DFIR analyst capstone project
As a DFIR analyst you start from a single alert and run the case end to end yourself: acquisition, disk, memory, log and network analysis, containment advice and a court-ready report.
Level 501 · 13 lessons · 12 practice labs
Lessons
Taking the case
- Taking in the alert and first assessment
- Scope and acquisition plan
- Collecting evidence and starting the chain of custody
- Short task: hand in the acquisition log and hash list
Examination
- Disk examination: execution, persistence and file traces
- Memory examination: processes, injection, connections
- Log and network examination: lateral movement and exfiltration
- Bringing it all together in a super timeline
- Short task: list the incident’s seven key moments with evidence
Outcome and handover
- Containment and eradication advice
- The indicators and detection rules pack
- Peer review and reproducibility of findings
- Capstone: hand over the case file with executive summary, technical report and evidence annexes
Practice labs
- Take the alert and make the first assessment: Write the severity, likely scope and first three questions from the initial alert.
- Scope and acquisition plan: Plan which evidence is collected in what order for the affected systems.
- Hand in the acquisition record and hash list: Collect memory, disk and logs from the lab systems, start the chain of custody and hand in the hash list.
- Extract the execution traces on disk: List the programs run in the incident window in the prepared image.
- Examine processes and connections in memory: Tie together the suspicious process, the injected region and the outbound connection in the dump.
- Confirm persistence on disk and in memory: Prove the persistence entry from three sources: registry, file system and its counterpart in memory.
- Find lateral movement in the logs: List in order the systems hopped to from logon events.
- Measure data egress in the network record: Determine the destination, time and size of the outgoing data from flow and PCAP data.
- List the seven critical moments of the incident: List the incident's seven critical moments from the super timeline with two pieces of evidence each.
- The indicators and detection rules package: Gather the case's indicators and two detection rules in a shareable package.
- Carry out a peer review: Reproduce three findings in another analyst's prepared report and flag the one that does not hold.
- Deliver the case file: Deliver the executive summary, technical report, containment recommendations and evidence annexes for the Turnalı Perakende case in one file.
About this course
As a DFIR analyst you start from a single alert and run the case end to end yourself: acquisition, disk, memory, log and network analysis, containment advice and a court-ready report.
What you will learn
- Taking the case
- Examination
- Outcome and handover
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.