Digital Forensics and Incident Response

Preface

• Who this course is for
• What this course covers
• To get the most out of this course

Understanding Incident Response

• The IR process
• The IR framework
• The IR plan
• The IR playbook/handbook
• Testing the IR framework
• Summary
• Further reading

Managing Cyber Incidents

• Engaging the incident response team
• SOAR
• Incorporating crisis communications
• Incorporating containment strategies
• Getting back to normal – eradication, recovery, and post-incident activity
• Summary
• Further reading

Fundamentals of Digital Forensics

• An overview of forensic science
• Locard’s exchange principle
• Legal issues in digital forensics
• Forensic procedures in incident response
• Summary
• Further reading

Investigation Methodology

• An intrusion analysis case study: The Cuckoo’s Egg
• Types of incident investigation analysis
• Functional digital forensic investigation methodology
• The cyber kill chain
• The diamond model of intrusion analysis
• Summary

Collecting Network Evidence

• An overview of network evidence
• Firewalls and proxy logs
• NetFlow
• Packet capture
• Wireshark
• Evidence collection
• Summary
• Further reading

Acquiring Host-Based Evidence

• Preparation
• Order of volatility
• Evidence acquisition
• Acquiring volatile memory
• Acquiring non-volatile evidence
• Summary
• Further reading

Remote Evidence Collection

• Enterprise incident response challenges
• Endpoint detection and response
• Velociraptor overview and deployment
• Velociraptor scenarios
• Summary

Forensic Imaging

• Understanding forensic imaging
• Tools for imaging
• Preparing a staging drive
• Using write blockers
• Imaging techniques
• Summary
• Further reading

Analyzing Network Evidence

• Network evidence overview
• Analyzing firewall and proxy logs
• Analyzing NetFlow
• Analyzing packet captures
• Summary
• Further reading

Analyzing System Memory

• Memory analysis overview
• Memory analysis methodology
• Memory analysis tools
• Memory analysis with Strings
• Summary
• Further reading

Analyzing System Storage

• Forensic platforms
• Autopsy
• Master File Table analysis
• Prefetch analysis
• Registry analysis
• Summary
• Further reading

Analyzing Log Files

• Logs and log management
• Working with SIEMs
• Windows Logs
• Analyzing Windows Event Logs
• Summary
• Further reading

Writing the Incident Report

• Documentation overview
• Executive summary
• Incident investigation report
• Forensic report
• Preparing the incident and forensic report
• Summary
• Further reading

Ransomware Preparation and Response

• History of ransomware
• Conti ransomware case study
• Proper ransomware preparation
• Eradication and recovery
• Summary
• Further reading

Ransomware Investigations

• Ransomware initial access and execution
• Discovering credential access and theft
• Investigating post-exploitation frameworks
• Command and Control
• Investigating lateral movement techniques
• Summary
• Further reading

Malware Analysis for Incident Response

• Malware analysis overview
• Setting up a malware sandbox
• Static analysis
• Dynamic analysis
• ClamAV
• YARA
• Summary
• Further reading

Leveraging Threat Intelligence

• Threat intelligence overview
• Sourcing threat intelligence
• The MITRE ATT&CK framework
• Working with IOCs and IOAs
• Threat intelligence and incident response
• Summary
• Further reading

Threat Hunting

• Threat hunting overview
• Crafting a hypothesis
• Planning a hunt
• Digital forensic techniques for threat hunting
• EDR for threat hunting
• Summary
• Further reading

Appendix