SEC504: Hacker Tools, Techniques, and Incident Handling

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usConnect, learn, and share with other cybersecurity professionals
Engage, challenge, and network with fellow CISOs in this exclusive community of security leaders
Become a member for instant access to our free resources.
Sign UpMission-focused cybersecurity training for government, defense, and education
Explore industry-specific programming and customized training solutions
Sponsor a SANS event or research paper
We're here to help.
Contact UsPhil is VP of Cyber Defense Strategy at Gem Security, the Cloud Detection & Response (CDR) company. Prior to Gem, he held executive roles at innovative startups like CardinalOps, CyberX, Veracode, and Guardium as well as at larger organizations like Microsoft Security, IBM Security, and Symantec. Phil has a BSEE from McGill University, is certified in cloud security (CCSK), and has a black belt in American Jiu-Jitsu.
Explore content featuring this instructor’s insights and expertise.
Detecting attacks in their earliest stages — before they impact your business — is a key element of an effective threat detection and incident response (TDIR) strategy. But according to Mandiant’s 2022 M-Trends Special Report, it still takes an average of 21 days to detect a successful cyberattack — and only an average of 92 minutes for threat actors to move laterally across a compromised network.
For many years, security professionals have advocated the approach of collecting logs from all the places where they’re generated and centralizing them into one or only a few places.
Adversaries are increasingly targeting multi-cloud infrastructures to disrupt operations and demand ransomware, exfiltrate sensitive data, and steal funds. To accomplish this while evading detection, they often adapt traditional Living-off-the-Land (LOTL) tactics to the specific API-driven characteristics of the cloud.