Course Description

This hands-on course focuses on the forensic assessment of an infected endpoint, utilizing a wide range of analysis techniques on volatile and disk evidence. After purposely infecting virtual systems, students will learn to apply the host intrusion methodology to recover evidence indicating what actions a hacker took against the victim computer.

The course begins with an introduction and explanation of the classroom’s virtual workspace. Instruction addresses topics, such as methods of reconnaissance, in-depth exploration of browser exploits triaging a live host, intrusion analysis methodology, data hiding and phishing techniques, and malware infection. Other areas of study include performing collections with various investigation techniques, and escalating privileges.

Students will take part in real-world scenarios by performing several different types of attacks on a mock victim machine and then examine the victim computer using OpenText™ Forensic (EnCase) to identify the artifacts left behind by the attacker. Many different types of tools and programs will be demonstrated and used during the course.

In addition to the various hacker tools, students will also utilize and discuss a variety of forensic tools, including OpenText Forensic, the direct network preview, and network intrusion EnScript programs for live incident response and collection/analysis of volatile data.

Delivery method: Group-Live. NASBA defined level: advanced

CPE Credits - 32

The course will cover the following topics:

• Conducting reconnaissance activities and using honey networks
• The life cycle of a cyber attack and the anatomy of a browser exploit
• Conducting a triage of a live host
• Understanding and establishing a viable methodology for intrusion analysis
• Data hiding and phishing activities
• Identifying and combating malware infections
• Analysis of compromised systems of remote access software and drive-by, web-browser exploits
• Analysis of memory, event logs, packet captures, and malware
• Use of tools to escalate privileges and to enhance user capabilities

 Course Syllabus

Prerequisites

DF320-Advanced Analysis of Windows Artifacts course or IR250-Incident Investigation course or CFSR Certification. Students should have a good understanding of network topology and TCP/IP. Advance preparation for this course is not required.