Advanced Cyber Threat Hunting and DFIR Training

• Introduction to Threat Hunting and DFIR (Digital Forensics and Incident Response)
• Detection Engineering Approaches and Scenarios
• MITRE Frameworks (e.g., ATT&CK, Engage, D3FEND)
• MITRE ATT&CK based Threat Hunting and Detection
• Detection Lab Setup (for Simulating and Detecting Attacks)
• Malware Analysis (Static and Dynamic Analysis)
• Reverse Engineering a Malware Sample
• Hunting on Event Logs, ETW, and Kernel Callbacks
• Call stack based Threat Hunting
• Threat Hunting Scenarios
• Forensic Investigation Techniques
• Memory Forensics
• Analysis Using Memory Forensics Frameworks
• Disk and Registry Forensics
• Ransomware Investigation scenarios

Tools to be learnt

• SIEM platforms (such as Elastic)
• Malware analysis tools (e.g., IDA Pro, x64dbg, windbg)
• Forensics tools (e.g., Volatility, Eric Zimmerman tools)
• ETW and event log analysis tools

Lab

• Simulating and detecting cyber attack
• Conducting malware analysis and reverse engineering
• Ransomware Investigation
• Practical threat hunting scenarios

Bonus Content

• Interview preparation and guidance
• Lab VM and malware samples for analysis
• Custom-built list/repository of openly available resources
• Custom-built mind-maps of different frameworks and major concepts discussed in the course (for example: MITRE ATT&CK)
• Cheat sheets for important topics (for example: x64 assembly instructions, windbg commands, malware sample sources)

System Requirements

• 64-bit Intel i5/i7 2.0+ GHz processor or equivalent
• At least 8GB of RAM and 50GB of free disk space
• Ability to run at least 2 VMs (using Virtual Box, Vmware etc.)
• Windows 10 or later, macOS 10 or later, or Linux
• Internet access for downloading tools and resources

• Malware Analysts
• Digital Forensic Investigators
• Cyber Security Analysts
• Network Security Engineers
• Red Team Members/Penetration Testers
• Incident Response Team Members

• Familiarity of Window and Linux at log level
• Comprehensive understanding of Information Security and its terms
• Basics of Networking
• Experience in Cyber Security is highly recommended

At the end of the course, you will be able to:

• Understand the fundamentals of threat hunting and DFIR.
• Develop and implement detection engineering approaches.
• Utilize MITRE frameworks (ATT&CK, Engage, D3FEND) for threat analysis and response.
• Set up and configure a detection lab for simulating and identifying cyber threats.
• Perform static and dynamic malware analysis.
• Reverse engineer malware samples to uncover malicious behavior.
• Conduct threat hunting using event log, ETW, and kernel callbacks.
• Apply forensic investigation techniques to analyze memory, disk, and registry artifacts.
• Execute memory forensics and analyze results using specialized frameworks.
• Implement and manage disk and registry forensic processes.