Alert Analysis

This course covers FireEye-generated alerts. It provides a framework for interpreting callbacks and the results of malware binary analysis. Hands-on activities include analyzing alert data to determine the significance of alerts.

Learning Objectives

After completing this course, learners should be able to:

  • Distinguish FireEye alert types
  • Locate and use critical information in a FireEye alert to assess a potential threat
  • Use indicators of compromise (IOCs) in a FireEye alert to identify the threat on compromised hosts

Who Should Attend

Network security professionals, incident responders and FireEye administrators and analysts who must work with alerts generated by FireEye products.

Prerequisites

Completion of at least one instructor-led or web-based FireEye deployment training course or experience administering FireEye appliances. A working understanding of networking and network security, the Windows operating system, file system, registry and use of the CLI.

Duration

2 days

Instructor-Led Training Instructor-Led Training

Courses cannot be purchased or accessed from this site.

If you would like to register for this course, please contact your FireEye account manager.

Thank you.

Course Outline

Instructor-led sessions are typically a blend of lecture and hands-on lab activities.

  1. FireEye Core Technology
    • Malware infection lifecycle
    • MVX engine
    • Appliance analysis phases
  2. Malware Landscape
    • Malware overview and definition
    • Motivations of malware
    • Mandiant Attack Lifecycle
    • Types of malware
  3. Threat Management
    • Primary NX functions
    • Event types
    • Web UI and dashboard
    • Managing alerts
  4. Web Infections & Exploits
    • Web Infection alerts
    • OS Change Details - Web Infections
    • Honey binary
    • Second-stage payloads
    • Triaging Web Infections
  5. Malware Objects
    • Malware Object alerts
    • BOT Communication Details
    • OS Change Details – Objects
    • Malware Object origin analysis
  6. Callbacks
    • Malware Callback alerts
    • Callback Behavior
    • Encrypted Callbacks
    • Callback Payload
    • Domain Match
    • Threat Assessment
  7. Case Study: Backdoor.Netwire
    • OS Change detail
    • Windows API
    • Windows registry
    • Code injection
    • Alternate data streams
    • Processes and Network Activity
    • Mutexes
    • Registry Run Keys
    • User Account Control
Optional Add-On Lesson
  • Yara Malware Framework File Signatures
  • YARA on FireEye Appliances
  • YARA Hexadecimal
  • Regular Expressions
  • Conditions
  • Snort Rule Processing
  • Enabling Snort Rules
  • Creating A Snort Rule