BTL1 Syllabus

BTL1v1 Syllabus. Copyright Security Blue Team 2020. Visit https://securityblue.
team/why-btl1/
Course Code: BTL1-01

Course Title: Blue Team Level 1 Certification
Contact Information
Lead Instructor: Joshua Beaman
Email: joshua@securityblue.team
Course Goals
To develop and test a student’s knowledge of defensive cybersecurity practices and improve their
practical ability to complete security operations tasks, making them a stronger defender.
Copyright Notice
This syllabus has been designed by Security Blue Team, and any replication is an infringement of
our intellectual property and copyright rights. Any unauthorized use will result in legal action to
claim for damages against Security Team Training Ltd.
Course Terms and Conditions

During the checkout process students must agree to the Refunds Policy and BTL1 Terms and
Conditions before they are able to purchase the course. These terms are also reiterated at the start
of the course. These protect the intellectual property of Security Team Training Ltd and prohibit
students from sharing training material with non-paying students. Any form of piracy, account
sharing, or otherwise disclosing private course materials will result in permanent account
termination with no refund, and potentially legal action to claim for damages. Please respect our
hard work.
1
BTL1v1 Syllabus. Copyright Security Blue Team 2020. Visit https://securityblue.team/why-btl1/
BTL1: Security Fundamentals

This introduction domain is aimed at individuals that have little or no prior experience with
cybersecurity and networking. These lessons are designed to create a foundation for the rest of the
course, developing a student’s understanding of soft skills, networking, security controls, and
management principles.
Soft Skills: Networking 101:
• Section Introduction • Section Introduction

• Communication • Network Fundamentals
• Teamwork • Network Devices
• Problem Solving • Ports and Services
• Time Management • Activity) Port Scanning with Nmap
• Motivation • Activity) End of Section Review
• Burnout, Imposter Syndrome, Alert
Fatigue
Security Controls: Management Principles:

• Physical Security • Risk
• Network Security • Policies and Procedures
• Endpoint Security • Compliance and Frameworks
• Email Security • Activity) End of Section Review
• Activity) End of Section Review
2
BTL1: Phishing Analysis

Phishing is the number one security risk faced by organizations and leads to the highest number of
data breaches. Initially students will learn what phishing is, the different types of phishing attacks,
tactics and techniques used by malicious actors. Then students will be taught how to analyze emails
to retrieve important artifacts, perform analysis on these to determine the risk to the organisation,
and suggest appropriate reactive and preventative defensive measures.
PA1) Introduction to Emails and Phishing: PA2) Types of Phishing Emails:

• Phishing Analysis Glossary • Recon
• How Electronic Mail Works • Spam
• Anatomy of an Email • Credential Harvester
• What is Phishing? • Drive-by Download
• Impact of Phishing • Social Engineering
• Activity) End of Section Review • Vishing, Smishing
• Whaling
• False Positives
• Video) Types of Email Attacks and Examples
• Activity) Categorising Phishing Emails
PA3) Tactics and Techniques Used: PA4) Retrieving Artefacts:

• Spear Phishing • Artefacts we need to Collect
• Impersonation • Manual Collection – Email Artefacts
• Typo squatting and Homographs • Manual Collection – Web Artefacts
• Sender Spoofing • Manual Collection – File Artefacts
• HTML Styling • Video) Collecting Artefacts Manual Methods
• Attachment • Automated Collection with PhishTool
• Hyperlinks • Video) Collect Artefacts Automated Methods
• URL-Shortening Services • Activity) Artefact Extraction
• Use of Legitimate Services • Activity) End of Section Review
• Business Email Compromise
• Video) Tactics and Techniques Examples
• Activity) Reporting on Tactics Used
3
PA5) Analyzing Artefacts: PA6) Taking Defensive Measures:

• Visualisation Tools • Preventative: Marking External Emails
• Artefact Reputation Tools • Preventative: Email Security Technology
• Interaction Tools • Preventative: Spam Filter
• Analysis with PhishTool • Preventative: Attachment Filtering
• Video) Artefact Analysis Walkthrough • Preventative: Attachment Sandboxing
• Activity) Artefact Analysis • Reactive: Immediate Response Process
• Activity) End of Section Review • Reactive: Blocking Web-Based Artefacts
• Reactive: Blocking File-Based Artefacts
• Reactive: Blocking Email-Based Artefacts
• Reactive: Informing Threat Intelligence Team
• Activity) Selecting Appropriate Defensive
Measures
PA7) Report Writing: PA8) Lessons Learned:

• Email Header, Artefacts, and Body Content • Identifying New Tactics
• Users Affected & Actions Taken • Response Improvements
• Analysis Process, Tools, and Results • Activity) End of Section Review
• Defensive Measures Taken
• Lessons Learned
• Video) Report Writing Walkthrough and
Examples
• Activity) Report Writing
PA9) Phishing Response Challenge:
• Section Introduction
• Video) Phishing Response Walkthrough Video
• Phishing Response Brief
• Activity) Phishing Response
4
BTL1: Threat Intelligence

It’s important for an organisation to understand the malicious actors that may target them, allowing
for tailored defences to be implemented, increasing the resilience and slowing the attackers down,
giving defenders more time to respond. In this domain students will learn what threat actors are,
the naming conventions used to track them, and develop an understanding of operational, tactical,
and strategic threat intelligence practices and knowledge. Finally, students will learn about
different types of malware used by actors, and global campaigns such as Emotet and Magecart.
TI1) Introduction to Threat Intelligence: TI2) Threat Actors and APTs:

• Threat Intelligence Glossary • Common Threat Agents
• Threat Intelligence Explained • Actor Naming Conventions
• Why Threat Intelligence can be Valuable • Motivations
• The Future of Threat Intelligence • What are APTs?
• Types of Intelligence • Tools, Techniques, and Procedures
• Further Reading • Activity) Threat Actor Research
TI3) Operational Threat Intelligence: TI4) Tactical Threat Intelligence:

• Indicators of Compromise Explained • Threat Exposure Checks Explained
• Pyramid of Pain • Public Exposure Checks Explained
• Precursors Explained • Watchlists/IOC Monitoring
• Lockheed Martin Cyber Kill Chain • Threat Intelligence Platforms
• MITRE ATT&CK Framework • Malware Information Sharing Platform (MISP)
• Attribution and its Limitations • Activity) Deploying MISP
• Activity) End of Section Review • Activity) End of Section Review
TI5) Strategic Threat Intelligence: TI6) Malware and Global Campaigns:

• Intelligence Sharing and Partnerships • Types of Malware Used by Threat Actors
• IOC/TTP Gathering and Distribution • Global Campaign: Emotet
• OSINT vs Paid Sources • Global Campaign: Magecart
• Activity) End of Section Review • Global Campaign: Trickbot
• Global Campaign: Sodinokibi
5
BTL1: Digital Forensics

Supply a description of any special course requirements, such as knowledge of specific software,
and why it is necessary for successful completion of the course. Include software required to access
course material or submit assignments such as Microsoft Word, SPSS, etc. Also include any
hardware requirements for the course such as cameras, lab equipment, etc.
DF1) Introduction to Digital Forensics: DF2) Forensics Fundamentals:

• Digital Forensics Glossary • Introduction to Data Representation
• What is Digital Forensics? • Activity) Data Representation
• Digital Forensics Process • Hard Disk Drive Basics
• Further Reading Material • Solid State Disk Basics
• File Systems
• Activity) File Systems
• Hashing and Integrity
• Activity) Hashing and Integrity
• Metadata and File Carving
• Activity) Metadata and File Carving
• Memory, Pagefile, and Hibernation File
• Digital Evidence and Handling
• Order of Volatility
DF3) Digital Evidence Collection: DF4) Windows Investigations:

• Equipment • Windows Artifacts - Programs
• ACPO Principles of Digital Evidence and • Activity) Windows Investigation 1
Preservation • Windows Artifacts – Internet Browsers
• Chain of Custody • Activity) Windows Investigation 2
• Disk Imaging: FTK Imager • Activity) End of Section Review
• Live Forensics
• Live Acquisition: KAPE
• Evidence Destruction
6
DF5) Linux Investigations: DF6) Autopsy:

• Linux Artifacts – User Files • What is Autopsy?
• Activity) Hidden Files • Installing Autopsy
• Linux Artifacts - /Var/Lib and /Var/Log • Autopsy Walkthrough
• Linux Artifacts – Passwd and Shadow • Activity) Autopsy Exercise
• Activity) Password Cracking
DF7) Volatility:
• What is Volatility?
• Volatility Walkthrough
• Activity) Volatility Exercise
7
BTL1: Security Information and Event Management

SI1) Introduction to SIEM: SI2) Logging:

• SIEM Glossary • What is Logging?
• Security Information Management • Syslog
• Security Event Management • Windows Event Logs
• What is a SIEM? • Sysmon
• SIEM Platforms • Other Logs
• Further Reading Material • Activity) Windows Event Analysis
• Activity) End of Section Review • Activity) End of Section Review
SI3) Aggregation: SI4) Correlation:

• Log Aggregation Explained • Normalization and Processing
• Activity) End of Section Review • Regex
• SIEM Rules
• Activity) Regex Writing
SI5) Analysis:
• Activity) Installing Splunk
• Activity) Importing BOTSv3
• Splunk Crash Course
• Activity) Splunk Scenario Easy
• Activity) Splunk Scenario Easy
• Activity) Splunk Scenario Medium
• Activity) Splunk Scenario Medium
• Activity) Splunk Scenario Hard
8
BTL1: Incident Response

IR1) Introduction to Incident Response: IR2) Introduction to Incident Response:

• Incident Response Glossary • Preparation: Incident Response Plan
• What is Incident Response? • Preparation: Incident Response Teams
• Why is Incident Response Needed? • Preparation: Asset Inventory and Risk
• Security Events vs. Security Incidents Assessments
• CSIRT and CERT Explained • Prevention: DMZ
• Incident Response Lifecycle (NIST) • Prevention: Host Defenses
• Lockheed Martin Cyber Kill Chain • Prevention: Network Defenses
• MITRE ATT&CK Framework • Activity) Setting up a Firewall
• Further Reading Material • Prevention: Snort
• Activity) End of Section Review • Activity) Deploying Snort
• Prevention: Email Defenses
• Prevention: Physical Defenses
• Prevention: Human Defenses
IR3) Detection and Analysis: IR4) Containment, Eradication, Recovery:

• Common Events and Incidents • Incident Containment
• Baselines and Behavior Profiles • Taking Forensic Images
• Introduction to Wireshark (GUI) • Identifying and Removing Malicious
• Introduction to Wireshark (Analysis) Artifacts
• Activity 1) PCAP Analysis • Identifying Root Cause and Recovery
• Activity 2) PCAP Analysis • Activity) End of Section Review
• Activity 3) PCAP Analysis
9
IR5) Lessons Learned:
• What Went Well?
• What Can be Improved?
• Importance of Documentation
• Metrics and Reporting
10

BTL1 Syllabus

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

BTL1 Syllabus

Uploaded by

Copyright:

Available Formats

BTL1v1 Syllabus. Copyright Security Blue Team 2020. Visit https://securityblue.

Course Code: BTL1-01

Course Terms and Conditions

BTL1: Security Fundamentals

Soft Skills: Networking 101:

• Section Introduction • Section Introduction

Security Controls: Management Principles:

• Section Introduction • Section Introduction

BTL1: Phishing Analysis

PA1) Introduction to Emails and Phishing: PA2) Types of Phishing Emails:

• Section Introduction • Section Introduction

PA3) Tactics and Techniques Used: PA4) Retrieving Artefacts:

• Section Introduction • Section Introduction

PA5) Analyzing Artefacts: PA6) Taking Defensive Measures:

• Section Introduction • Section Introduction

PA7) Report Writing: PA8) Lessons Learned:

• Section Introduction • Section Introduction

PA9) Phishing Response Challenge:

BTL1: Threat Intelligence

TI1) Introduction to Threat Intelligence: TI2) Threat Actors and APTs:

• Section Introduction • Section Introduction

TI3) Operational Threat Intelligence: TI4) Tactical Threat Intelligence:

• Section Introduction • Section Introduction

TI5) Strategic Threat Intelligence: TI6) Malware and Global Campaigns:

• Section Introduction • Section Introduction

BTL1: Digital Forensics

DF1) Introduction to Digital Forensics: DF2) Forensics Fundamentals:

• Section Introduction • Section Introduction

DF3) Digital Evidence Collection: DF4) Windows Investigations:

• Section Introduction • Section Introduction

DF5) Linux Investigations: DF6) Autopsy:

• Section Introduction • Section Introduction

BTL1: Security Information and Event Management

SI1) Introduction to SIEM: SI2) Logging:

• Section Introduction • Section Introduction

SI3) Aggregation: SI4) Correlation:

• Section Introduction • Section Introduction

BTL1: Incident Response

IR1) Introduction to Incident Response: IR2) Introduction to Incident Response:

• Section Introduction • Section Introduction

IR3) Detection and Analysis: IR4) Containment, Eradication, Recovery:

• Section Introduction • Section Introduction

IR5) Lessons Learned:

You might also like