Threat Intelligence with MSTICPy
This course will focus on using MSTICPy in notebooks to detect adversary logons, decode obfuscated scripting attacks, and attempts to establish persistence.
What you'll learn
MSTICPy is a Python library of CyberSec tools designed for hunting and investigations using Jupyter notebooks. Jupyter notebooks are an ideal tool for CyberSec/SOC work. You can ingest data from multiple sources, analyze, reshape, and visualize the data and add your own commentary.
In this course, Threat Intelligence with MSTICPy, you’ll cover how to utilize MSTICPy to detect against adversary intrusions in an enterprise or cloud environment. First, you’ll learn how to query and analyze network and endpoint logs to identify adversary activity. Next, you’ll analyze logon sessions on a compromised host and identify and decode a scripted attack. Finally, we will pinpoint the way that attacker has enabled a persistent foothold on the host. When you’re finished with this course, you’ll have the skills and knowledge to detect these techniques: T1078.002 - Valid Accounts/Domain Accounts; T1059.001 - Command and Scripting Interpreter: PowerShell; and T1053.005 - Scheduled Task/Job: Scheduled Task, using MSTICPy and Jupyter Notebooks.
Table of contents
About the author
Ian is a Principal Software Engineer in the Microsoft Threat Intelligence Centre (MSTIC). He has worked in security for 20 years and has been with MSTIC for the past 5 years (from infrastructure/network consulting to building compiler plug-ins and authoring detections and detection systems). He's the creator and joint-author/maintainer of MSTICPy - Python CyberSec tools for Jupyter notebooks - and spends most of his time creating notebooks and enhancing and fixing MSTICPy. In the time left over... more