This workshop will help you practice techniques to detect, analyze, and respond to intrusions. You will construct targets and attackers on the Google cloud, and send attacks using Metasploit and Caldera to emulate APT attackers. Participants will monitor and analyze the attacks using Splunk, Suricata, Sysmon, Wireshark, Yara, and online analysis tools including PacketTotal and VirusTotal. The ATT&CK Matrix will be covered in detail, which enumerates threat actors, tactics, and techniques, so red and blue teams can better communicate and work together to secure networks.

The workshop is structured in a Capture the Flag format. Each participant works at their own pace. The techniques will be demonstrated, with complete step-by-step instructions to lead beginners through the easy challenges. There are also harder challenges for more experienced participants. We will help participants as needed, to ensure that everyone learns new techniques.

Participants need a credit card and a few dollars to rent Google Cloud servers. Debian Linux and Windows Server 2016 systems will be used. All the tools used are freely available, and all the training materials will remain available to everyone after the workshop ends.

https://wiki.hope.net/index.php?title=Incident_Response_workshop