeasures.com/free-tools/adhd/
 GitHub Labs:
 https://github.com/strandjs/IntroLabs
 https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md
 
 Security Onion:
 https://github.com/Security-Onion-Solutions/security-onion
 https://securityonionsolutions.com/software/
 
 SOC Core Skills w/ John Strand (16 Hours - Pay What You Can)
 Tue-Fri 2-5 Feb 2021 11AM-3PM CST
 https://register.gotowebinar.com/register/5912460362618462478
 
 Getting Started in Security with BHIS and MITRE ATT&CK w/ John Strand (16-Hours - Pay What You Can)
 Tue-Fri 23-26 Feb 2021 11AM-3PM CST
-https://www.linkedin.com/in/john-strand-a1b4b62/
+
 
 Active Defense & Cyber Deception w/ John Strand (16 Hours - Pay What You Can)
 Tue-Fri 16-19 Mar 2021 11AM-3PM CDT
 https://register.gotowebinar.com/register/3272325136631560973
 
 LINKS (BHIS):
 
 https://www.blackhillsinfosec.com/
 https://wildwesthackinfest.com/online-training/
 https://www.activecountermeasures.com/
 
 Your 5 Year Path: Success in Infosec:
 https://youtu.be/Uv-AfK7PkxU
 https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_Your5YearPlanIntoInfoSec.pdf
 
 Contacts:
 https://www.twitch.tv/banjocrashland
 https://www.twitch.tv/banjocrashland/schedule
 https://twitter.com/BanjoCrashland
 https://www.linkedin.com/in/jasonsblanchard/
 https://twitter.com/debthedeb
 https://www.linkedin.com/in/deborahwigley/
 https://twitter.com/BHinfoSecurity
 
 Training:
-====================
+
 https://www.blackhillsinfosec.com/webcast-the-soc-age-or-a-young-soc-analysts-illustrated-primer/
 https://www.youtube.com/channel/UCJ2U9Dq9NckqHMbcUupgF0A
-*****DAY 1*****
+
 How to Hunt for Jobs like a Hacker w/ Jason Blanchard
 https://youtu.be/Air1c697tjw
 
 Cyber Range:
 https://www.blackhillsinfosec.com/services/cyber-range/
 
 4-hours of free intro Threat Hunting Training from Chris Brenton:
 https://youtu.be/FzYPT1xTVHY
 
 How to build your own home lab to use to get experience:
 https://youtu.be/t7bhnK47Ygo
 
 Pillage the Village:
 https://www.youtube.com/watch?v=n2nptntIsn4
 
 Backdoors and Breaches:
 https://www.blackhillsinfosec.com/projects/backdoorsandbreaches/
 
 RITA:
 https://www.activecountermeasures.com/free-tools/rita/
 
 Videos:
 https://www.youtube.com/c/BlackHillsInformationSecurity/videos
 News:
 https://youtu.be/QZOW0itnyLU
 
 The SOC Age Or, A Young SOC Analyst's Illustrated Primer | John Strand | 1 Hour
 https://www.youtube.com/watch?v=Lhol4rZo_ts
 
 How to update the VM labs:
 •Delete:  C:\IntroLabs\
 •Double-click:  C:\labupdate.bat
 •Note:  don't run as an Administrator, the files will not be placed in the correct directory
 If this fails somehow, or the labupdate.bat file is not present:
 •Open Notepad and paste the following in, then save as C:\labupdate.bat and run it again:
 @ECHO OFF
 git clone https://github.com/strandjs/IntroLabs
-News 20201214:
+
 LABS shortcut on the Desktop is missing/broken:
 •Update the labs again
 •or manually open:  C:\IntroLabs\IntroClassFiles\index.html
 
 Stop Windows 10 updates:
 •In the Run command (Win+R), type in "services. msc" and hit Enter
 •Select the Windows Update service from the Services list
 •Click on the "General" tab and change the "Startup Type" to "Disabled"
 •Restart your machine
 
 VMware Workstation does not support nested virtualization on this host.
 Module 'MonitorMode' power on failed.
 Failed to start the vitual machine.
 Fixed:  bcdedit /set hypervisorlaunchtype off
 
 dism.exe /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart
 
 netstat:
 https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/netstat
 tasklist:
 https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/tasklist
 DeepBlueCLI:
 https://github.com/sans-blue-team/DeepBlueCLI
 DeepWhiteCLI:
 https://github.com/darkoperator/Posh-VirusTotal
 VirusTotal:
 https://www.virustotal.com/gui/
 VirusTotal API Key:
 https://www.virustotal.com/en/documentation/public-api/
 
 https://www.opendns.com/
 https://github.com/davehull/Kansa
 https://adblockplus.org/
 https://pi-hole.net/
 https://portswigger.net/daily-swig/sad-dns-researchers-pull-source-code-as-dns-cache-poisoning-technique-deemed-too-dangerous
 https://www.windows-commandline.com/get-computer-model/
 https://requestpolicycontinued.github.io/
 https://www.virustotal.com/gui/
 https://www.velocidex.com/
 https://github.com/ComodoSecurity/openedr
 https://www.activecountermeasures.com/free-tools/passer/
 https://github.com/activecm/passer
 https://github.com/sans-blue-team/DeepBlueCLI
 
 
 LINKS (Students):
 
 https://www.timeanddate.com/time/map/
 
 https://jensoroger.wordpress.com/2020/07/22/if-you-are-attending-getting-started-in-security-with-bhis-and-mitre-attck-with-strandjs-next-week-and-running-linux-and-virtualbox-how-to-import-the-machine-bhinfosecurity-wwhackinfest/
 
 I was able to run the Soc VM in Hyper-v. Just follow Converting a VMDK virtual disk copied from ESXi and The entry 1 is not a supported disk database entry for the descriptor in this guide:
 https://www.nakivo.com/blog/how-to-convert-vmware-vm-to-hyper-v/#:~:text=The%20entry%201%20is%20not,of%20the%20disk%20database%20entries
 In the entry 1 error guide section, you don't need to run boot repair, just uncomment the dbtools lline and run dsfi to save back. I converted it to vhdx and created a gen 2 vm in hyper-v. It booted up just fine, but FYI they don't support you running it like this. This is also handy if you want to run vmware images from vulnhub on hyper-v. Just note that depending on errors you may need to uncomment other lines in descriptor.txt. On some of them on vulnhub, especially old linux ones, I have had to make vm gen 1. Also convert vmdk to vhd, and use a legacy network adapter in hyper-v. Sometimes this doesn't work so your just stuck only running it in vmware or virtualbox.
 
 https://www.cisa.gov/news/2020/12/13/cisa-issues-emergency-directive-mitigate-compromise-solarwinds-orion-network
-*****DAY 2*****
+
 SANS Webcast tonight about it:
-2020-12-14 – RECORDING – SOC Core Skills – Day 1 – John Strand
+
-https://attendee.gotowebinar.com/register/3061585041642106382
+
-FOR FREE ACCESS USE CODE:
+
-JOHNSMISSINGSOCS0187
+
 https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
-Now That’s What I Call ADHD! 4:
+
-https://www.blackhillsinfosec.com/now-thats-what-i-call-adhd-4/
+
 SwiftOnSecurity:
-Anagram Solver:
+
-https://word.tips/anagram-solver/
+
 Countermeasures:
-Discord CLI:
+
-https://github.com/RickvanLoo/discord-cli
+
 https://pastebin.com/N0bfywTB
-12 Days of Cyber Defense:
+
-https://www.youtube.com/playlist?list=PLUze0rzlzxgJ2Ys5lpm3HCCa2xC6oNMuK
+
 SAML tokens were forged, learn more about SAML here:
-CIS Benchmarks:
+
-https://cisecurity.org/cis-benchmarks/
+
-https://www.cisecurity.org/controls/cis-controls-list/
+
-https://www.cisecurity.org/white-papers/cis-controls-sme-guide/
+
-https://public.cyber.mil/stigs/
+
 https://www.professormesser.com/
-How to Build a Home Lab – Bill Stearns:
+
-https://www.youtube.com/watch?v=t7bhnK47Ygo
+
 https://linuxjourney.com/
-Code Combat:
+
-https://codecombat.com/
+
 https://pentesterlab.com/
-Infosec Mentoring | How to Find and Be a Mentor & Mentee | John Strand & Jason Blanchard | 1 Hour:
+
-https://youtu.be/j3_xXgNOmQM
+
 
-Holiday Hack Challenge 2020:
+
-https://holidayhackchallenge.com/2020/
+
 https://www.youtube.com/watch?v=8armE3Wz0jk
-How SPF, DKIM, and DMARC Authentication Works to Increase Inbox Pen... (Testing) Rates:
+
-https://tinyurl.com/y92s4o8d
+
-https://www.blackhillsinfosec.com/how-spf-dkim-and-dmarc-authentication-works-to-increase-inbox-pen...-testing-rates/
+
-^^^use the tinyurl or spell out the word with "..." in the link (pastebin was flagging as potentially offensive)
+
 
-ActiveCountermeasures:
+
-https://www.activecountermeasures.com/blog/
+
 https://nostarch.com/rootkits
-Alert (AA20-302A)
+
-Ransomware Activity Targeting the Healthcare and Public Health Sector:
+
-https://us-cert.cisa.gov/ncas/alerts/aa20-302a
+
 https://ublockorigin.com/
-Atomic Red Team:
+
-https://github.com/redcanaryco/atomic-red-team
+
 
-Hacking a Security Career - Deviant Ollam:
+
-https://www.youtube.com/watch?v=jZFuCYyQB6c
+
 https://www.amazon.com/Standing-Sitting-Perching-Ergonomic-Computer/dp/B00HCLJDSK
-Exploit-DB
+
-https://www.exploit-db.com/
+
 
-115 How to Social Engineer your way into your dream job Jason Blanchard:
+
-https://youtu.be/__lvS2pjuSg
+
 https://support.opendns.com/hc/en-us/articles/227986647-Can-I-Block-Advertisers-and-Ad-Servers-
 
-https://www.youtube.com/watch?v=Air1c697tjw&feature=youtu.be
+
 
-Kroll:
+
-https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape
+
-https://ericzimmerman.github.io/#!index.md
+
 https://processhacker.sourceforge.io/
-*****DAY 3*****
+
 https://github.com/Tripwire/tripwire-open-source
-2020-12-15 – RECORDING – SOC Core Skills – Day 2 – John Strand
+
-https://attendee.gotowebinar.com/register/1681441762585925903
+
-FOR FREE ACCESS USE CODE:
+
-JOHNSMISSINGSOCS0187
+
 https://www.crowdstrike.com/resources/reports/2020-crowdstrike-global-threat-report/
-Shodan:
+
-https://shodan.io/
+
 
-Active Countermeasures:
+
-https://www.activecountermeasures.com/blog/
+
-https://www.activecountermeasures.com/category/video-blog/
+
-https://www.activecountermeasures.com/malware-of-the-day-backoff/
+
-https://www.youtube.com/activecountermeasures
+
 
-tcpdump:
+
-https://www.tcpdump.org/
+
 https://lolbas-project.github.io/
-Wireshark:
+
-https://www.wireshark.org/
+
 
-Getting Started With TCPDump:
+
-https://www.blackhillsinfosec.com/getting-started-with-tcpdump/
+
 https://wadcoms.github.io/
-Volatility:
+
-https://www.volatilityfoundation.org/26
+
-https://www.volatilityfoundation.org/releases
+
-https://github.com/fireeye/win10_volatility
+
-https://downloads.volatilityfoundation.org/releases/2.4/CheatSheet_v2.4.pdf
+
 https://blog.didierstevens.com/my-software/
-FTK Imager:
+
-https://accessdata.com/product-download/ftk-imager-version-4-5
+
-https://accessdata.com/products-services/forensic-toolkit-ftk/ftkimager
+
 https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#overview-of-sysmon-capabilities
-Rekall:
+
-http://www.rekall-forensic.com/
+
-https://github.com/google/rekall
+
-https://github.com/fireeye/win10_rekall
+
 
-Winpmem:
+
-https://winpmem.velocidex.com/
+
-https://github.com/google/rekall/tree/master/tools/windows/winpmem
+
 
-Velociraptor:
+
 
-https://github.com/Velocidex/velociraptor
+
-https://www.velocidex.com/discord
+
 https://osquery.io/
-NetFlow (IPFIX):
+
-https://en.wikipedia.org/wiki/NetFlow
+
-https://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-netflow/index.html
+
-https://en.wikipedia.org/wiki/IP_Flow_Information_Export
+
-https://tools.ietf.org/html/rfc7011
+
 https://github.com/Cyb3rWard0g/HELK
-Zeek (Corelight):
+
-https://zeek.org/
+
-https://github.com/zeek/zeek
+
-https://corelight.com/about-zeek/how-zeek-works/
+
-https://www3.corelight.com/nsm@home
+
 
 https://nsacyber.github.io/unfetter/
-https://github.com/activecm/rita
+
-https://www.blackhillsinfosec.com/projects/rita/
+
 
-https://www.blackhillsinfosec.com/webcast-rita/
+
-Real Intelligence Threat Analytics (RITA) Overview & AI-Hunter Demo:
+
-https://youtu.be/h8KNyhSMoig
+
 
-Gigamon:
+
-https://www.gigamon.com/
+
 https://github.com/fireeye/red_team_tool_countermeasures/blob/master/all-snort.rules
-JA3:
+
-https://github.com/salesforce/ja3
+
 
 https://github.com/kitabisa/teler
 
 https://www.youtube.com/watch?v=iB_xCLsgQZI
 https://www.youtube.com/watch?v=Uv-AfK7PkxU
-Suricata:
+
-https://suricata-ids.org/
+
-https://github.com/OISF/suricata
+
 https://www.cyberseek.org/index.html#
-Webcast: Attack Tactics 7 – The Logs You Are Looking For:
+
-https://www.blackhillsinfosec.com/webcast-attack-tactics-7-the-logs-you-are-looking-for/
+
 
-Cyber Threat Hunting | Chris Brenton | October 2020 | 4 Hours:
+
-https://www.youtube.com/watch?v=FzYPT1xTVHY
+