Join
Invictus Incident Response /Incident Response in the Google Cloud
Buy now

  • €1,650

Incident Response in the Google Cloud

  • Course
  • 90 Lessons
  • 365-day access

In this course you will learn how to investigate incidents across Google Cloud and Google Workspace. You will learn what the most common threats are and how to find malicious activity. This course is highly interactive and you will walk away with hands-on Google Cloud IR experience.
Buy now

Contents

Start here!

Everything you need to know
Access the lab environment

Course resources

Course Reference document
BigQuery Cheat Sheet

Welcome

Welcome

Course Introduction

Why this course
Structure & Roadmap

Google Cloud Introduction

Shared Responsibility Model
Hierarchy
Organizational Controls

Identity & Access Management (IAM)

IAM Building blocks
IAM Policy & Policy Analyzer
IAM - Trivia
IAM for Incident Response

Lab 1.1 - IAM enumeration & Policy Analyzer

Lab introduction
Lab 1.1 - Google Cloud IAM - Walkthrough

Google Cloud Threats

Threat Landscape & Google Cloud Threats
Google Workspace Threats
Google Cloud Incident Response - Takeaways

Audit Logging in Google Cloud

Logging overview for Google Cloud
Types of logging
Google Cloud Logs
Data Access Logging
Logging Permissions
Querying logs - Log Explorer
Demo - Log Explorer
BigQuery - 101
Demo - BigQuery
Log Querying - Alternatives
Logging Best Practices

Lab 1.2 - Log analysis in Google Cloud

Lab introduction
Lab 1.2 - Google Cloud Logging - Walkthrough

Google Cloud Security

Security Command Center & SecOps

Google Cloud Forensics

Scenario 1 - Creating a Service Account Key
Scenario 2 - Granting Editor permissions

Google Cloud Attacks - Part I

Frameworks & Invictus Matrix
Initial Access - Valid Credentials
Initial Access - Exploit Public Facing Applications
Discovery

Lab 1.3 - Investigating an account compromise

Lab introduction
Lab 1.3 - Google Cloud Account Compromise - Walkthrough

Google Cloud Attacks - Part II

Persistence & Execution - Deploy Container
Persistence & Execution - IAM Policy Manipulation
Persistence & Execution - Account Manipulation
Persistence & Execution - Cloud Functions
Privilege Escalation & Lateral Movement - Valid Accounts
Privileg Escalation & Lateral Movement - Additional Cloud Roles

Lab 1.4 - Google Cloud Incident Response Investigation

Lab introduction
Lab 1.4. - Google Cloud Capstone - Walkthrough

Google Cloud Attacks - Part III

Exfiltration & Impact - Impair Defenses
Exfiltration & Impact -Data Destruction
Exfiltration & Impact - Transfer to Cloud Account

Google Workspace Introduction

Google Workspace - Overview
Google Workspace - Management
Google Workspace - Licensing

Google Workspace IAM

Google Workspace IAM - Users, OUs, Groups & Roles

Lab 2.1 - Exploring the Admin Console and IAM

Lab introduction
Lab 2.1 - Exploring the Admin Console and IAM - Walkthrough

Audit Logging in Google Workspace

GWS Logging Overview
Retention & Ranking
Permissions
Demo - Setting up a custom IR role
Log Querying
Demo - Querying Google Workspace logs
Exporting Logs
Log Acquisition with Invictus ALFA
Demo - Acquiring logs with ALFA

Lab 2.2 - Acquire GWS logs with ALFA

Lab introduction
Lab 2.2 GWS-Tooling-Walkthrough

Google Workspace Security

Security Alert Center
API Controls
Session Controls

Google Workspace Forensics

Overview
Email Forensics in Google Workspace
Gemini Forensics

Lab 2.3 - Investigate a suspected phishing campaign

Lab introduction
Lab 2.3 - GWS - Phishing Attack - Walkthrough

Google Workspace Attacks - Part I

Attack Overview & Invictus Matrix
Initial Access - AiTM Attacks
Persistence & Execution - OAuth compromise

Lab 2.4 - Investigate an OAuth compromise

Lab introduction
Lab 2.4 - OAuth compromise - Walkthrough

Google Workspace Attacks - Part II

Privilege Escalation & Lateral Movement
Exfiltration & Impact - Part I
Exfiltration & Impact - Part II

Lab 2.5 - AiTM compromise

Lab introduction
Lab 2.5 - AiTM compromise - Walkthrough

Prepare for an Incident

Incident Readiness in Google

Closing & Continue your learning

Closing words!

Request Certificate of Completion

🥇
Request Certificate