Black Hills Information Security, Inc.

Red Team Fundamentals for Active Directory w/ Eric Kuehn
2023-03-29 12:00 - 16:00, 2023-03-28 11:00 - 16:00 (America/New_York)
Register: https://www.antisyphontraining.com/red-team-fundamentals-for-active-directory/
The Red Team Fundamentals for Active Directory course is an 8-hour class focused on explaining the fundamentals of Active Directory and how different aspects can be exploited when performing penetration tests. The goal is not only to cover different attacks but also explain the details of why they work and how an environment can be made resilient to them and potentially detect malicious activity. This combination opens the course to those looking to hone their offensive skills as well as those who are protecting an enterprise network.
The course mixes lecture with a number of hands-on exercises to reinforce the information and techniques. The activities will cover ways to examine an Active Directory environment, looking for a variety of misconfigurations that are commonly seen in Active Directory implementations (even by some security-conscious entities), and then exploit these issues to pivot and escalate our access. Ultimately, the students will gain full control of an AD Forest.
While in class, students will be provided access to a lab containing realistic targets and tools to learn both the attacks and defenses of Active Directory. This environment enables the attendees to understand how the covered techniques are used in the real world.

SOC Core Skills w/ John Strand
2023-03-29 12:00 - 16:00, 2023-03-28 12:00 - 16:00, 2023-03-27 11:00 - 16:00
Register: https://www.antisyphontraining.com/soc-core-skills-w-john-strand/
This 16-hour information security training course will cover the core security skills all Security Operation Center (SOC) analysts need to have. These are the skills that all Black Hills Information Security (BHIS) SOC team members need to have.

AASLR: Antisyphon Address Space Layout Randomization
2023-03-28 16:30 - 17:30, 2023-03-22 16:30 - 17:30, 2023-03-21 16:30 - 17:30, 2023-03-15 16:30 - 17:30, 2023-03-14 16:30 - 17:30, 2023-03-08 16:30 - 17:30, 2023-03-07 16:30 - 17:30
AASLR will have infosec professionals sharing their knowledge on tools, techniques, and procedures and then answering a lot of your questions on everything you can think to ask.
Streamed live every Tuesday and Wednesday @ 4:30 pm.
https://www.twitch.tv/antisyphon

BHIS | Talkin' Bout Infosec News
2023-03-27 16:30 - 17:30, 2023-03-20 16:30 - 17:30, 2023-03-13 16:30 - 17:30, 2023-03-06 16:30 - 17:30
Join the BHIS team as we talk about current infosec news.
Streamed live every Monday @ 4:30 pm.
https://www.youtube.com/BlackHillsInformationSecurity

BHIS Webcast: Attack Surface Management 101 w/ Ashley Knowles
2023-03-23 13:00 - 14:00
Register:
https://zoom.us/webinar/register/WN_-DCeQRWpTeqhZaccVeB66w
Why does every organization, regardless of size, need a form of Attack Surface Management (ASM)? Every day there are more and more cyber security attacks on organizations across the globe that have folks scratching their heads wondering how to identify and remediate these potential attack vectors. Enter ASM, where the aim is to identify and protect critical IT infrastructure and digital assets.
In this BHIS webcast, Ashley will cover real-world examples and participants will gain a better understanding of the impact of not having proper ASM practices in place.

BSides Rochester
2023-03-18 08:00 - 17:00

WiCyS (Women in CyberSecurity)
2023-03-16 08:00 - 2023-03-18 17:00

Foundational Data Protection Training (FDPT)
2023-03-15 12:00 - 16:00, 2023-03-14 11:00 - 16:00
Register: https://www.antisyphontraining.com/foundational-data-protection-training
This foundational course is designed to provide the basic tools needed to protect the data that is most valuable to your business. Since data is an integral part of an organization’s core operations, it’s important to build a solid foundation for understanding the considerations and mechanisms related to data protection.
The protection of sensitive data is paramount for information security professionals. The course is intended to help provide the techniques and tools needed to conduct a self-assessment of your data protection program. This helps ensure that your limited resources are being dedicated to the places within your security program needing the most attention, and based on corporate goals, needs, and regulatory compliance requirements.

PowerShell for InfoSec: What You Need to Know! w/ Carrie Roberts
2023-03-03 10:00 - 18:00
Register: https://www.antisyphontraining.com/powershell-for-infosec-what-you-need-to-know/
PowerShell is an excellent cross-platform shell for executing commands and scripts on both local and remote machines. It is installed on Windows by default and is widely used by both network defenders and attackers. This course will cover key PowerShell concepts that both blue and red teamers should understand including logging, credential management, remote administration, security bypass techniques, and popular PowerShell attack tools.

Introduction to Python w/ Joff Thyer
2023-03-03 10:00 - 18:00
Register: https://www.antisyphontraining.com/introduction-to-python/
One of the most pressing needs Information Security professionals face today is the need to automate their work in both the attack, and defense context. Skills gained for automating tasks in programming languages are critical to scale up the efforts of a limited security professional talent pool.
For example, it is not uncommon to find useful Python scripts on the Internet that are at a Proof-of-Concept stage to quickly achieve some information security professional goal. Penetration testers, incident responders, forensics, and defense professionals need the ability to be able to take existing code and produce stable functional Python tools or be able to debug an issue with an existing tool.
This course aims to teach the fundamentals of the Python programming language such that a student will gain a beginning to intermediate level of competency with the language. Labs will be presented in a Capture the Flag (CTF) style format as well as some more comprehensive programming tasks.
The expectation as to whether students can complete all exercises is dependent on prior student experience, and knowledge. Python is a language that is best approached if a student has some elementary programming background (such as shell scripting for example).

Advanced Endpoint Investigations w/ Jake Williams
2023-03-03 10:00 - 18:00
For most security teams, high operational tempo (measured in dumpster fire lumens) incentivizes analysts to stick to well-tailored playbooks that prioritize remediation at the expense of proper incident scoping and root cause analysis. Though modern endpoint security products have significantly improved host visibility, most critical incidents will require the acquisition and analysis of additional endpoint data. This course focuses on four core investigative competencies: endpoint data collection, investigative triage, incident response pivots, and root cause analysis.
After learning about key endpoint artifact and memory analysis techniques for Windows and Linux, attendees will work through real-world scenarios in hands-on labs. We’ll pivot from initial detection into host triage analysis to discern attackers’ discovery, defense evasion and lateral movement techniques. Attendees will learn to identify key indicators for the generation of high-fidelity detections.

https://www.antisyphontraining.com/advanced-endpoint-investigations/

Introduction to Pentesting w/ John Strand
2023-03-03 10:00 - 18:00
Register: https://www.antisyphontraining.com/introduction-to-pentesting/
Are you looking to make a transition into pentesting but are overwhelmed or just don’t know how to get started? With numerous different types of engagements, operational phases, and a constant flood of new vulnerabilities hitting the industry, the journey into penetration testing can quickly become confusing.
In this training course, we will examine the different types of penetration testing engagements and take a deep dive into establishing a repeatable testing methodology for executing quality tests. We will look at some tools of the trade to understand what they are doing under the hood, identify what separates a great finding from a good finding in reports, and really zero in on establishing your own methodology!
By the end of the training, you can expect to leave with a firm understanding of how pentests are executed and a newfound comfortability performing penetration tests. We will also provide numerous resources and tools that will help you pave your way into a pentesting career!

Network Forensics and Incident Response w/ Troy Wojewoda
2023-03-03 10:00 - 18:00
Register: https://www.antisyphontraining.com/network-forensics-and-detection-w-troy-wojewoda/
Incident responders are continually faced with the challenge of collecting and analyzing relevant event data—network communications is no exception. This course uses an assortment of network data acquisition tools and techniques with a focus on open-source, vendor-neutral solutions. Students who take this course will learn how to perform network traffic and protocol analysis that ultimately supports cybersecurity incident response efforts. From reconnaissance to data exfiltration, network traffic scales to provide a bird’s-eye view of attacker activity. Leveraging the vantage point of key network traffic chokepoints, this course explores nearly every phase of an attacker’s methodology. Students will learn network traffic analysis concepts and work through hands-on lab exercises that reinforce the course material using real-world attack scenarios.

Modern WebApp Pentesting w/ BB King
2023-03-03 10:00 - 18:00
Register: https://www.antisyphontraining.com/modern-webapp-pentesting-w-bb-king/
Modern Webapp Pentesting is unique in its approach to testing webapps. Too many courses are built around the assumption that a webapp pentester’s skills should grow along a straight line, starting with something like the OWASP Top Ten and culminating in something like Attacking Web Cryptography. Real webapps don’t follow that same path, and neither should real webapp pentesters. Attacking Web Sockets is not more difficult than attacking HTTP traffic, it’s just different. Web APIs are not something you’re qualified to test only after you’ve put your time in on traditional webapps … they’re just different.
This course doesn’t worry about where a student falls on the imaginary scale of beginner to expert but instead focuses on finding and exploiting the kinds of issues found in real webapps today, based on the instructor’s many years of ongoing experience in testing … real webapps today.

Offensive Development w/ Greg Hatcher & John Stigerwalt
2023-03-03 10:00 - 18:00
Register: https://www.antisyphontraining.com/offensive-development-w-greg-hatcher-john-stigerwalt/
Dive deep into cutting edge techniques that bypass or neuter modern endpoint defenses. Learn how these solutions work to mitigate their utility and hide deep within code on the endpoint. The days of downloading that binary from the internet and pointing it at a remote machine are over. Today’s defenses oftentimes call for multiple bypasses within a single piece of code.
This course is designed to take you deep into defensive and offensive tooling – an apex attacker must know the own indicators of compromise (IOCs) they’re creating and the artifacts they’re
leaving behind.

Enterprise Attack Initial Access w/ Steve Borosh
2023-03-03 10:00 - 18:00
Register: https://www.antisyphontraining.com/enterprise-attack-initial-access-w-steve-borosh/
Enterprises have been working tirelessly to improve their security postures through defense-in-depth approaches. Offensive teams have also been putting in long hours of research into bypassing the latest EDR’s and defensive products that keep them on their toes. Long gone “hopefully” are the days of hurdling an HTA file laced with a download cradle at a mature organization with a “Free iPad” ruse and watching your screen fill with incoming agents.
An offense-in-depth approach may be applied to offensive practitioners looking for success against organizations well-versed in defending a large enterprise. Today’s organizations have assets in multiple geo regions, networks, cloud services, border hosts, and many of them are tied to the internal network in some way.
This course aims to help offensive practitioners successfully exercise their client environments from a multi-faceted approach using the latest TTPs blended with esoteric practices to gain the upper hand on your assessments.

Breaching the Cloud w/ Beau Bullock
2023-03-03 10:00 - 18:00
Register: https://www.antisyphontraining.com/breaching-the-cloud-w-beau-bullock/
Do you want to level up your cloud penetration testing skills? The attack surface of many organizations has changed to include third-party hosted services such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform. In this training course, hacking concepts will be introduced for each of those services.
This training walks through a complete penetration testing methodology of cloud-based infrastructure. Starting with no information other than the company name you will learn to discover what cloud-specific assets your target is using. Following the enumeration of cloud services, you will learn how to discover misconfigurations that commonly expose sensitive data as well as a thorough understanding of how to get an initial foothold into a cloud-based organization.
Post-compromise techniques of cloud infrastructure differ from the techniques used in typical on-premise environments. You will learn situational awareness techniques that ultimately will impact how you will escalate privileges in the cloud. With most cloud-based authentication being publicly exposed this presents new and interesting persistence techniques that are non-existent to on-premise environments. With productivity tools like G-Suite and Microsoft 365 many organizations are making their email and other data that is normally protected by a firewall available to remote employees. You will learn how to discover, pillage, and exfiltrate data from these services.
Many organizations are fully leveraging cloud services for their production infrastructure. This can include web servers, SQL databases, storage, virtual machines, and more. In this training, you will learn how to assess and compromise these resources. Some cloud deployments are directly connected to on-premise environments via VPN. This presents an opportunity to pivot access from cloud to on-prem or vice-versa.
Finally, in this training, we will not only be attacking cloud infrastructure but also leveraging it for red team operations. You will learn techniques that leverage cloud services for techniques such as phishing, domain fronting, and command & control.
Tools and techniques used on real-world penetration tests against cloud assets will be shared including hands-on demonstrations. At the end of this training, you will have new skills for assessing cloud-based infrastructure!
