P-325: Python Programming

Course Overview:

This is an introductory course into the Python scripting language. This class uses a hands-on approach in teaching the Python language. This course builds the prerequisite skills for TechNow's P-345: Python for Pentration Testers course. Getting comfortable with Python is important to understanding how Python can be utilitized for offensive measures.

This course is hands-on with the instructor walking the students through many short examples to exemplify an objective. Dexterity with the language comes through many small code examples to produce the desired result. Students have fun acquiring points for all the code examples they get correct. We must be having fun because TechNow is always amazed at how competitive students are in trying to acquire the most points!

The instructor will focus on the level that each student is currently at, and ensure the student absorbs the subject matter. Programming is not a daily tasking of administrators or offensive operators and TechNow understands that. As an instructor led course TechNow is very successful in making Python accessible to those who do not live eat and breath programming. If a student's ultimate goal is to attend a course like TechNow's P-345: Python for Pentration Testers course, then not being bogged down in the Python language is critical, and this course (P-325: Python Programming) meets that objective.

Recently we have introduced Raspberry Pi's and multiple sensors to the P-325: Python Programming course. This enables the student to actually see productive results from their coding skills in the physical world! Some examples that students create programs for are: Motion detectors, distance, temperature, cameras and keypads.

Attendees to P-325: Python Programming will receive TechNow approved course materials and expert instruction.

Dates/Locations:

No Events

Duration: 5 Days

Course Objectives:

How Python Runs Programs
Introducing Python Object Types
- Numeric Types
- Dynamic Typing
Variables
Regular Expressions
Strings
Conditionals
- if Tests and Syntax Rules
Lists and Dictionaries
Tuples and Files
Introducing Python Statements
Assignments, Expressions, and Prints
while and for Loops
Iterations and Comprehensions
Documentation
Function Basics
Built-In Functions
Scopes
Arguments
Modules
Module Packages and Importing
Classes and OOP
Operator Overloading
Recursion
Exception Coding Details
Exception Objects
Unicode and Byte Strings
Working with Raspberry Pi
- Writing code for sensors

Prerequisites:

Experience with some form of programming is preferred

Comments

Latest comments from students

User: slewis8435

Instructor comments: Very good instructor - he was excited about the material, very knowledgeable, and explained things clearly.

Facilities comments: The facilities were fine - plenty of room for each student to set up an extra computer and have room for note taking

User: nathan.karras

Instructor comments: Instructor was extremely knowledgeable in programming and scripting. He encouraged students to explore and ask questions. He would work with individuals to troubleshoot lab problems sets. Would highly recommend as an instructor.

Facilities comments: Room got a little warn. Instructor purchased fans to cool things off for the class. Projector had over scan.

Liked the class? Then let everyone know!

cheddarcon-powershell-threat-hunting-registration

Windows Security Automation and Threat Hunting with PowerShell Seminar

Location: 400 W Wisconsin Ave, Milwaukee, WI 53203, USA

Date: October 10, 2018 8:00am – 4:00pm

Duration: 8 hours

Audience: Cyber Security professionals and Windows administrators

Attendees Environment: Laptops not required, but suggested to have better hands-on absorption of subject matter.

Description:
PowerShell is both a command-line shell and scripting language. Fight fires quickly using existing or custom PowerShell commands or scripts at the shell. PowerShell is made for Security Operations (SecOps) automation on Windows. This seminar does not require prior programming skills. The seminar focuses on PowerShell programming, giving a beginner skills to be productive in windows scripting to automate tasks and also remediate problems.

Cyber Security is the objective of this seminar, and the PowerShell examples will demonstrate PowerShell capabilities that help lock down a Windows system and also report security status.

Objectives:

PowerShell Overview

Getting started running commands
Security cmdlets
Using and updating the built-in help
Execution policies
Fun tricks with the ISE graphical editor
Piping .NET and COM objects, not text
Using properties and methods of objects
Helping Linux admins feel more at home
Aliases, cmdlets, functions, modules, etc.

PowerShell Utilities and Tips

Customizing your profile script
PowerShell remote command execution
Security setting across the network
File copy via PowerShell remoting
Capturing the output of commands
Parsing text files and logs with regex patterns
Parsing Security Logs
Searching remote event logs
Mounting the registry as a drive
Security settings in the Registry
Exporting data to CSV, HTML and JSON files
Running scripts as scheduled jobs
Continued Security Compliance
Pushing out scripts through Group Policy
Importing modules and dot-sourcing functions
http://www.PowerShellGallery.com

PowerShell Scripting

PowerShell Scripting to implement Security Practices
Writing your own functions to automate security status and settings
Passing arguments into your scripts
Function parameters and returning output
Flow control: if-then, foreach, that make security decisions
How to pipe data in/out of your scripts for security compliance and reporting

Attendees to this seminar, Windows Security Automation and Threat Hunting with PowerShell, will receive TechNow approved course materials and expert instruction.[/wr_text][/wr_column][/wr_row]

RH-355: RHCSA Rapid Track Course

Course Overview:

The RHCSA Rapid Track Course is designed for experienced Linux® system administrators who want to expand their technical skill sets and become accredited with the Red Hat® Certified System Administration (RHCSA) certification. To successfully navigate this course, students should have experience with the Linux command line—including the necessary skills to execute common commands, such as cp, grep, sort, mkdir, tar, mkfs, ssh, and dnf—and be familiar with accessing man pages for help. At the completion of the course, students will be adequately prepared to take the RHCSA exam (EX200) .

Date/Locations:

No Events

Duration: 5 days

Course Objectives:

Introduce Linux and the Red Hat Enterprise Linux ecosystem.
Run commands and view shell environments.
Manage, organize, and secure files.
Manage users, groups and user security policies.
Control and monitor systemd services.
Configure remote access using the web console and SSH.
Configure network interfaces and settings.
Manage software using DNF
Access security files, file systems, and networks
Execute shell scripting and automation techniques
Manage storage devices, logical volumes, and file systems
Manage security and system access
Control the boot process and system services
Running containers

Prerequisites:

Experience in the field system administration.

Comments

Latest comments from students

Liked the class? Then let everyone know!

TN-905: Cyber Threat Intelligence Analysis

Course Overview:

TechNow has worked worldwide enterprise infrastructures for over 30 years and has developed demos and labs to exemplify the techniques required to demonstrate technologies that effectively support CTI. This course integrates well with our courses TN-575: Open Source Network Security Monitoring and TN-865: Wireshark Network Traffic and Security Analysis .

TechNow develops Cyber Ranges and makes them available for conferences in support of annual meetings for Cyber Threat Response Teams. Developing scenarios and reacting to them appropriately is a big part of the value in understanding the contexts required to comprehend valuable CTI. As with many advanced TechNow security courses, there is a large hands-on ratio. This course helps Cyber Protection Teams (CPT), Defensive Cyber Operations (DCO), and Mission Defense Teams (MDT) to collect, analyze and apply targeted cyber intelligence to defensive operations in order to proactively act on and tune response to attacks by cyber adversaries. CPT, DCO, and MDT can take preemptive action by utilizing CTI, understanding CTI tools, techniques and procedures (TTPs) needed to generate and consume timely and relevant intelligence to improve resilience and prevention.

This course focuses on the collection, classification, and exploitation of knowledge about adversaries and their TTPs. . MDT puts us close the mission and helps define the internal context to be analyzed against the CTI. TechNow pushes the student to truly understand how to think about and use CTI to make a difference.

Attendees to TN-905: Cyber Threat Intelligence Analysis will receive TechNow approved course materials and expert instruction.

Date/Locations:

No Events

Course Duration: 5 days

Course Objectives:

Learn to comprehend and develop complex scenarios
Identify and create intelligence requirements through practices such as threat modeling
Utilize threat modeling to drive intelligence handling and practices
Breakdown tactical, operational, and strategic-level threat intelligence
Generate threat intelligence to detect, respond to, and defeat focused and targeted threats
How to collect adversary information creating better value CTI
How to filter and qualify external sources, mitigating low integrity intelligence
Create Indicators of Compromise (IOCs) in formats such as YARA, OpenIOC, and STIX
Move security maturity past IOCs into understanding and countering the behavioral tradecraft of threats
Breaking down threats mapped against their tradecraft to tweak IOCs
Establish structured analytical techniques to be successful in any security role
Learn and apply structured principles in support of CTI and how to communicate that to any security role.

Course Prerequisites:

Security+, or equivalent experience

Comments

Latest comments from students

Liked the class? Then let everyone know!

TN-963: Windows Security Automation with PowerShell

Course Overview:

PowerShell is made for Security Operations (SecOps) automation on Windows. SecOps requires automation in order to scale out security changes and monitoring beyond a handful of hosts. For example, when a vulnerability must be remediated but there is no patch for it yet, automation is needed to quickly and consistently enact the changes necessary. PowerShell “remoting” is encrypted remote command execution of PowerShell scripts in a way that can scale to thousands of endpoints and servers.

Imagine being able to hunt for indicators of compromise across thousands of machines with just a few lines of PowerShell code. Or imagine having the local Administrator account password reset every night on thousands of endpoints in a secure way, and being able to retrieve that password securely too.

We will show you to do these tasks and more. Transcription logging for forensics, strong encryption code signing, application whitelisting of scripts, IPSec port control, and Just Enough Admin (JEA).

As more and more of our systems are moved up to the cloud, PowerShell will become even more important. Amazon Web Services, Microsoft Azure, Office 365, Hyper-V and VMware already support PowerShell administration for many tasks.

Attendees to TN-963: Windows Security Automation with PowerShell will receive TechNow approved course materials and expert instruction.

Date/Locations:

No Events

Duration: 3 days

Course Objectives:

Day One
PowerShell Overview and Tips

- Getting started running commands
- Using and updating the built-in help
- Execution policies
- Fun tricks with the ISE graphical editor
- Piping .NET and COM objects, not text
- Using properties and methods of objects
- Helping Linux admins feel more at home
- Aliases, cmdlets, functions, modules, etc.
- Customizing your profile script

What Can We Do With PowerShell

- PowerShell remote command execution
- Fan-out remoting and security
- File copy via PowerShell remoting
- Capturing the output of commands
- Parsing text files and logs with regex patterns
- Searching remote event logs faster with XPath
- Mounting the registry as a drive
- Exporting data to CSV, HTML and JSON files
- Parsing and mining nmap port scanner XML output
- Running scripts as scheduled jobs
- Pushing out scripts through Group Policy
- Importing modules and dot-sourcing functions
- http://www.PowerShellGallery.com

Write your own scripts

- Writing your own functions
- Passing arguments into your scripts
- Function parameters and returning output
- Flow control: if-then, do-while, foreach, switch
- The .NET Framework class library: a playground
- How to pipe data in/out of your scripts

Day Two
Continuous Secure Configuration Enforcement

- How to use Group Policy and PowerShell together
- Automate with INF security templates
- How to customize INF templates
- Microsoft Security Compliance Manager (SCM)
- SECEDIT.EXE scripting
- Building an in-house security repository for SecOps/DevOps
- NSA’s Secure Host Baseline GPOs

Group Policy Precision Targeting

- Managing Group Policy Objects (GPOs) with PowerShell
- LSDOU, Block Inheritance, Enforced GPOs
- Group Policy permissions for targeting changes
- ADMX templates for mass registry editing
- Deploying PowerShell startup and logon scripts
- WMI item-level targeting of GPO preferences
- GPO scheduled tasks to run PowerShell scripts
- Remote command execution via GPO (not remoting)
- Empowering the Hunt Team to fight back!

Server Hardening for SecOps/DevOps

- Server Manager scripting with PowerShell
- Adding and removing roles and feature
- Remotely inventory roles, features, and apps
- Why Server Nano or Server Core
- Running PowerShell automatically after service failure
- Service account identities, passwords, and risks
- Tools to reset service account passwords securely

Day Three
PowerShell Desired State Configuration (DSC)

- DSC is Configuration Management built in for free
- Using DSC for continuous reinforcement of settings
- Writing your own DSC configuration scripts
- Free DSC resource modules: www.PowerShellGallery.com
- How to push DSC configurations to many targets
- DSC background job processing in push mode
- Examples: sync files, install roles, manage groups
- Auditing a remote target against a DSC MOF template
- “ApplyAndAutoCorrect” mode for continuous enforcement

PowerShell Just Enough Admin (JEA)

- JEA is Windows sudo, like on Linux
- JEA is Windows setuid root, like on Linux
- Restricting commands and arguments
- Verbose transcription logging
- How to set up and configure JEA
- Privilege Access Workstations (PAWs)

PowerShell and WMI

- Windows Management Instrumentation (WMI) service
- What is WMI and why do hackers abuse it so much?
- Using PowerShell to query WMI CIM classes
- WMI authentication and traffic encryption
- Inventory operating system versions and installed software
- WMI remote command execution versus PowerShell remoting
- PowerShell security best practices
- PowerShell transcription logging to catch hackers

Prerequisites:

GSEC or equivalent experience
UNIX, Windows, Networking, and Security Experience
This is a hands-on skill course requiring comfort with command line interaction and network communications

Comments

Latest comments from students

First Name*
Last Name*
Your Email*
Your Organization*
Phone*