Overview
This course is designed to help the participants learn more about Digital Forensics, providing them with the needed knowledge and background that enables them to get started in this field. Throughout the course, different vectors used in Digital Forensics are covered. Every topic is introduced with practical live examples of how to solve some issues in a real attack scenario in this category. The course includes theory and practical hands-on experience in our lab setup.
What you will learn?
Introduction to DFIR
- Introduction to Digital Forensics
- Incident Response Life Cycle
- Cyber Kill Chain
- Overview of the MITRE ATT&CK Matrix
Data Collection Techniques
- Type of Digital Collection
- Sampling Techniques
- Data Collection Methods and Tools
- Quality Assurance
Triage and Rapid Assessment
- Introduction to KAPE
- GKAPE Modules
- GKAPE Output
Forensics Imaging
- FTK Imager
- Live Drive and Partitions
- Guymager Tool
Operating System Artifacts
- System and Memory
- Network and Web
Windows Registry Analysis
- Windows Registry
- SAM and System Registry
Windows Log Analysis Techniques
- Windows Event Log
- Event Log Explorer
- Sysmon
User and Application Artifacts
- User and Application Analysis
- Key Registry Artifacts
- Service Analysis
- Shellbags Analysis
- Scheduled Tasks and PsExec
Script and Powershell Analysis
- Code Obfuscation
- Methods of Deobfuscation
- JS Code
- Powershell Code
Memory Acquisition and Analysis
- Why Memory Forensics?
- Volatility - mmrpocfs
Malware Analysis and Detection
- Types of Malware
- Malware Analysis Techniques
- Sandbox Analysis
- Yara and Sigma
Why Do You Need This Course?
- Organizations can use digital forensics to ensure the integrity of their digital assets and maintain good cyber hygiene.
- Aiding firms in analyzing cyberattacks, identifying attack paths and vulnerabilities, estimating risk, and strategizing better defense.
- Protecting and maintaining the security of your computer network.
- Allowing the court to track down criminals and assist in the administration of justice.
- Assisting firms in retaining vital information and preventing leaks in the event of a security attack.
