Passing the GCTI Exam

Recently, I challenged the GIAC/SANS GCTI exam. And I am excited to say I passed and have obtained the GCTI certificate!!!

The concepts for this course were much newer to me. Threat modelling, researching, and building a threat intelligence tech stack was amazing to learn. Usually, a threat intel program is conducted with very established and mature security programs. So, this is an area I have not seen too many people often get into. However, Threat Intel programs are slowly becoming more common. and knowing your adversary, as well as keeping track of an adversary that could potentially be targeting you is an awesome skill set to accomplish.

FOR578: Cyber Threat Intelligence class

I had taken the full course on threat intelligence. If you want to read my review of it check this blog post out –> https://www.stealthbay.com/a-review-of-for578-cyber-threat-intelligence/

Prepping for the exam

I highly advise everyone take the FOR578: Cyber Threat Intelligence course. You can get more details from here: https://www.sans.org/cyber-security-courses/cyber-threat-intelligence/

The course will prepare you for the exam and cover topics and tools that you will be tested on. There is a lot of material to learn in the course. So, dedicate a good amount of time towards learning the course material and all the concepts. The class was a huge learning experience in the world of Threat Intelligence.

After you take the course try going back to each book and building your index. After this, it is a good time to use up practice exam 1 and see how you fair in it. Use the section at the end, which lists out which sections you were weak in and go study them some more. Take practice exam 2 and hopefully this time you see an improvement. If so, then book your final exam within the next 2-5 days and go for it. This format always has worked well for me.

Making an Index

A Review of FOR578 Cyber Threat Intelligence

Why take this course?

For me Threat Intelligence has been an area of interest.  Many organizations are still in the mindset and position of being very reactive. You notice something odd and investigate it further. However, not a lot of organizations are as proactive, where they go our and research threat actors/adversaries. Or building their own threat intel database that covers incidents within their own org. And, with that not just pulling in public and private threat feeds. But, also building your own indicators, and additional defensive mechanisms. This course will teach you all of that and much more!

Day 1

You will learn about actual incidents and case studies that took place. And, how CTI (Cyber Threat Intelligence) played a huge role in identifying each threat actor.  There are topics just on general “what is threat intelligence”, and different threat models that can be used to develop a program. Overall, day 1 is very much a more theory and introduction type of day.

Day 2

Day 2 things start to get more fun! There is lots of learning about the kill chain life cycle, and really understanding how it functions in respect to threat intel. There are great topics on more detailed threat models, how to apply them and how to analyze various types of logs for key indicators. You also get a good grasp on networking, and forensics analysis techniques.

Earning the Microsoft 365 Threat Protection CCP Badge

I am super honored to say that I am now officially part of the Microsoft 365 Threat Protection Customer Connection Program as a Community Member!

You can view the official badge & details here -> https://www.credly.com/badges/b6a58efe-386f-43c6-a056-2e1defbf45a6/public_url

I have been extremely fortunate to be able to help drive many of Microsoft’s security tools and roadmaps. For those members that are part of the M365 Threat Protection CCP group. They get a chance to contribute heavily to provide feedback on Microsoft Security products. In the end, it helps enhance the security roadmap that Microsoft plans out. Some of the technologies we get to help drive forward and further enhance are listed below.

For example:

Passing the GCFA exam

Recently, I challenged the GIAC/SANS GCFA exam. And I am excited to say I passed and have obtained the GCFA certificate!

This was one of the more detailed courses I had taken in awhile. The IR and Threat hunting sections were not as new to me. However, the memory and forensics section were very deep and detailed. Normally, most organizations will contract out major forensic type of work to 3^rd party external partners. So, the forensics section was something I do not work on as often. But I found learning and getting the knowledge of various ways malware can hide in memory, or how to detect Time stomping attacks from malware was extremely fun and exciting to learn. Feeling incredibly grateful to learn about all these new attack techniques and detection mechanisms.

Prepping for the exam

I highly advise everyone take the SANS FOR 508 course. You can read my review of it here -> https://www.stealthbay.com/review-of-sans-for-508/

The course will prepare you for the exam and cover topics and tools that you will be tested on. There is a lot of material to learn in the course. So, dedicate a good amount of time towards learning the course material and all the concepts. The class itself was amazing especially when you get into Memory Analysis, File system analysis and the Anti-forensics sections.