Hello friends welcome to my course on Malware Analysis and Reverse Engineering. 1
In this video I'm going to give you a detailed explanation about 2
the course overview. 3
Many of you might have seen a quick introduction about this course where I have explained about the 4
overview. 5
But in this video I want to give you slightly more details about the course and how it's going to proceed 6
further. 7
Before we move on I quickly want to introduce myself to the students. So I'm security enthusiast 8
and I have been working with the security industry for quite some time now. 9
I enjoy spending time on stuff that are related with stuff that are related with information security. 10
I have also been a speaker 11
at eminent conferences like Blackhat and RSA. The reason why I love talking at these conferences 12
is because it gives me a chance to meet with like minded people and also kind of create some ears for 13
what you want to talk about. 14
I also authored a book titled Metasploit penetration testing cookbook. 15
The book has been released in three editions now and it's available on all major bookstores online. 16
I'm also the author of Instant wireshark. Both these books have been published by PACKT publishing house, UK. 17
You can also follow me on Linkedin, Twitter or github. The links have been provided here. 18
Now let us proceed to the course flow view. 19
So this is the same diagram which I used in the introduction video. 20
And the reason why I want to talk a bit more about it is because I want you to understand why I'm following 21
this methodology. 22
So when the attack happens it basically has certain predefined steps which it takes or which the attacker 23
takes in order to compromise the hosts. 24
So what the attacker first does is that it creates a weaponization level, where it targets the victim, 25
plans the attack, starts doing enumeration on different services for example what servers 26
The host is running, what version of http server is there, what version of SQL database is running 27
and stuff like that. 28
Once that information is collected by the attacker the next step is to deliver the attack. 29
Now the delivery of attack can take place 30
In multiple ways. For example it can be done through SpearPhishing or spam emails where the attacker can embed malicious 31
attachments and it can send that e-mail to the particular user whose information was collected 32
in the weaponization phase. Other delivery phases can include exploit kits or PUA(Potentially unwanted Applications) etc. We will go into details 33
of each of these delivery phases in the later videos. 34
So once the delivery has been done the next step is to exploit the machine. 35
The reason why the attacker wants to exploit the machine is that a lot of times once you get inside the 36
system you might not have the right privileges to do advanced activities like taking screen shots or 37
probably installing malware on the system and things like that. 38
That's where exploitation comes handy. 39
Once exploration is done the user can basically escalate its privilege to get more permissions onto 40
the system which he or she has compromised. Once the exploitation phase is done the next action that 41
the attackers want to take is to create persistance onto the system. 42
A lot of times the systems might reboot or you might shut it down and restarted later on. 43
So how do the attackers ensure that they have a persistence into the system that they have compromised. 44
This is done by different steps. 45
For example they can create registry entries for start ups. 46
So every time the machine boots up the malware automatically starts onto the system. 47
They can set up cron jobs. 48
They can set up different WMI scripts and stuff like that. we will go into a lot more details about each 49
of these stuffs then we'll be analyzing malwares because these are very critical in understanding how 50
malware infect the system and how they kind of create a foothold into the network and systems that they 51
have compromised. 52
So once the persistance has been done and the malware has maintained a foothold into the system and 53
the network. 54
The next step is to exfiltrate the data. Data exfilteration would happen by sending stolen data to its command 55
and control server. 56
There are different ways by which they do it. 57
We will be seeing that in much more details in the later videos. 58
So this was a quick overview of the entire work flow that an attacker takes and I have designed this course 59
based on this workflow itself so that we basically not directly jump into understanding malwares, but we 60
first understand the attackers mindset, how they craft their attacks 61
And then only we can you know create effective defense methodology around each of these steps. 62
Well all these steps have been borrowed from a very popular Cyber Kill-Chain Model. 63
This model basically lays down the different steps at which an attack takes place. 64
There are basically seven different steps in the cyber kill-chain but I have narrowed it down to five major 65
steps and this is why I just wanted to quickly give you an idea about the cyber Kill chain. We will be going 66
into the details of these steps in the next video as well. 67
But I just wonder to let you know that the concept is basically picked up from the cyber chain. We will 68
be mapping all the attacks at these steps and we will be applying the analysis strategies based on how the 69
activities are performed. 70
The entire of course is divided into sections. 71
For example the first section is course introduction and overview of the cyber kill chain. 72
The section will contain multiple lecture videos and along with those lecture videos there will be different 73
assignments associated with them. 74
So that's the logical flow. 75
And that's how Udemy has designed the course. 76
And this is how we are going to design the entire course around the sections and assignments. 77
So that's it for this video. 78
Thanks a lot.