Aucun résultat pour cette recherche.

Parcours de Formation Cybersécurité Défensive¶

Formation complète : SOC Analyst | Blue Team | Incident Response | Digital Forensics

Table des Matières¶

#Fondamentaux Essentiels
#SOC Analyst
#Blue Team
#Incident Response
#Digital Forensics
#Threat Intelligence
#Outils Open Source Essentiels
#Labs et Environnements de Pratique
#Certifications Recommandées
#Roadmap d’Apprentissage

1. Fondamentaux Essentiels¶

1.1 Réseaux et Protocoles¶

Concepts à Maîtriser¶

[ ] Modèle OSI et TCP/IP
Couches réseau et leur rôle
Encapsulation des données
[ ] Protocoles Essentiels
TCP/UDP
HTTP/HTTPS
DNS
SMTP/POP3/IMAP
FTP/SFTP
SMB/CIFS
LDAP/Kerberos
SNMP
ICMP
[ ] Concepts Réseau
Subnetting et CIDR
VLANs
Routage et switching
NAT/PAT
VPN (IPSec, SSL VPN)
Firewalls et ACLs
Proxy et reverse proxy

Outils à Maîtriser¶

# Analyse réseau
- Wireshark          # Capture et analyse de paquets
- tcpdump            # Capture en ligne de commande
- tshark             # Wireshark CLI
- Zeek (Bro)         # Network security monitoring
- nmap               # Scan réseau
- netcat (nc)        # Connexions réseau
- socat              # Tunnel réseau avancé

Vocabulaire¶

Packet: Unité de données transmise
Handshake: Établissement de connexion (ex: TCP 3-way handshake)
TTL: Time To Live
Latency: Délai de transmission
Bandwidth: Bande passante
Throughput: Débit réel

1.2 Systèmes d’Exploitation¶

Linux (Essentiel)¶

Distributions à connaître: - Ubuntu/Debian (environnement SOC) - CentOS/RHEL (entreprise) - Security Onion (SIEM) - SIFT Workstation (forensics) - Kali Linux (outils offensifs pour comprendre les attaques)

Compétences Linux: - [ ] Ligne de commande avancée (bash, zsh) - [ ] Gestion des processus (ps, top, htop, kill) - [ ] Système de fichiers (permissions, ownership) - [ ] Logs système (/var/log/) - [ ] Services et démons (systemd, systemctl) - [ ] Réseau (ifconfig, ip, netstat, ss) - [ ] Scripting bash - [ ] Cron jobs et automation

# Commandes essentielles pour SOC
tail -f /var/log/syslog              # Suivi logs en temps réel
journalctl -xe                        # Logs systemd
grep -r "pattern" /var/log/          # Recherche dans logs
find / -name "*.log" -mtime -1       # Fichiers modifiés 24h
ps aux | grep suspicious             # Processus suspects
netstat -tulpn                       # Connexions réseau
ss -tunap                            # Sockets actifs
lsof -i :80                          # Fichiers ouverts sur port
last -a                              # Dernières connexions
who                                  # Utilisateurs connectés

Windows¶

Compétences Windows: - [ ] PowerShell (essentiel pour IR) - [ ] Event Viewer (Event IDs critiques) - [ ] Registry (structure et analyse) - [ ] Active Directory - [ ] Group Policy - [ ] Windows Services - [ ] Task Scheduler - [ ] Windows Defender et antivirus

Event IDs Critiques à Connaître:

4624 - Successful logon
4625 - Failed logon
4672 - Special privileges assigned
4720 - User account created
4732 - User added to security group
4688 - New process created
4697 - Service installed
7045 - Service installed (System log)
1102 - Audit log cleared
4104 - PowerShell script block logging
4103 - PowerShell module logging

PowerShell pour IR:

# Analyse de sécurité Windows
Get-EventLog -LogName Security -Newest 100
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624}
Get-Process | Select-Object Name, ID, Path
Get-Service | Where-Object {$_.Status -eq "Running"}
Get-ScheduledTask | Where-Object {$_.State -eq "Ready"}
Get-NetTCPConnection -State Established
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Run
Get-WmiObject Win32_StartupCommand

1.3 Fondamentaux de Sécurité¶

Concepts de Cybersécurité¶

[ ] CIA Triad
Confidentiality (Confidentialité)
Integrity (Intégrité)
Availability (Disponibilité)
[ ] AAA
Authentication (Authentification)
Authorization (Autorisation)
Accounting (Traçabilité)
[ ] Defense in Depth (Défense en profondeur)
Plusieurs couches de sécurité
Principe du moindre privilège
Séparation des responsabilités
[ ] Kill Chain / MITRE ATT&CK
Phases d’une cyber-attaque
Tactiques, Techniques et Procédures (TTPs)

Cryptographie de Base¶

[ ] Chiffrement symétrique vs asymétrique
[ ] Hash (MD5, SHA-1, SHA-256, SHA-512)
[ ] Certificats et PKI
[ ] SSL/TLS
[ ] Digital signatures

2. SOC Analyst¶

2.1 Rôle et Responsabilités¶

Niveaux SOC: - Tier 1: Triage initial, alertes de premier niveau - Tier 2: Analyse approfondie, investigation - Tier 3: Threat hunting, analyse avancée, réponse complexe

Missions principales: - Surveillance continue (24/7) - Analyse des alertes de sécurité - Triage et escalade des incidents - Utilisation des SIEM - Documentation des incidents - Threat hunting proactif - Amélioration continue des détections

2.2 SIEM (Security Information and Event Management)¶

Concepts SIEM¶

[ ] Log aggregation et corrélation
[ ] Normalisation des logs
[ ] Règles de détection (correlation rules)
[ ] Use cases de sécurité
[ ] Dashboards et visualisation
[ ] Alerting et notification
[ ] Retention des logs
[ ] Log sources integration

SIEM Open Source¶

2.2.1 ELK Stack (Elastic, Logstash, Kibana)¶

Installation et Configuration:

# Installation ELK sur Ubuntu
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo "deb https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
sudo apt update

# Elasticsearch
sudo apt install elasticsearch
sudo systemctl enable elasticsearch
sudo systemctl start elasticsearch

# Kibana
sudo apt install kibana
sudo systemctl enable kibana
sudo systemctl start kibana

# Logstash
sudo apt install logstash

Logstash Configuration Example:

# /etc/logstash/conf.d/syslog.conf
input {
  syslog {
    port => 514
    type => "syslog"
  }
  beats {
    port => 5044
  }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGLINE}" }
    }
    date {
      match => [ "timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "syslog-%{+YYYY.MM.dd}"
  }
}

Beats pour collecte: - Filebeat: Logs de fichiers - Metricbeat: Métriques système - Packetbeat: Analyse réseau - Winlogbeat: Event logs Windows - Auditbeat: Audit framework

2.2.2 Wazuh¶

Wazuh - SIEM complet avec EDR

# Installation Wazuh Manager
curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh
sudo bash ./wazuh-install.sh -a

# Features principales
- Host-based IDS (HIDS)
- Log analysis
- File integrity monitoring
- Vulnerability detection
- Configuration assessment
- Incident response
- Regulatory compliance (PCI DSS, GDPR, etc.)

Wazuh Rules Example:

<!-- Custom rule pour détecter brute force SSH -->
<rule id="100001" level="10">
  <if_matched_sid>5551</if_matched_sid>
  <same_source_ip />
  <description>Multiple SSH authentication failures</description>
  <frequency>5</frequency>
  <timeframe>120</timeframe>
</rule>

2.2.3 Graylog¶

Installation Graylog:

# Graylog - Alternative ELK
sudo apt install graylog-server

# Configuration /etc/graylog/server/server.conf
password_secret = <généré>
root_password_sha2 = <hash SHA-256>
http_bind_address = 0.0.0.0:9000

2.2.4 Splunk (version gratuite 500MB/jour)¶

Splunk Free:

# Installation Splunk
wget -O splunk-9.x.tgz 'https://download.splunk.com/...'
tar xvzf splunk-9.x.tgz -C /opt
/opt/splunk/bin/splunk start --accept-license

SPL (Search Processing Language):

# Recherches Splunk essentielles
index=main sourcetype=linux_secure "Failed password"
| stats count by src_ip
| where count > 5

index=windows EventCode=4625
| timechart count by Account_Name

index=firewall action=blocked
| top 20 dest_port

2.3 Log Analysis¶

Types de Logs Essentiels¶

1. Logs Système: - /var/log/syslog (Linux) - /var/log/auth.log (authentification) - /var/log/secure (RHEL/CentOS) - Windows Event Logs (Security, System, Application)

2. Logs Réseau: - Firewall logs - Proxy logs (Squid, nginx) - DNS logs - VPN logs - IDS/IPS logs

3. Logs Applicatifs: - Web server logs (Apache, nginx) - Database logs (MySQL, PostgreSQL) - Email server logs - Application-specific logs

Outils d’Analyse de Logs¶

# grep avancé pour logs
grep -E "Failed|Error|Critical" /var/log/syslog
grep -C 5 "pattern" file.log                    # 5 lignes contexte

# awk pour parsing
awk '{print $1, $4, $5}' /var/log/apache2/access.log
awk -F: '/Failed password/ {print $11}' /var/log/auth.log | sort | uniq -c

# sed pour manipulation
sed -n '/ERROR/p' application.log

# Log analysis tools
- GoAccess             # Web log analyzer (temps réel)
- Logwatch             # Analyse automatique logs système
- OSSEC                # HIDS avec log analysis
- Lnav                 # Log navigator avec couleurs

Chainsaw - Forensic tool pour Windows Event Logs:

# https://github.com/WithSecureLabs/chainsaw
chainsaw hunt evtx_files/ -s sigma_rules/ --mapping mappings/sigma-event-logs.yml
chainsaw search evtx_files/ -e "4624" -t "Logon Type 3"

2.4 Network Security Monitoring (NSM)¶

Zeek (anciennement Bro)¶

Installation et Configuration:

# Installation Zeek
sudo apt install zeek

# Configuration /opt/zeek/etc/node.cfg
[zeek]
type=standalone
host=localhost
interface=eth0

# Démarrer Zeek
sudo zeekctl deploy
sudo zeekctl status

Zeek Scripts et Logs:

# Logs Zeek importants
/opt/zeek/logs/current/
├── conn.log          # Toutes les connexions
├── dns.log           # Requêtes DNS
├── http.log          # Traffic HTTP
├── ssl.log           # Connexions SSL/TLS
├── files.log         # Fichiers transférés
├── notice.log        # Alertes Zeek
└── weird.log         # Anomalies protocoles

# Analyse Zeek logs
zeek-cut id.orig_h id.resp_h id.resp_p < conn.log | sort | uniq -c
zeek-cut query answers < dns.log | grep -v "^-"

Custom Zeek Scripts:

# detect-beaconing.zeek
@load base/frameworks/notice

event connection_state_remove(c: connection) {
    if (c$duration > 3600 && c$orig_bytes > 1000000) {
        NOTICE([$note=Possible_C2_Beacon,
                $msg=fmt("Long duration connection detected"),
                $conn=c]);
    }
}

Suricata (IDS/IPS)¶

Installation:

sudo apt install suricata

# Configuration /etc/suricata/suricata.yaml
# Définir HOME_NET, EXTERNAL_NET
# Activer les règles

# Mise à jour des règles
sudo suricata-update
sudo suricata-update list-sources
sudo suricata-update enable-source et/open

# Démarrer Suricata
sudo systemctl start suricata

Règles Suricata Custom:

# /etc/suricata/rules/local.rules
alert http any any -> $HOME_NET any (msg:"Potential webshell access"; \
  flow:established,to_server; content:"POST"; http_method; \
  content:".php"; http_uri; content:"cmd="; http_client_body; \
  sid:1000001; rev:1;)

alert dns any any -> any any (msg:"DNS tunneling attempt"; \
  dns_query; content:"|00|"; depth:512; isdataat:100,relative; \
  sid:1000002; rev:1;)

Eve.json Output (logs JSON):

# Analyseur eve.json
jq '.alert | select(.signature_id == 2100498)' /var/log/suricata/eve.json
jq '.flow | select(.dest_port == 443)' /var/log/suricata/eve.json

Security Onion¶

Distribution complète NSM:

# Security Onion inclut:
- Suricata/Snort (IDS)
- Zeek (NSM)
- Wazuh (HIDS)
- Elasticsearch + Kibana
- Stenographer (PCAP complet)
- CyberChef (analyse données)
- NetworkMiner (forensic réseau)
- Playbook (case management)

# Installation
https://github.com/Security-Onion-Solutions/securityonion

2.5 Endpoint Detection and Response (EDR)¶

Concepts EDR¶

Surveillance des endpoints en temps réel
Détection comportementale
Threat hunting sur endpoints
Isolation et containment
Forensic collection
Automated response

EDR Open Source¶

Wazuh Agent¶

# Installation agent Linux
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -
echo "deb https://packages.wazuh.com/4.x/apt/ stable main" > /etc/apt/sources.list.d/wazuh.list
apt update && apt install wazuh-agent

# Configuration /var/ossec/etc/ossec.conf
<client>
  <server>
    <address>MANAGER_IP</address>
  </server>
</client>

# Windows agent
# Download MSI installer et configurer

Osquery¶

# Installation Osquery
export OSQUERY_KEY=1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys $OSQUERY_KEY
sudo add-apt-repository 'deb [arch=amd64] https://pkg.osquery.io/deb deb main'
sudo apt install osquery

# Requêtes Osquery pour sécurité
osqueryi

SELECT * FROM listening_ports WHERE port != 0;
SELECT * FROM processes WHERE name LIKE '%python%';
SELECT * FROM users WHERE username != '' AND directory LIKE '/home/%';
SELECT * FROM startup_items;
SELECT * FROM kernel_modules WHERE name LIKE '%rootkit%';

Osquery Packs:

{
  "queries": {
    "kernel_modules": {
      "query": "SELECT * FROM kernel_modules;",
      "interval": 3600,
      "description": "Monitor kernel modules"
    },
    "suspicious_processes": {
      "query": "SELECT * FROM processes WHERE name IN ('nc', 'ncat', 'netcat');",
      "interval": 60
    }
  }
}

Velociraptor¶

# EDR/DFIR tool moderne
# https://github.com/Velocidex/velociraptor

# Déploiement serveur
./velociraptor-v0.x-linux-amd64 --config server.config.yaml frontend -v

# Features:
- Live forensics
- Hunting queries (VQL)
- Artifact collection
- Timeline analysis
- Remote shell

VQL (Velociraptor Query Language):

-- Recherche fichiers suspects
SELECT * FROM glob(globs='C:\\Users\\**\\*.exe')
WHERE Mtime > timestamp(epoch=now() - 86400)

-- Processus avec connexions réseau
SELECT * FROM pslist()
WHERE Pid IN (SELECT Pid FROM netstat())

OSSEC¶

# OSSEC HIDS
wget -U "Mozilla" https://github.com/ossec/ossec-hids/archive/3.7.0.tar.gz
tar -zxvf 3.7.0.tar.gz
cd ossec-hids-3.7.0
sudo ./install.sh

# Capabilities:
- File integrity monitoring (FIM)
- Rootkit detection
- Active response
- Log analysis

2.6 Indicateurs de Compromission (IOCs)¶

Types d’IOCs¶

Hash de fichiers: MD5, SHA-1, SHA-256
Adresses IP: C2 servers, malicious IPs
Domaines: Malicious domains, DGA
URLs: Phishing, malware download
Email addresses: Phishing senders
Mutex names: Malware persistence
Registry keys: Malware artifacts
File paths: Dropper locations
Network signatures: Packet patterns

Formats IOCs¶

STIX/TAXII: Structured Threat Information
OpenIOC: Open format par Mandiant
YARA: Pattern matching
Sigma: Generic log signatures

Outils Gestion IOCs¶

# MISP - Malware Information Sharing Platform
# Installation via Docker
git clone https://github.com/MISP/misp-docker
cd misp-docker
docker-compose up -d

# Features MISP:
- Threat intel sharing
- IOC management
- Event correlation
- API integration
- Feed integration

YARA Rules:

rule Suspicious_PowerShell_Script
{
    meta:
        description = "Detects suspicious PowerShell"
        author = "SOC Team"
        date = "2024-01-01"

    strings:
        $s1 = "Invoke-Expression" nocase
        $s2 = "DownloadString" nocase
        $s3 = "WebClient" nocase
        $s4 = "-enc" nocase
        $s5 = "bypass" nocase

    condition:
        3 of ($s*)
}

# Utilisation YARA
yara rules.yar /path/to/scan
yara -r rules.yar /path/to/directory

# YARA sur processus (Linux)
yara rules.yar $(pidof suspicious_process)

Sigma Rules:

title: Suspicious PowerShell Execution
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects suspicious PowerShell with encoded commands
logsource:
    product: windows
    service: powershell
detection:
    selection:
        EventID: 4104
        ScriptBlockText|contains:
            - '-enc'
            - '-encodedcommand'
            - 'FromBase64String'
    condition: selection
falsepositives:
    - Legitimate admin scripts
level: high

Conversion Sigma vers SIEM:

# Sigmac - Converter
pip install sigmatools

# Convertir vers différents SIEM
sigmac -t elastalert rule.yml
sigmac -t splunk rule.yml
sigmac -t qradar rule.yml
sigmac -t arcsight rule.yml

2.7 Threat Hunting¶

Méthodologie Threat Hunting¶

Hypothesis-Driven Hunting: 1. Créer une hypothèse basée sur threat intel 2. Collecter les données pertinentes 3. Analyser et corréler 4. Documenter les findings 5. Créer des détections automatisées

IOC-Driven Hunting: - Recherche proactive d’IOCs connus - Scan de l’environnement - Validation et investigation

Techniques de Hunting:

# 1. Recherche de processus suspects
# Linux
ps aux | grep -E '(nc|ncat|/dev/tcp|base64)'
lsof -i -P -n | grep LISTEN

# Windows PowerShell
Get-Process | Where-Object {$_.ProcessName -match "powershell|cmd"}
Get-NetTCPConnection | Where-Object {$_.State -eq "Established"}

# 2. Analyse persistance
# Linux
cat /etc/crontab
ls -la /etc/cron.*
systemctl list-units --type=service --state=running

# Windows
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Get-ScheduledTask | Where-Object {$_.State -eq "Ready"}
Get-WmiObject Win32_StartupCommand

# 3. Connexions réseau suspectes
netstat -antp | grep ESTABLISHED
ss -tnp | grep -v "127.0.0.1"
lsof -i -n -P | grep -E "ESTABLISHED|LISTEN"

# 4. Analyse fichiers récents
find / -type f -mtime -1 -ls 2>/dev/null
find /tmp -type f -executable
Get-ChildItem -Recurse | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-1)}

Hunting Frameworks¶

TaHiTI (Targeted Hunting integrating Threat Intelligence): 1. Direction (hypothèse) 2. Collection (données) 3. Processing (analyse) 4. Analysis (findings) 5. Dissemination (reporting)

PEAK Framework: - Prepare - Execute - Act - Knowledge sharing

Outils de Threat Hunting¶

# Bloodhound - Active Directory analysis
sudo apt install bloodhound neo4j

# SharpHound collector (Windows)
.\SharpHound.exe -c All

# DeepBlueCLI - PowerShell threat hunting
git clone https://github.com/sans-blue-team/DeepBlueCLI.git
.\DeepBlue.ps1 .\evtx\security.evtx

# Hayabusa - Windows event log analysis
hayabusa-2.x-win-x64.exe csv-timeline -d C:\Windows\System32\winevt\Logs

# Zircolite - Sigma sur EVTX
python3 zircolite.py --evtx Security.evtx --ruleset rules/ --outfile results.json

3. Blue Team¶

3.1 Defensive Security Operations¶

Missions Blue Team¶

Hardening des systèmes
Configuration sécurisée
Patch management
Vulnerability management
Security awareness training
Simulation d’attaques (Purple Team)
Amélioration continue de la posture

3.2 Hardening et Configuration¶

Linux Hardening¶

# 1. Mise à jour système
sudo apt update && sudo apt upgrade -y
sudo apt autoremove

# 2. Configuration SSH sécurisée
# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Port 2222  # Changer port par défaut
AllowUsers username
MaxAuthTries 3

# 3. Firewall (UFW)
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp
sudo ufw enable

# 4. Fail2ban (brute force protection)
sudo apt install fail2ban
sudo systemctl enable fail2ban

# /etc/fail2ban/jail.local
[sshd]
enabled = true
port = 2222
maxretry = 3
bantime = 3600

# 5. Audit et logging
sudo apt install auditd
sudo systemctl enable auditd

# 6. File integrity monitoring
sudo apt install aide
sudo aideinit
sudo aide --check

# 7. Désactiver services inutiles
sudo systemctl list-unit-files --state=enabled
sudo systemctl disable <service>

# 8. Kernel hardening (sysctl)
# /etc/sysctl.conf
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.log_martians = 1
kernel.dmesg_restrict = 1

CIS Benchmarks Implementation:

# CIS-CAT scanner
# https://www.cisecurity.org/cybersecurity-tools/cis-cat-pro

# Lynis - Security auditing tool
sudo apt install lynis
sudo lynis audit system

# OpenSCAP
sudo apt install libopenscap8
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds.xml

Windows Hardening¶

PowerShell Hardening Script:

# 1. Activer Windows Defender
Set-MpPreference -DisableRealtimeMonitoring $false

# 2. Enable Firewall
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

# 3. Disable SMBv1
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

# 4. Enable LSASS protection
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
  -Name "RunAsPPL" -Value 1 -PropertyType DWORD -Force

# 5. PowerShell logging
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
  -Name "EnableScriptBlockLogging" -Value 1 -PropertyType DWORD

# 6. AppLocker configuration
# Utiliser GPO pour définir les règles

# 7. Disable LLMNR
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" `
  -Name "EnableMulticast" -Value 0 -PropertyType DWORD

# 8. Audit policy
auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
auditpol /set /category:"Account Logon" /success:enable /failure:enable

GPO Hardening: - Password policies (complexité, longueur, expiration) - Account lockout policies - User rights assignment - Security options - Advanced Audit Policy - Windows Firewall with Advanced Security - AppLocker / Software Restriction Policies

3.3 Vulnerability Management¶

Processus VM¶

Asset Discovery - Inventaire
Vulnerability Scanning - Scan régulier
Prioritization - CVSS, exploitability
Remediation - Patching, mitigation
Verification - Rescan
Reporting - Métriques, KPIs

Scanners de Vulnérabilités Open Source¶

OpenVAS (Greenbone)¶

# Installation OpenVAS
sudo apt install openvas
sudo gvm-setup
sudo gvm-start

# Accès web: https://localhost:9392
# Scanner complet avec base NVT (50k+ tests)

Nessus Essentials (gratuit, 16 IPs)¶

# Download depuis Tenable
# Installation
sudo dpkg -i Nessus-x.x.x-debian10_amd64.deb
sudo systemctl start nessusd

# Accès: https://localhost:8834

Nuclei¶

# Modern vulnerability scanner
go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest

# Templates communautaires
nuclei -u https://example.com -t exposures/ -t cves/

# Scan réseau
nuclei -l targets.txt -t technologies/ -o results.txt

Trivy (containers & dependencies)¶

# Scan images Docker
trivy image nginx:latest
trivy image --severity HIGH,CRITICAL myapp:1.0

# Scan filesystem
trivy fs /path/to/project

# Scan dépendances
trivy repo https://github.com/user/repo

Gestion de Patches¶

# Linux - Unattended upgrades
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# Ansible playbook pour patch management
---
- name: Update all systems
  hosts: all
  tasks:
    - name: Update apt cache
      apt:
        update_cache: yes
      when: ansible_os_family == "Debian"

    - name: Upgrade all packages
      apt:
        upgrade: dist
      when: ansible_os_family == "Debian"

# Windows - WSUS / SCCM
# Ou PowerShell module PSWindowsUpdate
Install-Module PSWindowsUpdate
Get-WindowsUpdate
Install-WindowsUpdate -AcceptAll -AutoReboot

3.4 Email Security¶

Concepts Email Security¶

SPF (Sender Policy Framework)
DKIM (DomainKeys Identified Mail)
DMARC (Domain-based Message Authentication)
MTA-STS (Mail Transfer Agent Strict Transport Security)
Phishing detection
Malware analysis
Sandbox analysis

Outils Analyse Email¶

# Email header analysis
# https://mxtoolbox.com/EmailHeaders.aspx

# PhishTool - Email analysis
# https://www.phishtool.com/

# emlAnalyzer
pip3 install eml-analyzer
emlAnalyzer -i suspicious.eml --header --html -u

# VirusTotal API
curl --request POST \
  --url https://www.virustotal.com/vtapi/v2/file/scan \
  --form apikey=YOUR_API_KEY \
  --form file=@suspicious.eml

SpamAssassin:

sudo apt install spamassassin
spamassassin -t < email.eml

Rspamd:

# Modern spam filtering
sudo apt install rspamd
rspamc < message.eml

3.5 Web Application Security¶

Concepts Web Security¶

OWASP Top 10
XSS (Cross-Site Scripting)
SQL Injection
CSRF (Cross-Site Request Forgery)
IDOR (Insecure Direct Object Reference)
Security misconfiguration
Broken authentication
Sensitive data exposure

Web Application Firewall (WAF)¶

ModSecurity:

# Installation avec Apache
sudo apt install libapache2-mod-security2

# OWASP Core Rule Set
git clone https://github.com/coreruleset/coreruleset.git /etc/modsecurity/crs
cp /etc/modsecurity/crs/crs-setup.conf.example /etc/modsecurity/crs/crs-setup.conf

# Configuration Apache
<IfModule security2_module>
    SecRuleEngine On
    Include /etc/modsecurity/crs/crs-setup.conf
    Include /etc/modsecurity/crs/rules/*.conf
</IfModule>

Nginx + ModSecurity:

# Compilation Nginx avec ModSecurity
git clone --depth 1 https://github.com/SpiderLabs/ModSecurity
git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx

# Configuration nginx
load_module modules/ngx_http_modsecurity_module.so;

http {
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsec/main.conf;
}

Outils Test Sécurité Web¶

# OWASP ZAP
sudo apt install zaproxy
zaproxy

# Nikto web scanner
nikto -h https://example.com

# WPScan (WordPress)
wpscan --url https://example.com --enumerate u,p

# Gobuster (directory bruteforce)
gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt

# SQLMap
sqlmap -u "http://example.com/page?id=1" --batch

4. Incident Response¶

4.1 Incident Response Process¶

Phases IR (NIST)¶

Preparation - IR plan documenté - Équipe formée - Outils prêts - Contact lists - Playbooks définis
Detection & Analysis - Alertes SIEM - Reporting utilisateurs - Analyse initiale - Triage et prioritization - Scope determination
Containment - Short-term containment (isoler) - Long-term containment (patch temporaire) - System backup
Eradication - Supprimer malware - Fermer vulnérabilités - Hardening
Recovery - Restauration services - Monitoring accru - Validation
Post-Incident / Lessons Learned - Rapport final - Timeline complète - Améliorations processus - Mise à jour playbooks

4.2 IR Playbooks¶

Playbook: Ransomware¶

## PLAYBOOK: Ransomware Response

### Phase 1: Detection (0-15 min)
- [ ] Alert confirmée: fichiers chiffrés détectés
- [ ] Identifier patient zero
- [ ] Noter l'heure de détection
- [ ] Activer l'équipe IR

### Phase 2: Containment (15-60 min)
- [ ] Isoler machine(s) infectée(s) du réseau
      - Désactiver WiFi/Ethernet
      - Pas d'extinction (RAM forensics)
- [ ] Bloquer C2 IPs au firewall
- [ ] Désactiver comptes compromis
- [ ] Snapshot/backup machines avant actions
- [ ] Isoler segments réseau si spread lateral

### Phase 3: Analysis (parallel)
- [ ] Identifier variante ransomware
- [ ] Rechercher IOCs (hashes, IPs, domains)
- [ ] Vérifier backups intégrité
- [ ] Timeline reconstruction
- [ ] Identifier vecteur d'infection (phishing, RDP, vuln)

### Phase 4: Eradication
- [ ] Supprimer malware de tous systèmes
- [ ] Patcher vulnérabilités exploitées
- [ ] Reset credentials compromis
- [ ] Vérifier persistance supprimée

### Phase 5: Recovery
- [ ] Restaurer depuis backups propres
- [ ] Vérifier intégrité fichiers restaurés
- [ ] Réactiver services graduellement
- [ ] Monitoring accru 72h

### Phase 6: Post-Incident
- [ ] Rapport complet incident
- [ ] Lessons learned meeting
- [ ] Améliorer détections
- [ ] Formation utilisateurs
- [ ] Mise à jour playbook

### Contacts
- IR Lead: [nom] [tel]
- CISO: [nom] [tel]
- Legal: [nom] [tel]
- PR/Comms: [nom] [tel]
- Vendor support: [contacts]

### Outils nécessaires
- Network isolation capability
- Forensic workstation
- Backup verification tools
- Malware analysis sandbox
- ID Ransomware (https://id-ransomware.malwarehunterteam.com/)

Playbook: Phishing¶

## PLAYBOOK: Phishing Response

### Triage (0-15 min)
- [ ] Email reporté par utilisateur
- [ ] Vérifier headers (SPF, DKIM, DMARC)
- [ ] Analyser liens/attachments (sandboxing)
- [ ] Déterminer criticité

### Si confirmé malveillant:
- [ ] Quarantaine tous emails similaires (règle Exchange/Gmail)
- [ ] Identifier tous destinataires
- [ ] Vérifier qui a cliqué/téléchargé
- [ ] Block sender domain/IP

### Containment utilisateurs compromis:
- [ ] Reset credentials
- [ ] Scan endpoint (EDR)
- [ ] Vérifier activité suspecte compte
- [ ] MFA enforcement

### Analysis:
- [ ] Extraire IOCs
- [ ] Soumettre à threat intel platforms
- [ ] Documenter campagne

### Prevention:
- [ ] Update email filters
- [ ] Security awareness reminder
- [ ] Améliorer détections

4.3 Outils Incident Response¶

IR Distributions¶

# SIFT Workstation (SANS)
# https://github.com/teamdfir/sift
wget https://github.com/teamdfir/sift-cli/releases/download/v1.x/sift-cli-linux
chmod +x sift-cli-linux
sudo ./sift-cli-linux install

# CAINE (Computer Aided INvestigative Environment)
# Live distro forensics
# https://www.caine-live.net/

# DEFT Linux
# Digital Evidence & Forensics Toolkit

Memory Analysis¶

Volatility 3:

# Installation
pip3 install volatility3

# Acquisition mémoire Linux
sudo apt install lime-forensics-dkms
sudo insmod /path/to/lime.ko "path=/tmp/memdump.lime format=lime"

# Acquisition mémoire Windows
# Utiliser: DumpIt, FTK Imager, WinPmem

# Analysis avec Volatility
vol3 -f memory.dump windows.info
vol3 -f memory.dump windows.pslist
vol3 -f memory.dump windows.psscan
vol3 -f memory.dump windows.netscan
vol3 -f memory.dump windows.cmdline
vol3 -f memory.dump windows.malfind         # Recherche code injecté
vol3 -f memory.dump windows.dlllist
vol3 -f memory.dump windows.handles
vol3 -f memory.dump windows.filescan
vol3 -f memory.dump windows.registry.hivelist

# Linux memory analysis
vol3 -f linux.mem linux.pslist
vol3 -f linux.mem linux.bash

Rekall:

# Alternative à Volatility
pip install rekall

rekall -f memory.dump pslist
rekall -f memory.dump netstat

Disk Forensics¶

The Sleuth Kit + Autopsy:

# Installation
sudo apt install sleuthkit autopsy

# Utilisation TSK (ligne de commande)
mmls disk.img                    # Partition layout
fsstat -o 2048 disk.img          # Filesystem info
fls -o 2048 disk.img             # Liste fichiers
icat -o 2048 disk.img 15 > file  # Extraire fichier par inode
fiwalk -f disk.img               # Walk filesystem

# Autopsy GUI
autopsy

# Création image disque
sudo dd if=/dev/sda of=disk.img bs=4M status=progress
# Ou avec dc3dd pour hashing
sudo dc3dd if=/dev/sda of=disk.img hash=md5 hash=sha256 log=acquisition.log

FTK Imager (Windows): - Acquisition disque/mémoire - Montage images forensics - Extraction fichiers

Timeline Analysis¶

# Plaso (log2timeline)
sudo apt install plaso-tools

# Créer timeline
log2timeline.py timeline.plaso disk.img

# Filtrer et exporter
psort.py -o l2tcsv timeline.plaso "date > '2024-01-01 00:00:00'" -w filtered.csv

# Analyser avec timesketch
# https://github.com/google/timesketch

MFT Analysis (Windows):

# Analyser Master File Table
# Utiliser: MFTECmd, analyzeMFT

MFTECmd.exe -f "C:\$MFT" --csv output --csvf mft.csv

Network Forensics¶

# NetworkMiner
# GUI pour analyse PCAP
# https://www.netresec.com/?page=NetworkMiner

# Wireshark analysis
wireshark capture.pcap

# Filtres Wireshark utiles pour IR
http.request.method == "POST"
dns.qry.name contains "malicious"
tcp.flags.syn==1 and tcp.flags.ack==0    # SYN scan
!(arp or icmp or dns or stp)             # Filtrer bruit

# Zeek pour analyse PCAP post-incident
zeek -r capture.pcap

Malware Analysis¶

Sandbox Analysis:

# Cuckoo Sandbox
# https://cuckoosandbox.org/
git clone https://github.com/cuckoosandbox/cuckoo
cd cuckoo
python3 stuff/monitor.py

# ANY.RUN (online sandbox)
# https://any.run/

# Joe Sandbox (online)
# https://www.joesandbox.com/

Static Analysis:

# Strings
strings malware.exe | less
strings -el malware.exe    # Unicode strings

# File type
file malware.exe
xxd malware.exe | head     # Hex dump

# PE analysis
sudo apt install pev
readpe malware.exe
pescan malware.exe
pestr malware.exe

# objdump disassembly
objdump -d malware.exe

# radare2
r2 malware.exe
aaa    # Analyze all
pdf    # Print disassembly function

YARA scanning:

yara -r malware_rules/ /path/to/scan

Artifact Collection¶

KAPE (Kroll Artifact Parser and Extractor):

# Windows artifact collection
kape.exe --tsource C: --tdest D:\Collection --target KapeTriage

# Collecte:
- Event logs
- Registry hives
- Browser history
- Prefetch
- $MFT
- USN Journal
- Etc.

UAC (Unix Artifact Collector):

# Collection artifacts Unix/Linux
./uac -p full /path/to/output

Velociraptor Offline Collector:

# Création collector
velociraptor config generate > server.config.yaml
velociraptor --config server.config.yaml gui

# Build collector
# Déployer sur endpoints et collecter

4.4 Live Response¶

Linux Live Response¶

#!/bin/bash
# IR Collection Script Linux

OUTPUT_DIR="/tmp/ir_collection_$(date +%Y%m%d_%H%M%S)"
mkdir -p $OUTPUT_DIR

# System info
uname -a > $OUTPUT_DIR/uname.txt
hostname > $OUTPUT_DIR/hostname.txt
uptime > $OUTPUT_DIR/uptime.txt
date > $OUTPUT_DIR/date.txt

# Users
who -a > $OUTPUT_DIR/users_logged.txt
last -f /var/log/wtmp > $OUTPUT_DIR/last_logins.txt
cat /etc/passwd > $OUTPUT_DIR/passwd.txt
cat /etc/shadow > $OUTPUT_DIR/shadow.txt  # Si root

# Network
netstat -antp > $OUTPUT_DIR/netstat.txt
ss -antp > $OUTPUT_DIR/ss.txt
arp -a > $OUTPUT_DIR/arp.txt
ip addr show > $OUTPUT_DIR/ip_addr.txt
ip route show > $OUTPUT_DIR/ip_route.txt
iptables -L -n -v > $OUTPUT_DIR/iptables.txt

# Processes
ps auxwww > $OUTPUT_DIR/ps.txt
pstree -p > $OUTPUT_DIR/pstree.txt
top -b -n 1 > $OUTPUT_DIR/top.txt
lsof > $OUTPUT_DIR/lsof.txt

# Files
find / -type f -mtime -1 2>/dev/null > $OUTPUT_DIR/files_modified_24h.txt
find / -type f -name "*.sh" -o -name "*.py" -perm /u+x 2>/dev/null > $OUTPUT_DIR/scripts_executable.txt

# Persistence
cat /etc/crontab > $OUTPUT_DIR/crontab.txt
crontab -l > $OUTPUT_DIR/crontab_user.txt 2>/dev/null
ls -la /etc/cron.* > $OUTPUT_DIR/cron_dirs.txt
systemctl list-units --type=service > $OUTPUT_DIR/systemd_services.txt

# Logs
cp -r /var/log $OUTPUT_DIR/logs/

# Hash collection
tar czf $OUTPUT_DIR.tar.gz $OUTPUT_DIR
sha256sum $OUTPUT_DIR.tar.gz > $OUTPUT_DIR.tar.gz.sha256

echo "Collection terminée: $OUTPUT_DIR.tar.gz"

Windows Live Response¶

# IR_Collection.ps1
$OutputDir = "C:\IR_Collection_$(Get-Date -Format 'yyyyMMdd_HHmmss')"
New-Item -ItemType Directory -Path $OutputDir -Force

# System info
Get-ComputerInfo | Out-File "$OutputDir\system_info.txt"
systeminfo | Out-File "$OutputDir\systeminfo.txt"
Get-HotFix | Out-File "$OutputDir\hotfixes.txt"

# Users
Get-LocalUser | Out-File "$OutputDir\local_users.txt"
Get-LocalGroupMember -Group "Administrators" | Out-File "$OutputDir\admins.txt"
quser | Out-File "$OutputDir\logged_users.txt"
Get-EventLog -LogName Security -InstanceId 4624 -Newest 100 | Out-File "$OutputDir\recent_logons.txt"

# Network
Get-NetTCPConnection | Out-File "$OutputDir\tcp_connections.txt"
Get-NetUDPEndpoint | Out-File "$OutputDir\udp_endpoints.txt"
Get-DnsClientCache | Out-File "$OutputDir\dns_cache.txt"
arp -a | Out-File "$OutputDir\arp.txt"
ipconfig /all | Out-File "$OutputDir\ipconfig.txt"
netstat -anob | Out-File "$OutputDir\netstat.txt"

# Processes
Get-Process | Select-Object Name, Id, Path, Company | Out-File "$OutputDir\processes.txt"
Get-WmiObject Win32_Process | Select-Object ProcessId,Name,CommandLine | Out-File "$OutputDir\process_cmdline.txt"

# Services
Get-Service | Out-File "$OutputDir\services.txt"
Get-WmiObject Win32_Service | Select-Object Name,PathName,State,StartMode | Out-File "$OutputDir\services_detailed.txt"

# Scheduled tasks
Get-ScheduledTask | Out-File "$OutputDir\scheduled_tasks.txt"

# Autorun
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Run | Out-File "$OutputDir\autorun_hklm.txt"
Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Run | Out-File "$OutputDir\autorun_hkcu.txt"

# Files modified recently
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-1)} | Out-File "$OutputDir\files_modified_24h.txt"

# Event logs
wevtutil epl Security "$OutputDir\Security.evtx"
wevtutil epl System "$OutputDir\System.evtx"
wevtutil epl Application "$OutputDir\Application.evtx"
wevtutil epl "Microsoft-Windows-PowerShell/Operational" "$OutputDir\PowerShell.evtx"

# PowerShell history
Copy-Item "$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" "$OutputDir\"

# Compress
Compress-Archive -Path $OutputDir -DestinationPath "$OutputDir.zip"
Get-FileHash "$OutputDir.zip" -Algorithm SHA256 | Out-File "$OutputDir.zip.sha256"

Write-Host "Collection complete: $OutputDir.zip"

5. Digital Forensics¶

5.1 Fondamentaux Forensics¶

Principes DFIR¶

Chain of Custody: Traçabilité des preuves
Non-altération: Travailler sur copies
Documentation: Tout noter
Repeatability: Reproductible
Legal admissibility: Recevabilité juridique

Order of Volatility¶

Registers, cache
RAM
Network connections
Running processes
Disk
Logs
Archived data
Backups

5.2 Acquisition Forensique¶

Disk Imaging¶

# dd - Basic imaging
sudo dd if=/dev/sda of=/mnt/evidence/disk.img bs=4M status=progress conv=noerror,sync

# dc3dd - Enhanced dd avec hashing
sudo dc3dd if=/dev/sda of=disk.img hash=md5 hash=sha256 log=acquisition.log

# ddrescue - Pour disques endommagés
sudo ddrescue /dev/sda disk.img rescue.log

# FTK Imager (Windows GUI)
# - E01 format (Expert Witness)
# - Compression
# - Hashing intégré

# ewfacquire (EnCase format)
sudo apt install ewf-tools
ewfacquire /dev/sda

Vérification intégrité:

# Hash original
md5sum /dev/sda > original.md5
sha256sum /dev/sda > original.sha256

# Hash image
md5sum disk.img > image.md5
sha256sum disk.img > image.sha256

# Compare
diff original.md5 image.md5

Memory Acquisition¶

# Linux - LiME
git clone https://github.com/504ensicsLabs/LiME
cd LiME/src
make
sudo insmod lime-*.ko "path=/tmp/mem.lime format=lime"

# Linux - AVML (Azure)
sudo ./avml memory.lime

# Windows - DumpIt
DumpIt.exe /O C:\Forensics\

# Windows - Magnet RAM Capture
# GUI tool gratuit

# Windows - WinPmem
winpmem_mini_x64.exe memory.raw

5.3 Analyse Forensique Windows¶

Registry Analysis¶

# Registry Explorer (Eric Zimmerman)
# https://ericzimmerman.github.io/

# Registry hives locations
C:\Windows\System32\config\SAM
C:\Windows\System32\config\SECURITY
C:\Windows\System32\config\SOFTWARE
C:\Windows\System32\config\SYSTEM
%UserProfile%\NTUSER.DAT
%UserProfile%\AppData\Local\Microsoft\Windows\UsrClass.dat

# RegRipper
rip.exe -r NTUSER.DAT -p userassist
rip.exe -r SOFTWARE -p recentdocs

# Important Registry keys
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run       # Autorun
HKLM\SYSTEM\CurrentControlSet\Services                   # Services
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs  # Recent files
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist  # Program execution

Prefetch Analysis¶

# Prefetch files: C:\Windows\Prefetch\*.pf
# Show program execution

# PECmd (Eric Zimmerman)
PECmd.exe -f "C:\Windows\Prefetch\CHROME.EXE-12345.pf"
PECmd.exe -d "C:\Windows\Prefetch" --csv output --csvf prefetch.csv

# Info: Nombre exécutions, dernière exécution, fichiers chargés

Event Log Analysis¶

# EVTX Explorer
EvtxECmd.exe -f Security.evtx --csv output --csvf security.csv

# Chainsaw - Sigma rules sur EVTX
chainsaw hunt evtx/ -s sigma/ --mapping mappings/sigma-event-logs.yml

# Hayabusa - Timeline EVTX
hayabusa-2.x-win-x64.exe csv-timeline -d evtx_folder/ -o timeline.csv

# Event IDs importants (voir section SOC)

USN Journal¶

# Change journal NTFS
# MFTECmd peut parser USN Journal
MFTECmd.exe -f "C:\$Extend\$UsnJrnl:$J" --csv output --csvf usnjrnl.csv

# Info: Toutes modifications fichiers (create, delete, rename, etc.)

Browser Artifacts¶

# Hindsight - Chrome/Chromium analysis
hindsight.py -i "C:\Users\User\AppData\Local\Google\Chrome\User Data" -o output/

# Firefox
# Places: %AppData%\Mozilla\Firefox\Profiles\xxx\places.sqlite

# SQLite analysis
sqlite3 places.sqlite "SELECT url, title, visit_count FROM moz_places ORDER BY last_visit_date DESC LIMIT 100;"

# Browser History Viewer
# https://www.nirsoft.net/utils/browsing_history_view.html

$MFT Analysis¶

# Master File Table - Référence tous fichiers NTFS
# MFTECmd
MFTECmd.exe -f "C:\$MFT" --csv output --csvf mft.csv

# analyzeMFT (Linux)
pip install analyzeMFT
analyzeMFT.py -f MFT -o mft.csv

# Info: Timestamps (MACB), file attributes, resident data

Timeline Creation¶

# Plaso (log2timeline)
log2timeline.py --storage-file timeline.plaso image.dd

# Filter and export
psort.py -o l2tcsv -w timeline.csv timeline.plaso "date > '2024-01-01'"

# Timesketch visualization
# Docker deployment pour UI

5.4 Analyse Forensique Linux¶

File System Analysis¶

# ext4 forensics
debugfs /dev/sda1
# Commandes: ls, stat, logdump, etc.

# Sleuth Kit
fls -r -o 2048 linux.img
ils -e linux.img
icat linux.img 12345 > recovered_file

# Autopsy pour UI

Log Analysis¶

# Principaux logs
/var/log/syslog
/var/log/auth.log
/var/log/secure
/var/log/messages
/var/log/apache2/access.log
/var/log/apache2/error.log
/var/log/mysql/mysql.log
~/.bash_history

# Parsing avec awk/grep
grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr

# aureport (auditd)
aureport --summary
aureport --login
aureport --executable

Bash History¶

# ~/.bash_history par user
# /root/.bash_history

# Timestamps bash history
export HISTTIMEFORMAT="%F %T "
history

# Analyser toutes bash_history
find /home -name ".bash_history" -exec cat {} \; > all_bash_history.txt

Memory Forensics Linux¶

# Volatility 3 Linux
vol3 -f linux.mem linux.pslist
vol3 -f linux.mem linux.pstree
vol3 -f linux.mem linux.bash
vol3 -f linux.mem linux.lsmod
vol3 -f linux.mem linux.lsof
vol3 -f linux.mem linux.malfind

5.5 Mobile Forensics¶

Android Forensics¶

# ADB (Android Debug Bridge)
adb devices
adb shell
adb pull /data/data/com.android.providers.contacts/databases/contacts.db

# Autopsy avec Android module
# ALEAPP (Android Logs Events And Protobuf Parser)
python aleapp.py -t fs -i /path/to/android/dump -o output/

# Andriller
# https://github.com/den4uk/andriller

iOS Forensics¶

# libimobiledevice
ideviceinfo
idevicebackup2 backup --full /backup/location/

# iLEAPP (iOS Logs, Events, And Plists Parser)
python ileapp.py -t fs -i /path/to/ios/dump -o output/

# iTunes backups location:
# macOS: ~/Library/Application Support/MobileSync/Backup/
# Windows: %APPDATA%\Apple Computer\MobileSync\Backup\

5.6 Network Forensics¶

PCAP Analysis¶

# Wireshark
wireshark capture.pcap

# tshark (CLI)
tshark -r capture.pcap -Y "http.request.method == POST"
tshark -r capture.pcap -Y "dns" -T fields -e dns.qry.name
tshark -r capture.pcap -q -z http,tree

# NetworkMiner
# GUI Windows/Linux pour carving PCAP

# tcpflow - Reconstruct TCP sessions
tcpflow -r capture.pcap

# Zeek analysis (voir section SOC)
zeek -r capture.pcap
cat conn.log http.log dns.log

Carving Artifacts from PCAP¶

# Foremost - File carving
foremost -i capture.pcap -o carved/

# Scalpel - Advanced carving
scalpel capture.pcap -o output/

# binwalk
binwalk -e capture.pcap

6. Threat Intelligence¶

6.1 Concepts Threat Intel¶

Types de TI¶

Strategic: High-level, décisions business
Tactical: TTPs, adversaire behavior
Operational: Campagnes, actors
Technical: IOCs, signatures

Threat Intel Lifecycle¶

Planning & Direction
Collection
Processing
Analysis
Dissemination
Feedback

6.2 OSINT (Open Source Intelligence)¶

Outils OSINT¶

# theHarvester - Email, subdomains, IPs
theHarvester -d example.com -b all

# Amass - Subdomain enumeration
amass enum -d example.com
amass intel -whois -d example.com

# Shodan CLI
shodan search "port:22 country:US"
shodan host 8.8.8.8

# Censys
# https://search.censys.io/

# Maltego - Graphical OSINT
# Community edition gratuite

# SpiderFoot
spiderfoot -s example.com -o output

# OSINT Framework
# https://osintframework.com/

Passive DNS¶

# SecurityTrails
# https://securitytrails.com/

# VirusTotal passive DNS
# Integrate via API

# PassiveTotal (RiskIQ)
# https://community.riskiq.com/

6.3 Threat Intelligence Platforms¶

# MISP Docker
git clone https://github.com/MISP/misp-docker
cd misp-docker
docker-compose up -d

# Accès: https://localhost
# Default: admin@admin.test / admin

# Features:
- Event management
- IOC database
- Correlation engine
- Threat sharing
- Feed integration
- API integration

MISP Feeds: - CIRCL feeds - Botvrij.eu - Abuse.ch (URLhaus, MalwareBazaar) - AlienVault OTX

OpenCTI¶

# OpenCTI - Cyber Threat Intelligence platform
git clone https://github.com/OpenCTI-Platform/docker
cd docker
docker-compose up -d

# Features:
- Knowledge graph
- STIX 2.1 compliant
- Connectors (MITRE, CVE, etc.)
- Threat dashboards

YETI (Your Everyday Threat Intelligence)¶

# YETI install
git clone https://github.com/yeti-platform/yeti
cd yeti
docker-compose up -d

# Threat intel repository

6.4 Threat Feeds¶

Free Threat Feeds¶

# Abuse.ch
- URLhaus: https://urlhaus.abuse.ch/
- MalwareBazaar: https://bazaar.abuse.ch/
- ThreatFox: https://threatfox.abuse.ch/
- Feodo Tracker: https://feodotracker.abuse.ch/

# AlienVault OTX
https://otx.alienvault.com/

# Emerging Threats
https://rules.emergingthreats.net/

# Talos Intelligence
https://talosintelligence.com/

# CIRCL feeds
https://www.circl.lu/services/misp-malware-information-sharing-platform/

# Blocklist.de
https://www.blocklist.de/en/export.html

Integration Feeds dans SIEM¶

# Script Python pour pull feeds et ingest vers SIEM
import requests
import json

# Exemple AlienVault OTX
OTX_API_KEY = "your_key"
url = "https://otx.alienvault.com/api/v1/pulses/subscribed"
headers = {"X-OTX-API-KEY": OTX_API_KEY}

response = requests.get(url, headers=headers)
pulses = response.json()

for pulse in pulses['results']:
    for indicator in pulse['indicators']:
        # Ingest to SIEM
        # Send to Elasticsearch, Splunk, etc.
        print(f"{indicator['type']}: {indicator['indicator']}")

6.5 MITRE ATT&CK Framework¶

Utilisation ATT&CK¶

Matrices: - Enterprise (Windows, Linux, macOS, Cloud) - Mobile (Android, iOS) - ICS (Industrial Control Systems)

Structure: - Tactics: Why (Objectives) - 14 tactics - Techniques: How (Methods) - 200+ techniques - Sub-techniques: Variants - Procedures: Specific implementations

Tactics Enterprise: 1. Reconnaissance 2. Resource Development 3. Initial Access 4. Execution 5. Persistence 6. Privilege Escalation 7. Defense Evasion 8. Credential Access 9. Discovery 10. Lateral Movement 11. Collection 12. Command and Control 13. Exfiltration 14. Impact

Outils ATT&CK¶

# ATT&CK Navigator
# https://mitre-attack.github.io/attack-navigator/
# Visualisation et mapping

# Atomic Red Team
# Tests d'attaque ATT&CK
git clone https://github.com/redcanaryco/atomic-red-team
cd atomic-red-team
powershell
Import-Module .\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1
Invoke-AtomicTest T1003.001  # Dump LSASS

# CALDERA
# Automated adversary emulation
git clone https://github.com/mitre/caldera.git --recursive
cd caldera
pip3 install -r requirements.txt
python3 server.py --insecure

# Sigma rules mapping vers ATT&CK
# Chaque rule contient tags ATT&CK

7. Outils Open Source Essentiels - Récapitulatif¶

7.1 SIEM & Log Management¶

ELK Stack - Elasticsearch, Logstash, Kibana
Graylog - Log management
Wazuh - SIEM + HIDS + EDR
Splunk Free - 500MB/jour

7.2 Network Security¶

Zeek - Network security monitoring
Suricata - IDS/IPS
Security Onion - NSM distribution complète
Wireshark - Packet analysis
tcpdump - Packet capture

7.3 Endpoint Security¶

Wazuh Agent - HIDS
OSSEC - HIDS
Osquery - Endpoint visibility
Velociraptor - EDR/DFIR

7.4 Vulnerability Management¶

OpenVAS - Vulnerability scanner
Nessus Essentials - 16 IPs gratuit
Nuclei - Modern scanner
Trivy - Container scanning

7.5 Incident Response¶

SIFT Workstation - DFIR distro
Volatility - Memory forensics
Autopsy - Disk forensics
The Sleuth Kit - Filesystem analysis
KAPE - Artifact collection (Windows)

7.6 Malware Analysis¶

Cuckoo Sandbox - Automated malware analysis
YARA - Pattern matching
radare2 - Reverse engineering
Ghidra - NSA reverse engineering tool

7.7 Threat Intelligence¶

MISP - Threat intel platform
OpenCTI - TI platform
TheHive - Incident response platform
Cortex - Analysis engine

7.8 Security Testing¶

OWASP ZAP - Web app scanner
Burp Suite Community - Web proxy
Metasploit - Exploitation framework
Nmap - Port scanner

8. Labs et Environnements de Pratique¶

8.1 Home Lab Setup¶

Architecture Recommandée¶

┌─────────────────────────────────────────────────┐
│           Home SOC Lab Architecture             │
├─────────────────────────────────────────────────┤
│                                                 │
│  ┌──────────────┐      ┌──────────────┐        │
│  │  pfSense FW  │──────│  SIEM Server │        │
│  │  (Router)    │      │  (ELK/Wazuh) │        │
│  └──────────────┘      └──────────────┘        │
│         │                      │               │
│         │                      │               │
│  ┌──────────────────────────────────────┐      │
│  │         Network Switch               │      │
│  └──────────────────────────────────────┘      │
│         │           │            │             │
│  ┌──────────┐ ┌──────────┐ ┌──────────┐       │
│  │ Windows  │ │  Linux   │ │ Security │       │
│  │ Client   │ │  Server  │ │  Onion   │       │
│  └──────────┘ └──────────┘ └──────────┘       │
│                                                 │
│  ┌──────────┐ ┌──────────┐                     │
│  │ Malware  │ │ Attacker │                     │
│  │ Analysis │ │   VM     │                     │
│  │ Isolated │ │ (Kali)   │                     │
│  └──────────┘ └──────────┘                     │
│                                                 │
└─────────────────────────────────────────────────┘

Spécifications Minimales¶

Hypervisor: - VMware Workstation Pro / ESXi - VirtualBox (gratuit) - Proxmox VE (gratuit, recommandé) - Hyper-V (Windows Pro)

Hardware: - CPU: 4+ cores (8+ recommandé) - RAM: 32GB minimum (64GB recommandé) - Storage: 500GB+ SSD - Network: Gigabit NIC

VMs Essentielles¶

SIEM Server (Ubuntu 22.04) - RAM: 8-16GB - CPU: 4 cores - Disk: 200GB - Install: Wazuh ou ELK
Security Onion - RAM: 16GB - CPU: 4 cores - Disk: 200GB
Windows 10/11 Client - RAM: 4GB - Sysmon configured - Logging enabled
Windows Server 2019/2022 - RAM: 4GB - Active Directory - DNS, DHCP
Attacker VM (Kali Linux) - RAM: 4GB - Pour simulation attacks
Malware Analysis (SIFT/REMnux) - RAM: 4GB - Network isolated

8.2 Capture The Flag (CTF) Platforms¶

Blue Team CTFs¶

CyberDefenders - https://cyberdefenders.org/
DFIR challenges
SOC challenges
Threat hunting
Blue Team Labs Online - https://blueteamlabs.online/
SOC investigations
Digital forensics
Incident response
LetsDefend - https://letsdefend.io/
SOC Analyst training
SIEM alerts
Real-world scenarios

General CTFs (with blue team aspects)¶

TryHackMe - https://tryhackme.com/
SOC Level 1 path
DFIR modules
Blue team rooms
HackTheBox - https://www.hackthebox.com/
Forensics challenges
Sherlocks (DFIR)
PicoCTF - https://picoctf.org/
Forensics category

8.3 Datasets de Pratique¶

PCAP Datasets¶

Malware-Traffic-Analysis.net
https://malware-traffic-analysis.net/
PCAP avec infections malware
NETRESEC Public PCAP Files
https://www.netresec.com/index.ashx?page=PcapFiles
Wireshark Sample Captures
https://wiki.wireshark.org/SampleCaptures

Log Datasets¶

SecRepo - http://www.secrepo.com/
Sample security logs
LANL Cybersecurity Datasets
https://csr.lanl.gov/data/

Memory Dumps¶

MemLabs - https://github.com/stuxnet999/MemLabs
CTF-style memory forensics
Volatility Test Images
https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples

Malware Samples¶

MalwareBazaar - https://bazaar.abuse.ch/
VirusShare - https://virusshare.com/
theZoo - https://github.com/ytisf/theZoo
⚠️ Live malware - Utiliser avec précaution

9. Certifications Recommandées¶

9.1 Entry Level¶

CompTIA Security+¶

Niveau: Entry
Coût: ~$400
Validité: 3 ans
Focus: Fondamentaux sécurité générale

BTL1 (Blue Team Level 1)¶

Niveau: Entry-Intermediate
Coût: ~$400
Vendor: Security Blue Team
Focus: SOC analyst skills, SIEM, threat intelligence

CySA+ (Cybersecurity Analyst+)¶

Niveau: Intermediate
Coût: ~$400
Vendor: CompTIA
Focus: Security analytics, threat detection

9.2 Intermediate Level¶

GCIA (GIAC Certified Intrusion Analyst)¶

Niveau: Intermediate-Advanced
Coût: ~$2,000
Vendor: GIAC/SANS
Focus: Network forensics, intrusion detection

GCIH (GIAC Certified Incident Handler)¶

Niveau: Intermediate
Coût: ~$2,000
Vendor: GIAC/SANS
Focus: Incident response

GCFA (GIAC Certified Forensic Analyst)¶

Niveau: Advanced
Coût: ~$2,000
Vendor: GIAC/SANS
Focus: Digital forensics

ECIH (EC-Council Certified Incident Handler)¶

Niveau: Intermediate
Coût: ~$500
Vendor: EC-Council

9.3 Advanced Level¶

GNFA (GIAC Network Forensic Analyst)¶

Niveau: Advanced
Coût: ~$2,000
Focus: Advanced network forensics

GREM (GIAC Reverse Engineering Malware)¶

Niveau: Advanced
Coût: ~$2,000
Focus: Malware analysis, reverse engineering

GCFE (GIAC Certified Forensic Examiner)¶

Niveau: Advanced
Coût: ~$2,000
Focus: Computer forensic examinations

OSDA (OffSec Defense Analyst)¶

Niveau: Advanced
Vendor: Offensive Security
Focus: SOC operations, SIEM

9.4 Vendor-Specific¶

Splunk Certifications¶

Splunk Core Certified User
Splunk Core Certified Power User
Splunk Enterprise Security Certified Admin

Elastic Certifications¶

Elastic Certified Analyst
Elastic Certified Engineer

Microsoft¶

SC-200: Microsoft Security Operations Analyst

AWS/Azure/GCP¶

AWS Certified Security - Specialty
Azure Security Engineer Associate
Google Cloud Security Engineer

10. Roadmap d’Apprentissage¶

Phase 1: Fondamentaux (1-3 mois)¶

Mois 1: Bases¶

[ ] Réseaux TCP/IP
Cours: Cisco CCNA ou équivalent gratuit
Labs: Packet Tracer
[ ] Linux fundamentals
OverTheWire: Bandit
Linux Journey: https://linuxjourney.com/
[ ] Windows fundamentals
TryHackMe: Windows Fundamentals

Mois 2: Sécurité de base¶

[ ] CompTIA Security+ (étudier même si pas passer exam)
[ ] OWASP Top 10
[ ] Cryptographie basics
[ ] Scripting: Python/PowerShell basics

Mois 3: Logs et monitoring¶

[ ] Installer home lab (ELK ou Wazuh)
[ ] Générer et analyser logs
[ ] Wireshark basics
[ ] Practice: Malware-Traffic-Analysis.net

Phase 2: SOC Analyst (3-6 mois)¶

Mois 4: SIEM¶

[ ] ELK Stack deep dive
[ ] Créer use cases de détection
[ ] Logstash filters et parsing
[ ] Kibana dashboards

Mois 5: Detection Engineering¶

[ ] Sigma rules
[ ] YARA rules
[ ] Suricata rules
[ ] Correlation rules

Mois 6: Threat Hunting¶

[ ] MITRE ATT&CK framework
[ ] Hypothesis-driven hunting
[ ] Practice: Blue Team Labs Online
[ ] Objectif: BTL1 certification

Phase 3: Incident Response (3-4 mois)¶

Mois 7-8: IR Fundamentals¶

[ ] NIST IR framework
[ ] Créer playbooks
[ ] Live response (Windows & Linux)
[ ] Memory acquisition
[ ] Practice: CyberDefenders IR challenges

Mois 9-10: Forensics¶

[ ] Disk forensics (Autopsy, TSK)
[ ] Memory forensics (Volatility)
[ ] Network forensics
[ ] Timeline analysis
[ ] Practice: DFIR CTFs
[ ] Objectif: CySA+ ou GCIH

Phase 4: Spécialisation (3-6 mois)¶

Choisir une direction:

Option A: Threat Intelligence¶

[ ] MISP deployment
[ ] OSINT techniques
[ ] Threat actor tracking
[ ] APT analysis
[ ] Intel report writing

Option B: Advanced Forensics¶

[ ] Advanced memory forensics
[ ] Mobile forensics
[ ] Malware forensics
[ ] Reverse engineering basics
[ ] Objectif: GCFA ou GNFA

Option C: Security Engineering¶

[ ] EDR deployment
[ ] SOAR platforms
[ ] Automation (Python, APIs)
[ ] Infrastructure as Code
[ ] Cloud security (AWS/Azure)

Phase 5: Continuous Learning (ongoing)¶

Pratique Continue¶

[ ] Participer à CTFs mensuellement
[ ] Lire threat intel reports (Mandiant, CrowdStrike, etc.)
[ ] Suivre CVEs et exploits
[ ] Contribuer à projets open source
[ ] Blogging / write-ups
[ ] Networking: conférences, meetups

Ressources Continues¶

Blogs:
SANS ISC: https://isc.sans.edu/
Krebs on Security
Schneier on Security
The DFIR Report: https://thedfirreport.com/
Podcasts:
Darknet Diaries
SANS Internet Stormcenter
Risky Business
Twitter/X: Suivre security researchers
YouTube Channels:
John Hammond
13Cubed (DFIR)
SANS Digital Forensics
SecurityFWD

11. Vocabulaire Essentiel¶

A-C¶

APT (Advanced Persistent Threat): Menace avancée persistante
AV (Antivirus): Antivirus
C2 / C&C (Command & Control): Serveur de contrôle malware
CASB (Cloud Access Security Broker): Courtier sécurité cloud
CIA Triad: Confidentiality, Integrity, Availability
CSIRT (Computer Security Incident Response Team): Équipe réponse incidents
CVE (Common Vulnerabilities and Exposures): Référence vulnérabilités
CVSS (Common Vulnerability Scoring System): Score vulnérabilités

D-F¶

DDoS (Distributed Denial of Service): Déni de service distribué
DLP (Data Loss Prevention): Prévention perte de données
DNS (Domain Name System): Système noms de domaine
EDR (Endpoint Detection and Response): Détection endpoint
FIM (File Integrity Monitoring): Surveillance intégrité fichiers
FP (False Positive): Faux positif
FN (False Negative): Faux négatif

G-L¶

HIDS (Host-based Intrusion Detection System): IDS sur hôte
HIPS (Host-based Intrusion Prevention System): IPS sur hôte
IDS (Intrusion Detection System): Système détection intrusions
IOC (Indicator of Compromise): Indicateur de compromission
IPS (Intrusion Prevention System): Système prévention intrusions
IR (Incident Response): Réponse à incidents
LDAP (Lightweight Directory Access Protocol): Protocole annuaire
LOLBAS (Living Off the Land Binaries and Scripts): Binaires système pour attaque

M-R¶

MDR (Managed Detection and Response): Détection gérée
MITRE ATT&CK: Framework tactiques et techniques adversaire
MSSP (Managed Security Service Provider): Fournisseur sécurité managée
NGFW (Next-Generation Firewall): Firewall nouvelle génération
NIDS (Network-based IDS): IDS réseau
NSM (Network Security Monitoring): Surveillance sécurité réseau
OSINT (Open Source Intelligence): Renseignement sources ouvertes
PCAP (Packet Capture): Capture de paquets
PoC (Proof of Concept): Preuve de concept
RAT (Remote Access Trojan): Trojan accès distant
RCE (Remote Code Execution): Exécution code à distance

S-Z¶

SBOM (Software Bill of Materials): Inventaire composants logiciels
SIEM (Security Information and Event Management): Gestion événements sécurité
SOC (Security Operations Center): Centre opérations sécurité
SOAR (Security Orchestration Automation and Response): Orchestration sécurité
SSL/TLS: Secure Sockets Layer / Transport Layer Security
STIX (Structured Threat Information eXpression): Format threat intel
TAXII (Trusted Automated eXchange of Intelligence Information): Échange threat intel
TI (Threat Intelligence): Renseignement menaces
TTP (Tactics, Techniques, and Procedures): Tactiques, techniques et procédures
UEBA (User and Entity Behavior Analytics): Analyse comportementale
UTM (Unified Threat Management): Gestion unifiée menaces
WAF (Web Application Firewall): Firewall applicatif web
XDR (Extended Detection and Response): Détection étendue
Zero-day: Vulnérabilité inconnue (jour zéro)

12. Checklist Compétences¶

SOC Analyst Checklist¶

Technical Skills: - [ ] Maîtrise SIEM (ELK, Splunk, ou Wazuh) - [ ] Analyse logs (Windows Event Logs, syslog, Apache, etc.) - [ ] Network traffic analysis (Wireshark, Zeek) - [ ] IDS/IPS (Suricata, Snort) - [ ] EDR basics - [ ] Scripting (Python, PowerShell, Bash) - [ ] Connaissance OS (Windows, Linux) - [ ] Threat intelligence platforms - [ ] MITRE ATT&CK framework - [ ] Incident triage

Soft Skills: - [ ] Documentation claire - [ ] Communication technique - [ ] Travail d’équipe - [ ] Gestion du stress - [ ] Curiosité et apprentissage continu

Incident Responder Checklist¶

Technical Skills: - [ ] All SOC Analyst skills + - [ ] Memory forensics (Volatility) - [ ] Disk forensics (Autopsy, TSK) - [ ] Live response (Windows & Linux) - [ ] Timeline analysis (Plaso) - [ ] Malware analysis basics - [ ] Network forensics - [ ] Log correlation avancée - [ ] Artifact collection (KAPE, etc.) - [ ] Chain of custody - [ ] Report writing

Forensic Analyst Checklist¶

Technical Skills: - [ ] All IR skills + - [ ] Advanced disk forensics - [ ] File system internals (NTFS, ext4) - [ ] Registry forensics - [ ] Browser forensics - [ ] Mobile forensics (Android, iOS) - [ ] Database forensics - [ ] Cloud forensics - [ ] Email forensics - [ ] Advanced memory forensics - [ ] Timeline superanalysis - [ ] Court testimony skills

13. Ressources Complémentaires¶

Books¶

Blue Team Handbook - Don Murdoch
Applied Network Security Monitoring - Chris Sanders
Practical Malware Analysis - Michael Sikorski
The Art of Memory Forensics - Michael Hale Ligh
Windows Forensic Analysis - Harlan Carvey
Intelligence-Driven Incident Response - Scott J. Roberts

Free Training¶

SANS Cyber Aces: https://www.cyberaces.org/
Cybrary: https://www.cybrary.it/
Antisyphon Training: https://www.antisyphontraining.com/
Pay What You Can courses

YouTube Channels¶

13Cubed - DFIR
John Hammond - General security
SANS Digital Forensics and Incident Response
SecurityFWD
LiveOverflow - Advanced topics
IppSec - HTB walkthroughs (understand attacks)

Communities¶

Reddit:
r/blueteamsec
r/AskNetsec
r/cybersecurity
r/computerforensics
Discord:
Blue Team Village
DFIR Discord servers

Conclusion¶

Ce parcours de formation est conçu pour être progressif et complet. La clé du succès est:

Practice, Practice, Practice - Labs quotidiens
Build Projects - Portfolio GitHub
Document Everything - Blog ou GitHub
Network - LinkedIn, Twitter, conférences
Stay Current - Threat intel, CVEs, techniques
Certifications - Validation compétences

Timeline réaliste: - Entry SOC Analyst: 6-12 mois débutant complet - Mid-level IR: +12-18 mois - Senior/Specialist: +24-36 mois

Bonne chance dans votre parcours! 🛡️

Document créé pour formation cybersécurité défensive Dernière mise à jour: 2024