Part 3: Incident Analysis and Threat Hunting on Windows Systems

This part provides a detailed exploration of the entire attack life cycle and the corresponding incident response steps in a Windows environment. It begins with an examination of the initial access techniques employed by attackers, including the methods used to breach perimeters and establish a foothold, as well as the investigation methods and forensic artifacts involved in identifying these breaches. We then discuss how attackers explore and map the Windows environment after gaining initial access, identifying active hosts and key assets, and how to detect and respond to these discovery activities. Furthermore, this section delves into the topic of network propagation, describing the methods employed by attackers to move laterally across the network, maintain persistence, and prepare for data exfiltration. It outlines the techniques used to gather sensitive data, such as personally identifiable information, financial...