WEBVTT

00:00:01.140 --> 00:00:02.060
Before we go,

00:00:02.060 --> 00:00:04.590
I want to share with you a few more resources in case you want

00:00:04.590 --> 00:00:07.540
to learn more about Seatbelt and discovery.

00:00:07.540 --> 00:00:09.700
First and most important,

00:00:09.710 --> 00:00:13.990
check the official documentation from Seatbelt. In this course, we cover

00:00:13.990 --> 00:00:16.360
just a tiny fraction of the features of this tool.

00:00:16.840 --> 00:00:20.750
But the reality is that Seatbelt has several other features, like

00:00:20.750 --> 00:00:24.360
network drive discovery, Microsoft Outlook enumeration,

00:00:24.740 --> 00:00:27.350
Windows Firewall enumeration, and much more.

00:00:28.240 --> 00:00:32.210
Remember, this tool has over 100 modules that we can use, so

00:00:32.220 --> 00:00:33.960
there are a lot of other interesting features.

00:00:34.940 --> 00:00:37.770
Also, if you want to improve your discovery skills,

00:00:37.810 --> 00:00:43.770
I do recommend you two courses here at Pluralsight. First, the Discovery with

00:00:43.770 --> 00:00:47.480
ADRecon, in which you learn how to fully enumerate an Active Directory

00:00:47.480 --> 00:00:52.380
domain. And, talking about Active Directory, I also recommend a really good

00:00:52.380 --> 00:00:57.490
course here called Discovery with BloodHound. In there, you'll learn how to

00:00:57.490 --> 00:01:01.160
fully map out your Active Directory so you can create a strategy to gain

00:01:01.160 --> 00:01:02.560
domain admin privileges.

00:01:03.540 --> 00:01:06.500
Also, if you're wondering how you can protect your company against

00:01:06.500 --> 00:01:08.740
those discovery techniques that we discussed in here,

00:01:08.750 --> 00:01:13.010
I have a few suggestions for you. First, use some security solutions to

00:01:13.010 --> 00:01:17.290
monitor the Windows and Active Directory logs. A good endpoint protection

00:01:17.290 --> 00:01:21.090
solution or even a SIEM solution might do the job, as long as they are

00:01:21.090 --> 00:01:25.800
able to detect malicious or anomalous behavior. The idea here is that

00:01:25.800 --> 00:01:29.100
those discovery techniques that we use generate a lot of logs in the

00:01:29.100 --> 00:01:33.090
machines and the domain controller. So, you can create rules to detect

00:01:33.090 --> 00:01:36.770
such logs and alert you in case anyone is performing some discovery

00:01:36.770 --> 00:01:37.350
techniques.

00:01:39.040 --> 00:01:39.910
So that's it.

00:01:39.920 --> 00:01:41.560
That's the end of our Seatbelt course.

00:01:42.340 --> 00:01:44.750
I hope you enjoyed this course and that now you have one

00:01:44.750 --> 00:01:46.860
more discovery technique in your skillset.

00:01:47.540 --> 00:01:50.360
So, thank you for watching, and I will see you in the next course.