5. **Applications**: The software users interact with (Browsers, Office, Malware).
<!-- pagebreak -->
1. **ASLR (Address Space Layout Randomisation)**: OS defence that randomises base addresses of stack, heap, and libraries on each execution. Makes it harder for attackers to know where to jump in memory. 
   - *Bypass techniques*: Information disclosure leaks that reveal addresses, or brute force (practical only on 32-bit address spaces).
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
- **4625**: Failed Logon (Brute Force / Credential Stuffing indicator)
- **4740**: Account Locked Out (Correlate with brute force attempts)
<!-- pagebreak -->
<!-- pagebreak -->
# $1$=MD5(broken)  $5$=SHA-256  $6$=SHA-512
wmic process list brief      Process list via WMI (harder to hook)
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
  - **255.255.255.255** = limited broadcast.
<!-- pagebreak -->
2.  **Broadcast address** (all host bits = 1)
<!-- pagebreak -->
1.  **DISCOVER**: Client broadcasts on \`0.0.0.0\` → \`255.255.255.255\`, UDP port 67.
2.  **OFFER**: DHCP server broadcasts or unicasts an IP address offer.
3.  **REQUEST**: Client broadcasts acceptance.
    -   Broadcast so other DHCP servers know their offer was not selected.
<!-- pagebreak -->
1.  **Local Cache**: Browser and OS check local DNS cache first.
      <td style="padding: 12px; border: 1px solid #e2e8f0;">Brute force target. Use VPN/MFA.</td>
      <td style="padding: 12px; border: 1px solid #e2e8f0;">Broadcasts frames</td>
<!-- pagebreak -->
      <td style="padding: 12px; border: 1px solid #e2e8f0;">One break kills all</td>
      <td style="padding: 12px; border: 1px solid #e2e8f0;">One break kills ring</td>
      <td style="padding: 12px; border: 1px solid #e2e8f0;"><b>Hybrid</b></td>
<!-- pagebreak -->
-   **WEP (Wired Equivalent Privacy)**: **COMPLETELY BROKEN**. RC4-based, crackable in minutes. Never use. Finding WEP on a network is a critical vulnerability.
1.  Open a browser and navigate to \`http://example.com\` (note: http, NOT https — we need cleartext). Or in terminal: \`curl http://example.com\`.
3.  You will see: \`GET / HTTP/1.1\`, Host: \`example.com\`, User-Agent (browser identification), Accept headers.
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
• One-way functions. MD5 (Broken), SHA-1 (Deprecated), **SHA-256** (Secure).
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
                explanation: 'Snapshots are essential for reverting to a clean state if a lab exercise breaks the VM.'
                options: ['Bridged Adapter', 'NAT', 'Host-Only Adapter', 'Internal Network'],
                explanation: 'SHA-256 is a modern, secure hashing algorithm. MD5 and SHA-1 are considered broken or deprecated.'
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
- **4625**: Failed Logon (Multiple failures suggest brute force).
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
- **Integrations**: Browse the integration catalog to see what data sources are supported (e.g., AWS, Azure, Cisco, Windows).
<!-- pagebreak -->
<!-- pagebreak -->
Detection rules are the "brain" of the SIEM. They analyze incoming data and trigger alerts when specific patterns are matched.
<!-- pagebreak -->
• **Brute Force Detection**:
<!-- pagebreak -->
<!-- pagebreak -->
2. **Triage**: In Kibana, go to **Security -> Alerts**. You should see a "Brute Force" alert.
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
- **Root Cause**: How did the ransomware get in? (e.g., RDP brute force, phishing).
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
• **Directory Brute-forcing**: \`gobuster\`, \`ffuf\`.
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
          description: 'Attacking users through their browsers.',
<!-- pagebreak -->
• **Framework**: **BeEF** (Browser Exploitation Framework).`
<!-- pagebreak -->
          description: 'Cracking and brute-forcing credentials.',
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
- **Breaking Silos**: Ensuring that different departments (IT, Legal, HR) work together on security.
<!-- pagebreak -->
1. **GOVERN**: Establish and monitor the organization's cybersecurity risk management strategy. This is the "brain" of the framework.
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
1. **Policy**: The "What" (Mandatory). High-level, broad scope (e.g., Acceptable Use Policy).
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->
<!-- pagebreak -->