In this module,
we introduced you to MSTICPy and Jupyter Notebooks to investigate adversary
behavior. We looked at three MITRE ATT&CK techniques,
attacks on valid accounts in Azure Active Directory,
scripted attacks using PowerShell, and persistence
techniques using Windows scheduled tasks.
Although there is a learning curve for using Jupyter notebooks,
I hope you'll agree that this is a powerful and flexible
investigation and hunting environment.
One bonus with Notebooks is that your investigation workflow
and results are saved into a notebook,
a simple document that you can share as it is or convert to HTML or PDF.
Another bonus is that you can reuse the notebook or parts of it in
future investigations that have similar patterns.
I hope that you enjoyed this module and that has given you inspiration and
insight into how you can use Jupyter Notebooks and MSTICPy to supplement and
enrich the tools in your own security operations center.