Trellix FIRE-IR: Forensics and Incident Response Education

Kursinhalte

Introduction:

• Overview of Course Content and Format
• Principles of Forensics and IR

Preparation:

• Data Collection Techniques
• Forensic Hardware
• Chain of Custody
• Basic Incident Response Process
• Pre-Incident Preparation
• Documentation Requirements

Malware Strategies:

• Common Approaches
• Containment and Remediation Strategies
• Malware Footprints

Windows Incident Response:

• Data Volatility
• Installed Software and Hotfixes
• Persistence Mechanisms
• Windows Audit Policies
• Malware Analysis
• Prefetch Analysis
• The Windows Registry
• Windows Event Log Analysis

File Carving and Email Analysis:

• File Carving
• Email Header Analysis
• Determining File Headers
• Extraction of Attachments
• Extracting Specific File Types
• Deleted Files and Recovery

Hash and Timeline Module:

• Use of Hash Sets
• Adding Hash Sets
• Advantages of Timeline
• Timeline Creation

Network-Based Monitoring:

• Sources of Network Data
• PCAP Analysis with Wireshark
• Network Footprint

Memory Forensics:

• Basics of Memory Acquisition and Analysis
• Highlight Power of Memory

Unix and Linux Incident Response:

• Live Response Best Practices and Order of Volatility
• Following the Process Tree
• Unix/Linux File Permissions