Incident Response and Cyber Investigations

The first section of SEC504 focuses on how to develop and build an incident response process in your organization by applying the Dynamic Approach to Incident Response (DAIR) to effectively verify, scope, contain, assess, and remediate threats. We'll apply this process in-depth with hands-on labs and examples from real-world compromises.

• Live Windows examination
• Network investigation
• Memory investigation
• Malware investigation
• Cloud investigation

Incident Response

• Case study: Argous Corporation compromise
• Dynamic Approach to Incident Response
• Investigative analysis: Examining incident evidence

Digital Investigations

• Techniques for digital investigation
• Establishing an incident timeline
• Investigation efficiency: Data reduction

Live Examination

• Using PowerShell for Windows threat hunting
• Identifying suspicious Windows processes
• Correlating network and persistence activity
• Assessing file-less malware threats
• Enumerating Windows auto-start extensibility points
• Leveraging Sysinternals for live Windows examinations

Network Investigations

• Identifying compromised host beaconing with proxy server logs
• Filtering network activity to identify indicators of compromise
• Assessing encrypted network traffic with multiple data sources
• Building the incident timeline

Memory Investigations

• Collecting volatile memory from a compromised host
• Conducting offline analysis of attacker persistence
• Using Volatility 3 to investigate malware
• Build attacker event timelines using non-volatile memory captures

Malware Investigations

• Assessing attacker malware in a safe test environment
• Using snapshot and continuous recording tools
• Inspecting malware actions with RegShot and Procmon
• Identifying malicious code on Windows

Cloud Investigations

• Steps for conducting a cloud security incident investigation
• Essential cloud logging assets for incident response
• Data collection and isolation for compromise assessment
• Applying cloud recovery and remediation following an incident
• Complete cloud compromise incident response