SANS - FOR526: Advanced Memory Forensics & Threat Detection
Alissa Torres, Jake Williams | Duration: 37h+ | Video: Google VP8 1280x720 | Audio: Vorbis 32 kHz mono | 3,74 GB | Language: English
Memory Forensics In-Depth provides the critical skills necessary for digital forensics examiners and incident responders to proficiently analyze captured memory images and live response audits. The course uses the most effective freeware and open-source tools in the industry today and provides an in-depth understanding of how these tools work. FOR526 is a critical course for any serious DFIR investigator who wants to tackle advanced forensics, trusted insider, and incident response cases.
FOR526: Advanced Memory Forensics and Threat Detection has advanced the investigative skills of hundreds of seasoned security professionals over the years, instilling critical knowledge of operating system internals with the practical application of memory acquisition and analysis skills. We are proud to have served in training some of the most skilled technicians in the field today.
This version of this six-day bootcamp course, the FOR526 Re-Boot, focuses on modern multiplatform enterprise investigations and incorporates real-world, malware and artifact-laden images from system and process memory. We tackle more challenging fileless malware attacks, memory-only, LOLBin and script-based, that require more advanced analysis techniques. Investigative scenarios include acquisition and analysis of targets with security mitigations and OS optimizations such as system integrity protection and memory compression making use of varied tools and methods. Each day's content is augmented with a bootcamp scoring server tournament, allowing the opportunity to practice analysis concepts and build muscle memory. The final Capstone Challenge provides each student a virtual range enterprise to investigate, requiring live memory acquisition and analysis of compromised hosts.
FOR526 provides the critical skills necessary for digital forensics examiners and incident responders to successfully perform live system memory triage and analyze captured memory images from Windows, macOS and Linux hosts. The course uses the most effective freeware and open-source tools in the industry today and provides an in-depth understanding of how these tools work. FOR526 is a critical course for any serious security professional who wishes to gain a deeper understanding of the footprint of code execution and adversary tactics in memory.
