Black Hills Information Security, Inc.

PowerShell for InfoSec: What You Need to Know! w/ Carrie Roberts
2023-03-03 10:00 - 18:00, 2023-03-02 09:00 - 18:00 (America/New_York) | CO
Register: https://www.antisyphontraining.com/powershell-for-infosec-what-you-need-to-know/
PowerShell is an excellent cross-platform shell for executing commands and scripts on both local and remote machines. It is installed on Windows by default and is widely used by both network defenders and attackers. This course will cover key PowerShell concepts that both blue and red teamers should understand including logging, credential management, remote administration, security bypass techniques, and popular PowerShell attack tools.

Introduction to Python w/ Joff Thyer
2023-03-03 10:00 - 18:00, 2023-03-02 09:00 - 18:00
Register: https://www.antisyphontraining.com/introduction-to-python/
One of the most pressing needs Information Security professionals face today is the need to automate their work in both the attack, and defense context. Skills gained for automating tasks in programming languages are critical to scale up the efforts of a limited security professional talent pool.
For example, it is not uncommon to find useful Python scripts on the Internet that are at a Proof-of-Concept stage to quickly achieve some information security professional goal. Penetration testers, incident responders, forensics, and defense professionals need the ability to be able to take existing code and produce stable functional Python tools or be able to debug an issue with an existing tool.
This course aims to teach the fundamentals of the Python programming language such that a student will gain a beginning to intermediate level of competency with the language. Labs will be presented in a Capture the Flag (CTF) style format as well as some more comprehensive programming tasks.
The expectation as to whether students can complete all exercises is dependent on prior student experience, and knowledge. Python is a language that is best approached if a student has some elementary programming background (such as shell scripting for example).

Advanced Endpoint Investigations w/ Jake Williams
2023-03-03 10:00 - 18:00, 2023-03-02 09:00 - 18:00
For most security teams, high operational tempo (measured in dumpster fire lumens) incentivizes analysts to stick to well-tailored playbooks that prioritize remediation at the expense of proper incident scoping and root cause analysis. Though modern endpoint security products have significantly improved host visibility, most critical incidents will require the acquisition and analysis of additional endpoint data. This course focuses on four core investigative competencies: endpoint data collection, investigative triage, incident response pivots, and root cause analysis.
After learning about key endpoint artifact and memory analysis techniques for Windows and Linux, attendees will work through real-world scenarios in hands-on labs. We’ll pivot from initial detection into host triage analysis to discern attackers’ discovery, defense evasion and lateral movement techniques. Attendees will learn to identify key indicators for the generation of high-fidelity detections.

https://www.antisyphontraining.com/advanced-endpoint-investigations/

Introduction to Pentesting w/ John Strand
2023-03-03 10:00 - 18:00, 2023-03-02 09:00 - 18:00
Register: https://www.antisyphontraining.com/introduction-to-pentesting/
Are you looking to make a transition into pentesting but are overwhelmed or just don’t know how to get started? With numerous different types of engagements, operational phases, and a constant flood of new vulnerabilities hitting the industry, the journey into penetration testing can quickly become confusing.
In this training course, we will examine the different types of penetration testing engagements and take a deep dive into establishing a repeatable testing methodology for executing quality tests. We will look at some tools of the trade to understand what they are doing under the hood, identify what separates a great finding from a good finding in reports, and really zero in on establishing your own methodology!
By the end of the training, you can expect to leave with a firm understanding of how pentests are executed and a newfound comfortability performing penetration tests. We will also provide numerous resources and tools that will help you pave your way into a pentesting career!

Network Forensics and Incident Response w/ Troy Wojewoda
2023-03-03 10:00 - 18:00, 2023-03-02 09:00 - 18:00
Register: https://www.antisyphontraining.com/network-forensics-and-detection-w-troy-wojewoda/
Incident responders are continually faced with the challenge of collecting and analyzing relevant event data—network communications is no exception. This course uses an assortment of network data acquisition tools and techniques with a focus on open-source, vendor-neutral solutions. Students who take this course will learn how to perform network traffic and protocol analysis that ultimately supports cybersecurity incident response efforts. From reconnaissance to data exfiltration, network traffic scales to provide a bird’s-eye view of attacker activity. Leveraging the vantage point of key network traffic chokepoints, this course explores nearly every phase of an attacker’s methodology. Students will learn network traffic analysis concepts and work through hands-on lab exercises that reinforce the course material using real-world attack scenarios.

Modern WebApp Pentesting w/ BB King
2023-03-03 10:00 - 18:00, 2023-03-02 09:00 - 18:00
Register: https://www.antisyphontraining.com/modern-webapp-pentesting-w-bb-king/
Modern Webapp Pentesting is unique in its approach to testing webapps. Too many courses are built around the assumption that a webapp pentester’s skills should grow along a straight line, starting with something like the OWASP Top Ten and culminating in something like Attacking Web Cryptography. Real webapps don’t follow that same path, and neither should real webapp pentesters. Attacking Web Sockets is not more difficult than attacking HTTP traffic, it’s just different. Web APIs are not something you’re qualified to test only after you’ve put your time in on traditional webapps … they’re just different.
This course doesn’t worry about where a student falls on the imaginary scale of beginner to expert but instead focuses on finding and exploiting the kinds of issues found in real webapps today, based on the instructor’s many years of ongoing experience in testing … real webapps today.

Offensive Development w/ Greg Hatcher & John Stigerwalt
2023-03-03 10:00 - 18:00, 2023-03-02 09:00 - 18:00
Register: https://www.antisyphontraining.com/offensive-development-w-greg-hatcher-john-stigerwalt/
Dive deep into cutting edge techniques that bypass or neuter modern endpoint defenses. Learn how these solutions work to mitigate their utility and hide deep within code on the endpoint. The days of downloading that binary from the internet and pointing it at a remote machine are over. Today’s defenses oftentimes call for multiple bypasses within a single piece of code.
This course is designed to take you deep into defensive and offensive tooling – an apex attacker must know the own indicators of compromise (IOCs) they’re creating and the artifacts they’re
leaving behind.

Enterprise Attack Initial Access w/ Steve Borosh
2023-03-03 10:00 - 18:00, 2023-03-02 09:00 - 18:00
Register: https://www.antisyphontraining.com/enterprise-attack-initial-access-w-steve-borosh/
Enterprises have been working tirelessly to improve their security postures through defense-in-depth approaches. Offensive teams have also been putting in long hours of research into bypassing the latest EDR’s and defensive products that keep them on their toes. Long gone “hopefully” are the days of hurdling an HTA file laced with a download cradle at a mature organization with a “Free iPad” ruse and watching your screen fill with incoming agents.
An offense-in-depth approach may be applied to offensive practitioners looking for success against organizations well-versed in defending a large enterprise. Today’s organizations have assets in multiple geo regions, networks, cloud services, border hosts, and many of them are tied to the internal network in some way.
This course aims to help offensive practitioners successfully exercise their client environments from a multi-faceted approach using the latest TTPs blended with esoteric practices to gain the upper hand on your assessments.

Breaching the Cloud w/ Beau Bullock
2023-03-03 10:00 - 18:00, 2023-03-02 09:00 - 18:00
Register: https://www.antisyphontraining.com/breaching-the-cloud-w-beau-bullock/
Do you want to level up your cloud penetration testing skills? The attack surface of many organizations has changed to include third-party hosted services such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform. In this training course, hacking concepts will be introduced for each of those services.
This training walks through a complete penetration testing methodology of cloud-based infrastructure. Starting with no information other than the company name you will learn to discover what cloud-specific assets your target is using. Following the enumeration of cloud services, you will learn how to discover misconfigurations that commonly expose sensitive data as well as a thorough understanding of how to get an initial foothold into a cloud-based organization.
Post-compromise techniques of cloud infrastructure differ from the techniques used in typical on-premise environments. You will learn situational awareness techniques that ultimately will impact how you will escalate privileges in the cloud. With most cloud-based authentication being publicly exposed this presents new and interesting persistence techniques that are non-existent to on-premise environments. With productivity tools like G-Suite and Microsoft 365 many organizations are making their email and other data that is normally protected by a firewall available to remote employees. You will learn how to discover, pillage, and exfiltrate data from these services.
Many organizations are fully leveraging cloud services for their production infrastructure. This can include web servers, SQL databases, storage, virtual machines, and more. In this training, you will learn how to assess and compromise these resources. Some cloud deployments are directly connected to on-premise environments via VPN. This presents an opportunity to pivot access from cloud to on-prem or vice-versa.
Finally, in this training, we will not only be attacking cloud infrastructure but also leveraging it for red team operations. You will learn techniques that leverage cloud services for techniques such as phishing, domain fronting, and command & control.
Tools and techniques used on real-world penetration tests against cloud assets will be shared including hands-on demonstrations. At the end of this training, you will have new skills for assessing cloud-based infrastructure!

Advanced Network Threat Hunting w/ Chris Brenton
2023-03-03 10:00 - 18:00, 2023-03-02 09:00 - 18:00
Register: https://www.antisyphontraining.com/advanced-network-threat-hunting-w-chris-brenton/
So far we’ve had over 21,000 students attend our one-day network threat hunting course. Many have asked that we provide an extended class with more hands-on lab time. That is exactly what we have rolled into this 16-hour course!
We will spend most of this class analyzing pcap files for Command and Control (C2) communications in order to identify malware back channels. It is assumed that the student will already understand the basics of network threat hunting, so we can immediately jump into applying that knowledge. The goal will be to create a threat hunting runbook that you can use within your own organization in order to identify systems that have been compromised.

How to be Irresistible to Hiring Managers w/ Kip Boyle
2023-03-03 10:00 - 18:00
Register: https://www.antisyphontraining.com/how-to-be-irresistible-to-hiring-managers/
Are you spending hours a day trawling through the online job sites and spending even more time filling out lengthy application forms with nothing to show for it? Something’s not working, but what could it be? Kip Boyle, a veteran hiring manager who has personally interviewed hundreds of job applicants as well as hired dozens of successful cybersecurity candidates, will teach you to think like a hiring manager and bend the hiring process to your advantage. After you taking this class, you’ll understand how to ace your resume, crush your interviews, and negotiate your ideal salary.

Linux Command-Line Dojo w/ Hal Pomeranz
2023-03-03 10:00 - 18:00
Register: https://www.antisyphontraining.com/linux-command-line-dojo-w-hal-pomeranz/
The DevOps folks are pushing Linux, your red-team friends are doing serious damage with Linux-based tools, and the Linux users on your Incident Response team are doing mysteriously powerful things. You’re ready to see if some of the Linux magic can rub off on you, but you don’t know where to start.
This 16-hour course is a quick jumpstart on the Linux command-line. Start from the basics and work all the way up to command-line programming. Short learning modules and lots of practical hands-on activities will put you on the road to Linux command-line mastery. And electronic copies of everything are yours to take home, so you can continue the learning even after class is over.

HackerOps w/ Ralph May
2023-03-03 10:00 - 18:00
To conduct an advanced attack, you need more than just a collection of simple scripts. In addition to talent, you need a large amount of managed and unmanaged code. The more code and resources that are required to conduct an engagement, the more time we need. Time is something we don’t have a lot of on an engagement.
Today, to be an advanced and effective attacker, you need to move fast, and that speed requires a move to a DevOps style of managing infrastructure and code. With cloud resources and APIs to manage these resources, the days of manual setup are long behind us.
Where do we get started? And how does it all work?
In this training, we learn the fundamentals of DevOps and how we can code our TTPs. Coding TTPs allows for new tactics and improved OPSEC to be shared without the cost of knowledge transfer and manual setup. This class will introduce students to Terraform Ansible and Docker with the goal of writing TTPs to use and share.
In this class, we will learn the fundamentals of Terraform Ansible and Docker with an emphasis on how we can use these tools to code our TTPs. After we have the fundamentals, we will start coding and get comfortable with YAML and will review how to create resources and customize TTPs. Lastly, we will work through multiple labs and examples that you can take with you for your next engagement.
https://www.antisyphontraining.com/hackerops-w-ralph-may/

Active Defense & Cyber Deception w/ John Strand
2023-03-02 12:00 - 16:00
Register: https://www.antisyphontraining.com/active-defense-cyber-deception-w-john-strand/
Active Defenses have been capturing a large amount of attention in the media lately. There are those who thirst for vengeance and want to directly attack the attackers. There are those who believe that any sort of active response directed at an attacker is wrong. We believe the answer is somewhere in between.
In this class, you will learn how to force an attacker to take more moves to attack your network. These moves may increase your ability to detect them. You will learn how to gain better attribution as to who is attacking you and why. You will also find out how to get access to a bad guy’s system. And most importantly, you will find out how to do the above legally.
The current threat landscape is shifting. Traditional defenses are failing us. We need to develop new strategies to defend ourselves. Even more importantly, we need to better understand who is attacking us and why. Some of the things we talk about you may implement immediately, others may take you a while to implement. Either way, consider what we discuss as a collection of tools at your disposal when you need them to annoy attackers, attribute who is attacking you, and finally, attack the attackers.
This class is based on the DARPA funded Active Defense Harbinger Distribution live Linux environment. This VM is built from the ground up for defenders to quickly implement Active Defenses in their environments. This class is also very heavy with hands-on labs. We will not just talk about Active Defenses. We will be doing hands-on labs and through them in a way that can be quickly and easily implemented in your environment.

Securing the Cloud: Foundations w/ Andrew Krug
2023-03-02 09:00 - 18:00
Register: https://www.antisyphontraining.com/securing-the-cloud-foundations-w-andrew-krug/
In this course, we’ll explore Amazon Web Services (AWS) as a platform. We will take the perspective of a new startup company spinning up infrastructure in AWS for the very first time. We’ll use a scenario-based approach, where you’ll don the persona of a security engineer on your first day at a new startup. This course will demonstrate ideas like secure-by-default and will examine services and patterns for locking down defaults using a combination of open source and platform-native tooling. Finally, attendees will walk away with a practical understanding of various controls, detections, and guardrails.

Professionally Evil API Testing
2023-03-02 09:00 - 18:00
Register: https://www.antisyphontraining.com/professionally-evil-api-testing/

This workshop-style intermediate course is designed to complement a student’s understanding of traditional Web Application Security. It focuses on modern application and API security features and tactics to protect APIs and microservices from attacks. Because the material in this course leans on standard HTTP and browser features, and standard web and API security best practices, the lessons and labs are applicable across programming languages and platform implementations. This material in this course is approached both from the perspective of an adversary and that of a defender.

Intro to Offensive Tooling w/ Chris Traynor
2023-03-02 09:00 - 18:00
Register: https://www.antisyphontraining.com/intro-to-offensive-tooling-w-chris-traynor/
Information security is an increasingly important field, as the amount of data being transmitted and stored digitally continues to grow. In order to protect this data from unauthorized access, it is important for individuals and organizations to have a strong understanding of the tools and techniques used by attackers.
The Intro to Offensive Tooling training course will cover the basics of common offensive tools, including Nmap, Recon-ng, Metasploit, proxychains, Responder, and many more. The tools discussed are used by security professionals to identify vulnerabilities and exploit them in order to test the security of a system or network. The class will cover an overview of each tool, its key features, and functionality, as well as practical exercises to reinforce how they can be used in a real-world scenario. Participants will also learn best practices for using these tools responsibly and within the bounds of ethical hacking.

Red Team Fundamentals for Active Directory w/ Eric Kuehn
2023-03-02 09:00 - 18:00
Register: https://www.antisyphontraining.com/red-team-fundamentals-for-active-directory/
The Red Team Fundamentals for Active Directory course is an 8-hour class focused on explaining the fundamentals of Active Directory and how different aspects can be exploited when performing penetration tests. The goal is not only to cover different attacks but also explain the details of why they work and how an environment can be made resilient to them and potentially detect malicious activity. This combination opens the course to those looking to hone their offensive skills as well as those who are protecting an enterprise network.
The course mixes lecture with a number of hands-on exercises to reinforce the information and techniques. The activities will cover ways to examine an Active Directory environment, looking for a variety of misconfigurations that are commonly seen in Active Directory implementations (even by some security-conscious entities), and then exploit these issues to pivot and escalate our access. Ultimately, the students will gain full control of an AD Forest.
While in class, students will be provided access to a lab containing realistic targets and tools to learn both the attacks and defenses of Active Directory. This environment enables the attendees to understand how the covered techniques are used in the real world.

Incident Response Foundations w/ Derek Banks
2023-03-02 09:00 - 18:00
Register: https://www.antisyphontraining.com/incident-response-foundations-w-derek-banks/
Are you just getting started with Incident Response (IR) and not sure where to begin? Do you need to stand up an IR program or establish a Computer Security and Incident Response Team and need to get started on the right foot?
Incident Response can be one of the most difficult aspects of Information Security and foundational skills are critical.
The goal of this course is to provide the core components that make up a successful Incident Response program. Students will learn how to get started on their IR journey, what to prioritize, and why boring stuff like policies and procedures are just as important as technical digital forensics skills.
We will cover the logging and monitoring capabilities necessary to be able to successfully investigate and triage an incident as well as what to do when those log sources fail. The concepts and skills introduced in this class will lay the groundwork for the next steps in the IR journey of in-depth endpoint and network forensics and analysis.
