Section 1: Introduction to Forensics Analysis

• Logistics and Open-Source Tool Recommendations
• Network Forensics Challenges – Nomenclature and Terminology
• Overview and history of Network Forensics Analysis
• Answering the critical incident response questions – Sample Six step Network Forensics Analysis Methodology

Section 2: Recap: Collecting the Data – Data Capture

• Forensic Profile Construction for Data Collection
• Configuring Wireshark – Standard Captures vs. Stealth and Silent Collection of Data
• New types of capture filters – Offset and String-Matching
• WiFi data collection challenges

Section 3: Identifying and Analyzing Indicators of Compromise (IoC)

• Analyzing Conversations and Activities for Indicators of Compromise (IoC)
• Analyzing Conversations and Activities using the Expert Systems to recognize IoCs
• Recognition, Analyzing, and Reconstructing Suspicions Activates
• Baselines & Sample Libraries
• Color Rules, Filtering & Pattern recognition
• Recognizing IOCs of Intrusions
• Forensic Analysis of an Intrusion
• Scouting the Target – Network Reconnaissance and Scanning Tools
• Recognizing Scanning Signatures of standard scanning tools – NMAP, Nessus, Retina, and others
• Honeypots – Trapping the Intruder
• Overview, Configuration & Usage
• Bot, Botnets – Command and Control Traffic
• Recognizing Bots and Botnet activity – the key IOCs
• Identifying, tracking, and reassembling Command and Control Traffic
• Forensic Diagramming – A Picture is worth 1024 Words

Section 4: They Hacked Me – Ethical Hacking & Network Forensics Analysis – Intrusions, Exploits, Etc.

• Overview & Terminology
• Roles and responsibilities of an ethical hacker?
• Ethical Hacking vs. Penetration Testing
• Information Security Threats and Attacks Overview

• Ethical Hacking – Identifying Target Networks Vulnerabilities
• Scanning & Reconnaissance
• Active vs. Passive OS Fingerprinting
• Tools, techniques, and scanning tool identification with Wireshark
• You Can Trust Me – Social Engineering
• Exploiting the Target – Layer 2 (Physical & DLC Layers) Exploits
• Driver & Device Exploits
• Man-in-the-Middle
• MAC / ARP Floods
• Mac Of Switch Port Attacks
• Exploiting the Target – Layer 3 (Network Layer) Exploits
• IPv4 Header and Option Exploits
• IPv6 Tunnel Exploits
• ICMPv4/v6 Exploits
• Exploiting the Target – Layer 4 (Transport Layer) Exploits
• Exploiting TCP – Header & Options, Resets, and Flags
• Exploiting SCTP
• Firewall & Intrusion Detection System (IDS) Exploits
• Exploiting the Target – Layer 5-7 (Application) Exploits
• Drive-by-Downloads
• Ransomware, Crimeware, and Malware – Worms & Viruses
• Fake Login’s & Password Hijacks
• Overflow’s
• Internet Exploits
• Hacking & Exploiting Voice and Video over IP
• Capturing Multimedia Data
• Reconstruction and Replay Voice over IP calls
• Hacking & Exploiting Internet of Thing Devices (IoT)
• Denial of Service (DoS / DDoS) – Network-Level Attacks
• Bots, Botnets, Bot Herders

Section 5: They Encrypted their traffic – now what? – Forensics Analysis of Encryption Protocols

• Analyzing Encrypted Traffic
• Using Wireshark to Decrypt Types of Encrypted Traffic

• Secure Socket Layer (SSL / Transport Layer Security (TLSv1-3)

• Wired Equivalency Protocol (WEP), WiFi Protected Access (WPA.X)

• VPN and Tunneling Protocols

• Security Vulnerabilities & Exploits