This class focuses on the use of freeware and open source tools to perform advanced memory analysis. Attendees will also be taught the concepts necessary to extend these tools or build new ones where the existing toolset does not meet all the needs of a particular incident. This course builds on the attendee’s skill in reverse engineering, malware analysis, and programming. MAIN MODULES Advanced Memory Forensics in Incident Response. Enterprise Incident Response. Introduction to Cyber Crime for Executives.

Attendees will learn how to extract host and network-based indicators from a malicious program using dynamic and static analysis techniques. They will learn the basics of how to find the functionality of a program by analyzing disassembly and by watching how it modifies a system as it runs in a debugger. Each section is filled with in-class demonstrations and hands-on labs with real malware where the attendees practice what they have learned in a safe environment. This class is taught by M-Labs Malware Analysts who are experienced in analyzing a diverse set of malware. MAIN MODULES Introduction to Malware Analysis. Intermediate Malware Analysis. Advanced Malware Analysis. Customized Malware Analysis.

Provides attendees a broad introduction to the technologies, techniques, and resources that incident response teams can use to quickly identify attacker activity. The course reinforces critical concepts through case studies and hands-on exercises. MAIN MODULES Network Investigative Techniques. Network Traffic Analysis. Wireless Security.

The course follows the “learn by doing” philosophy. Attendees perform Linux/UNIX commands and discover how the operating system functions. Attendees will primarily operate in the command line environment. The course includes relevant case studies and reinforces key concepts with hands-on exercises to ensure attendees gain practical experience in each critical area discussed. MAIN MODULES Introduction to Linux for Security Professionals Threat Analysis Forensics And Investigation UNIX Investigations. Windows Investigations.