Introduction
Immersive Labs is a well known and reputed platfrom and through Accenture I was able to enroll and take on the challenge of the the SOC Lead learning pathway. It broadly covered Threat Hunting, Malware Analysis and Incident Response.
I got exposure to wide variety of tools like, but not limited to Splunk, ElasticSearch etc.
The pathway had labs of over 60 hours and the main highlight of the learning experience was APT29 and FIN7 threat group emulation. I performed threat hunting and Incident response on simulated cases of both threat groups using Splunk.
Another great bit was learning detection engineering and rule creation on a completely new SIEM tool which I had never used before. It was time consuming but at the end it was one of the most satisfying parts of the pathway. Being able to learn ElasticSeach, create rules and interact with the SIEM using python scripts was a great learning expereince and help stengthen my ability to adapt to new and different platforms with ease.
I experienced the same when I was asking to perform IR in AWS environment. I setup my own forensic VM, created heavily restricted and monitored VPC. Performed containment actions like EC2 containment, isolation, key rotations, preserving evidence with help of a snapshot etc and did forensic investigation by attaching the compromised EC2 volume to the forensic VM. It was my first time setting up AWS environment and it helped me realise that the underlying processes are same on all cloud environments, just that the UI looks different and one can very easily move from one cloud environment to another, just need a quick reference :)
The last but not the least, I was able to perform Malware analysis of the following malware families/types -
- Quasar RAT
- CookieMiner
- ELECTRICFISH
- AutoIT
- Qakbot
- Kovter Trojan
Various techniques including but not limited to Memory Analysis, Disk Analysis and Network analysis with the help of tools like Volatility, EZ Tools, WireShark, Autopsy etc were used in the process.
And not to forget there were many single labs focusing on C2 beacon’s analysis, analysis of attacks like ZeroLogon, Linux Image analysis, Honeypots setup and data analysis, CTI standards, using AI algorithms for behaviour detection etc.
All in all, it was a great learning experience, I was able to pick up new technologies, become more adaptive when it comes to IR and got tangible Incident Response experience.
