Windows Incident Response & Forensics
What you'll learn
- Investigate the full attack chain, from initial access to impact
- Know how to detect and mitigate real-world techniques
- Master Windows memory, file system, and timeline analysis
- Learn to scale investigations across an entire enterprise
Module 1
Accessing and Collecting Data
Module 2
Initial Access and Execution
Module 3
Persistence Mechanisms
Module 4
Credential Access
Detecting LSA Secrets Dumping
Module 5
Privilege Escalation
Identifying Windows Service Escalation
Identifying UAC Escalation Bypass
Identifying Access Token Escalation
Identifying DLL Hijacking Escalation
Module 6
Domain Malicious Behaviours
Kerberos Tickets
Pass-the-Ticket Attack Detection
Kerberoasting and AS-REP Roasting Detection
DCSync and DCShadow Attacks Detection
Kerberos Delegation Abuse Detection
Microsoft ADCS Abuse Detection
Microsoft ADCS Abuse Detection Challenge
Module 7
Lateral Movement & Pivoting
SMB Lateral Movement Analysis
WinRM and WinRS Lateral Movement Analysis
PsExec Lateral Movement Analysis
Scheduled Task Lateral Movement Analysis
Investigating Lateral Movement via WMI
RMM Tools Lateral Movement Analysis
Module 8
Exfiltration and Impact
Investigating Data Discovery
Analysing Data Collection
Uncovering Attacker Infrastructure
Detecting Exfiltration Methods
Identifying Ransomware Operations
Tracing Impact Actions
Module 9
Memory Analysis
Memory Analysis Introduction
Memory Acquisition
Windows Memory & Processes
Windows Memory & User Activity
Windows Memory & Network
Supplemental Memory
Module 10
Advanced Memory Analysis
MemProcFS Overview
Process Objects Analysis
DLL Injections and Hollowing Analysis
Malicious Drivers and Rootkits Analysis
Module 11
Advanced File System Analysis
FAT32 Analysis
NTFS Analysis
Advanced NTFS Analysis
File Carving
Module 12
Scaling and Timeline Analysis
IR Process at Scale
Velociraptor
Advanced Velociraptor
Plaso Timeline Analysis
Module 13
Incident Reporting & Summary
IR Report Writing
Windows IR Summary