Abstract

This class is organized and designed to introduce students to advanced techniques for incident responding and threat hunting, which allows to detect and triage advanced malware threats using a completely practical approach. Futhermore, knowledge, techniques and procedures presented during this course help students to collect all necessary artifacts before starting reverse engineering tasks.

We really will deep dive into memory analysis techniques that are able to detect and provide information about advanced threats by analyzing processes, DLLs, network, code injection and hooking activities. Additionally, we will explore details about kernel modules, a topic that has presented as a difficult stuff for many professionals looking for understanding rootkits and their actions. The class also covers Linux memory analysis, and we will analyze artifacts related to processes, network, fileystem and, as expected, kernel. The course ends with a quick approach on Linux forensics.

This class focus on x86/x64 Windows and Linux forensics, but we will use Linux systems during most part of the training.

Who Should Attend

This class is designed and organized for professionals and security researches looking to learn practical approaches and techniques to detect and understand advanced malware threats in real world scenarios. Reverse engineers and malware analysts will benefit from this course because it offers an extensive approach and techniques to understand complex threats before starting reverse engineering analysis.

Key Learning Objectives

Students attending this class will:

  • Learn essential concepts about cyber operations.
  • Learn how to perform memory acquisition.
  • Understand how to adapt Volatility to cases which images symbols are not recognized.
  • Learn practical and effective techniques to detect malicious processes and DLLs.
  • Learn practical methods to detect code injection and hooking in a compromised system.
  • Master practical methods to detect and triage malicious kernel modules.
  • Understand how to collect persistence artifacts from Registry.
  • Learn how to configure how to create Volatility profiles on Linux.
  • Learn practical techniques to analyze process, file sytem system, network and kernel artifacts on Linux.
  • Learn from practical examples to analyze Linux rootkits.
  • Understand mainly artifacts to make Linux forensic investigation feasible.

Prerequisite Knowledge

The recommended prior knowledge for attending this class follows below:

  • Attendees should be prepared to work and install programs on Linux and Windows environments.
  • Students should be ready to use multiple operating system commands.
  • Students should have a good foundation on cyber security concepts.
  • Students should have attended the Incident Response and Threat Hunting 1 class. It is not required, but is strongly recommended.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • One virtual machine running Ubuntu 22.04+ or REMnux.
  • One virtual machine running Windows 11 x64.
  • Malwoverview installed on both virtual machines, including all necessary APIs already configured.
  • Visual Studio Code installed on both Windows virtual machines.
  • IDA Pro or Free.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

The list of sections presented in this class is:

  • Introduction and Lab Setup
  • Cyber Operations
  • Volatility Installation
  • Memory Acquisition
  • Additional Artifacts
  • Identifying Images
  • Windows: Volshell
  • Windows: Processes
  • Windows: DLLs
  • Windows: Code Injection
  • Windows: Networking
  • Windows: Registry
  • Windows: Hooking
  • Windows: Kernel Modules
  • Windows: Disks
  • Windows Memory Analysis
  • Windows Investigation
  • Linux Operations
  • Linux Memory Acquisition
  • Linux Processes
  • Linux Networking
  • Linux File System
  • Linux Kernel Artifacts
  • Linux Rootkits
  • Linux Forensics

Note: Topics can be added, merged or removed without prior notice!