ＨｉｄｅＺｅｒｏＯｎｅ

Linux is everywhere– running in the cloud, on cell phones, and in embedded devices that make up the “Internet of Things”. Often neglected by their owners, vulnerable Linux systems are low-hanging fruit for attackers wishing to create powerful botnets or mine cryptocurrencies. Ransomware type attacks may target Linux-based database systems and other important infrastructure. As attacks against Linux become more and more common, there is an increasing demand for skilled Linux investigators. But even experienced forensics professionals may lack sufficient background to properly conduct Linux investigations. Linux is its own particular religion and requires dedicated study and practice to become comfortable.

Antisyphon: Linux Forensics w/ Hal Pomeranz

Learn to turn malware inside out! This popular course explores malware analysis tools and techniques in depth. FOR610 training has helped forensic investigators, incident responders, security engineers, and IT administrators acquire the practical skills to examine malicious programs that target and infect Windows systems.

FOR610.1: Malware Analysis Fundamentals
FOR610.2: Reversing Malicious Code
FOR610.3: Analyzing Malicious Documents and Scripts
FOR610.4: In-Depth Malware Analysis
FOR610.5: Examining Self-Defending Malware
FOR610.6: Malware Analysis Tournament

FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

Whether you handle an intrusion incident, data theft case, employee misuse scenario, or are engaged in proactive adversary discovery, the network often provides an unparalleled view of the incident. SANS FOR572 covers the tools, technology, and processes required to integrate network evidence sources into your investigations to provide better findings, and to get the job done faster.

FOR572.1: Off the Disk and Onto the Wire
FOR572.2: Core Protocols & Log Aggregation/Analysis
FOR572.3: NetFlow and File Access Protocols
FOR572.4: Commercial Tools, Wireless, and Full-Packet Hunting
FOR572.5: Encryption, Protocol Reversing, OPSEC, and Intel
FOR572.6: Network Forensics Capstone Challenge

FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

The world is changing and so is the data we need to conduct our investigations. Cloud platforms change how data is stored and accessed. They remove the examiner’s ability to put their hands directly on the systems. Many examiners are trying to force old methods for on-premise examination onto cloud hosted platforms. Rather than resisting change, examiners must learn to embrace the new opportunities presented to them in the form of new evidence sources. FOR509: Enterprise Cloud Forensics and Incident Response addresses today’s need to bring examiners up to speed with the rapidly changing world of enterprise cloud environments by uncovering the new evidence sources that only exist in the Cloud.

FOR509.1: Microsoft 365 and Graph API
FOR509.2: Microsoft Azure
FOR509.3: Amazon (AWS)
FOR509.4: Google Workspace
FOR509.5: Google Cloud
FOR509.6: Multi-Cloud Intrusion Challenge

FOR509: Enterprise Cloud Forensics and Incident Response