SANS - SEC599 Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses

* Leveraging MITRE ATT&CK as a "common language" in the organization
* Building your own Cuckoo sandbox solution to analyze payloads
* Developing effective group policies to improve script execution (including PowerShell, Windows Script Host, VBA, HTA, etc.)
* Highlighting key bypass strategies for script controls (Unmanaged Powershell, AMSI bypasses, etc.)
* Stopping 0-day exploits using ExploitGuard and application whitelisting
* Highlighting key bypass strategies in application whitelisting (focus on AppLocker)
* Detecting and preventing malware persistence
* Leveraging the Elastic stack as a central log analysis solution
* Detecting and preventing lateral movement through Sysmon, Windows event monitoring, and group policies
* Blocking and detecting command and control through network traffic analysis
* Leveraging threat intelligence to improve your security posture
Homepage
https://www.sans.org/cyber-security-courses/defeating-advanced-adversaries-kill-chain-defenses/