Endpoint Live Forensics Training
While there is undoubtedly a need for deep forensic analysis in the investigation of malware and operating system intrusions, an investigator has to know that there has been an intrusion before that activity can begin. Many organizations rely on technology to perform this task, but there is still no substitute for a well-trained analyst, when it comes to identifying and investigating abnormal behavior on a system.
Endpoint Live Forensics
Course Overview
By the end of the course, you should be able to meet the following objectives:
Identify the core components of the operating system and ascertain their current state using built-in or other trusted tools
Analyze a running system and detect abnormal behavior relating to operating system objects such as processes, handles, network connections, etc.
- Use event log analysis to verify and correlate the artifacts of anomalous behavior, and determine the scope of an intrusion
- Use PowerShell to interact with the operating system and build scripts to automate repetitive analytic tasks
- Create and use a system baseline to identify unexpected items such as rogue accounts or configuration changes
Course Outline
- Lesson 1: Windows Core Components - OS Overview
- OS Definition
- Architecture Overview
- OS Structure
- OS Motivation
- Kernel Mode vs. User Mode
- Windows Structure
- Windows Boot Process
- Lab
- OS Familiarization
- Lesson 2: Windows Core Components - The Registry
- Registry Overview
- Signs of File Execution
- Registry Persistence Mechanisms
- Baselining the Registry
- Lab
- Navigate Regedit.exe and reg.exe
- Add and remove keys and values
- Investigate the registry for
- potentially malicious behavior
- Lesson 3: Windows Core Components - Processes
- What is a Process?
- Process Tree
- Single vs. Multiple Instances
- Threads
- Process Objects
- Process Tools
- Normal Windows Processes
- Suspicious Processes
- Lab
- Examine system information related to networking, sockets, and active connections with TCPView
- Execute a piece of malware and document the findings
- Lesson 4: Windows Core Components - Dynamic Linked Libraries (DLLS)
- Libraries
- Program Linking
- What are DLLs?
- Imports and Exports
- DLL Search Order
- Code and DLL Injection
- Known Windows DLLs
- Lesson 5: Windows Core Components - Memory Management and Injection
- Memory Management
- Page Protections
- Code and DLL Injection
- Reflective DLL Injection
- Hollow Process Injection
- Lab
- Identify process injection using the
- discussed tools
- Lesson 6: Windows Core Components - Services
- What is a Service?
- The Services Registry
- Common Service Control Programs
- Analyzing Services
- Lab
- Examine and interact with services using multiple tools
- Differentiate information types and sources
- Lesson 7: Windows Core Components - Logs and Timelines
- Logs Overview
- Event Logs
- Scheduled Task Logs
- Antivirus Logs
- PowerShell Logs
- Timelining
- Anti-analysis
- Lab
- Analyze malicious behavior with EventViewer
- Lesson 8: Powershell
- What Is PowerShell?
- Cmdlets and Providers
- Getting Help
- Objects, Piping, and Selection
- I/O and Formatting
- Lab
- Discover language features and cmdlets, using the PowerShell help system
- Use object members to obtain more functionality from cmdlets and sort the output
- Create variables and use static members
- Lesson 9: Powershill - Querying the Operating System
- Processes
- Services
- User Accounts
- Event Logs
- File System
- Registry
- Network Connections
- Lab
- Demonstrate the use of PowerShell to access and display Process and Service attributes
- Query Registry Keys using PowerShell
- Access and display Registry and File System attributes with PowerShell
- Lesson 10: Powershell - Scripting with Powershell
- What Is a Script?
- Branching
- Repetition
- Functions
- Script I/O
- Execution Policy
- Lab
- Modify a script using PowerShell
- Lesson 11: Powershell - Baselining with PowerShell
- What Is Baselining?
- Baselining Elements
- Differencing Tools
- Lab
- Compose a Baseline Script with PowerShell
- PowerShell Baseline Scenario
- Lesson 12: Powershell - Baselining Linux
- File System
- File Structure
- Virtual File System
- Links
- Permissions
- Accounts
- Lab
- Summarize the Linux File System permissions and file integrity
- Demonstrate how Linux determines a user’s shell
- Lesson 13: Powershell - Privilege Escalation
- Suid
- Sudo
- Wildcard Attacks
- Lesson 14: Powershell - Linux Internals
- Processes
- Scheduled Tasks
- Networking
- Services
- Logs
- Lab
- Monitor and interact with services
- Investigate processes and /proc filesystem
- Investigate concepts regarding two systems
Intended Audience
- Incident Responders who need to quickly identify a security breach
- Forensic Investigators needing to analyze the state of a running system
- Malware Analysts requiring a thorough understanding of operating system intrusions
Prerequisites
- Familiarity with the use of desktop operating systems, including command-line experience in Windows and/or Linux
- Working knowledge of TCP/IP networking
Related training topics
Justify your training
Use this sample request letter — copy it into an email to your manager and personalize the bracketed details to make the case for the time and budget.
Sample training request letter
Subject: Request for Digital Forensics & Reverse Engineering training from Applied Technology Academy
[Decision Maker Name],
I'm writing to request time and budget approval to complete Applied Technology Academy's course, Endpoint Live Forensics Training. The information below outlines how this training benefits our organization, the tasks I'll be able to perform after completing it, and relevant cost and funding details.
Course Description
While there is undoubtedly a need for deep forensic analysis in the investigation of malware and operating system intrusions, an investigator has to know that there has been an intrusion before that activity can begin. Many organizations rely on technology to perform this task, but there is still no substitute for a well-trained analyst, when it comes to identifying and investigating abnormal behavior on a system. Applied Technology Academy is an award-winning, SBA-certified woman-owned training provider (est. 2008) whose instructors are active practitioners; the course is hands-on with virtual labs and a learn-by-doing methodology.
Course Objectives
Once I've completed the course, I'll have hands-on, job-ready skills in digital forensics & reverse engineering that I can apply immediately to our work.
Expected Organizational Benefits
After completing this course, I will be better equipped to apply these skills directly to our projects, reduce our reliance on outside expertise, strengthen our team's capabilities, and share what I learn with colleagues.
Expected Cost & Funding
Course fee: [request an itemized quote at the link below]. Applied Technology Academy supports multiple funding paths that may reduce or cover this cost: GSA MAS purchasing and government purchase orders, military credentialing funding (Army CA, AF COOL, CG COOL), VA GI Bill and VR&E, ATA Flexible Spending, and student financing. Private team cohorts are available if colleagues should attend with me.
Conclusion
This training provides practical, hands-on experience I can apply immediately to strengthen our work in digital forensics & reverse engineering. Additional course information is available at https://appliedtechnologyacademy.com/endpoint-live-forensics/.
Thank you for your consideration,
[Your Name]
Design training around your team, not the other way around.
Talk to a training advisor about private cohorts, funding paths and program management.