Kaspersky Cybersecurity Training
Comprehensive training programs covering digital forensics, malware analysis and incident response topics

Topics

Through a simulated real-life targeted cyberattack, the course covers the following topics:

• Introduction to digital forensics
• Live response and evidence acquisition
• Post-mortem analysis of Windows machines
• MS Windows registry internals
• MS Windows events
• MS Windows artifacts analysis
• Browsers artifacts forensics
• Email analysis
• Forensics challenges with SSD disks
• Recommendations for building a digital forensics lab
• Testing the newly gained skills with a practical challenge using different Windows artifacts

Key skills gained

• How to acquire various digital evidence and deal with it in a forensically sound environment
• Find traces of incident-related malicious activities from
• MS Windows artifacts
• Utilize time stamps from different Windows artifacts to reconstruct an incident scenario
• Find and analyze browser and email history
• Be able be apply the tools and instruments of digital forensics
• Understand the process of creating a digital forensics lab

Topics

• Basic analysis using IDA Pro
• Dynamic analysis using popular virtualization solutions and debuggers
• Malicious documents analysis
• Unpacking
• Decryption
• Shellcodes analysis
• Exploit analysis
• Reverse tips and tricks

Key skills gained

• A grounding in OS and assembly language
• Be able to conduct static and dynamic malware analysis to fully understand its behavior and functionality
• Deal with malware anti-analysis tricks, self-protective techniques and protection software bypasses
• Identify and reverse engineer standalone and embedded shellcodes
• Analyze PDF exploits from scratch

Topics

Through a simulated real-life targeted cyberattack, the course covers the following topics:

• Numerical systems
• FAT file system
• NTFS file system
• Data and file recovery from file system, shadow copies and using file carving
• Forensics challenges in Cloud computing
• Memory forensics
• Network forensics
• Timeline vs SuperTimeline analysis
• Testing the newly gained skills with a practical challenge with acquired digital evidence

Key skills gained

• Conduct deep file system analysis
• Identify and recover deleted files using different techniques
• Analyze network traffic with different tools
• Identify and track malicious activities in memory dump
• Identify and dump interesting parts from memory for further analysis
• Reconstruct the incident timeline using file system timestamps
• Create a single timeline for all Windows OS artifacts to gain a better understanding of the incident scenario

Topics

• Unpacking
• Decryption
• Developing own decryptors for common scenarios
• Byte code decompilation
• Code decomposition
• Disassembly
• Reconstruction of modern APT architectures
• Recognizing typical code constructs
• Identification of cryptographic and compression algorithms
• Classification and attribution based on code and data
• Class and structure reconstruction
• APT plugin architectures (based on recent APT samples)

Key skills gained

• Be able to analyze a modern APT toolkit, from receiving the initial sample, all the way to producing a technical description of the attacker’s TTPs with IOCs
• Produce static decryptors for real-life scenarios and then continuing with in-depth analysis of the malicious code
• Analyze malicious documents that are typically used to deliver initial payloads and know how to extract them
• Ensure that damage assessment and incident response efforts are accurate and effective

Topics

In a simulated real-life environment, an incident will take place and the course will cover the following topics on that specific scenario:

• Introducing the incident response process and its workflow
• Explaining the difference between normal threats and APTs
• Explaining APT Cyber Kill Chain
• Applying the incident response process to different incident scenarios
• Applying Cyber Kill Chain on the simulated environment
• Applying live analysis on victim machines for first responders
• Forensically sound evidence-acquisition techniques
• Introducing post-mortem analysis and digital forensics
• Introducing memory forensics
• Log file analysis with regular expressions and ELK
• Introducing cyber threat intelligence
• Creating IoCs (Indicators of Compromise), with YARA and Suricata
• Introducing malware analysis and sandboxing
• Introducing network traffic forensics
• Discussing incident analysis reporting and recommendations on building CSIRT
• Testing the newly gained skills with a practical challenge in another simulated scenario

Key skills gained

• Understand the phases of incident response
• What to consider while responding to a cyber incident
• Understand various attack techniques and targeted attack anatomy through the Cyber Kill Chain
• Respond to different incidents with the appropriate actions
• The ability to differentiate APTs from other threats
• Confirm cyber incidents using live analysis tools
• Understand the difference between live analysis and post-mortem - and when to apply each of them
• Identify digital evidence; HDD, memory and network traffic with an introduction on their forensics analysis
• Write YARA and Suricata rules to detect IOCs for the investigated attack
• Log file analysis
• Understand the process involved in building an IR team

Topics

• Brief intro into Yara syntax
• Tips & tricks to create fast and effective rules
• Yara-generators
• Testing Yara rules for false positives
• Hunting new undetected samples on VT
• Using external modules within Yara for effective hunting
• Anomaly search
• Lots (!) of real-life examples
• Exercises for improving your Yara skills

Key skills gained

• Create effective Yara rules
• Test Yara rules
• Hunt for new undetected samples in your infrastructure and in cloud platforms

Develop practical skills in working with digital evidence

• Develop practical skills in searching for digital cybercrime traces
• Learn how to analyze different types of data
• Restore incident logic, timelines and sources

Learn how to analyze and detect malicious software

• Analyze malicious samples and collect indicators of compromise
• Create signatures to detect malware on infected machines
• Restore infected/encrypted files and documents

Adopt best practices for incident response and remediation

• Move through all the stages of successful incident response
• Learn the most efficient mitigation strategies
• Increase the overall efficiency of incident response in your organization