Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Malware Analysis (DFIR-II)
This course expands on the foundational principles set forth in DFIR-I, teaching students how to properly identify, handle and process malware threats that may be found during an incident response. By analyzing malware, analysts can expect to gain insight into the intent of a piece of malware and how it may fit in to a larger adversarial intrusion campaign. Malware is a constantly morphing tool by cyber adversaries and having an understanding into the inner workings will be a great asset to cybersecurity analysts and incident responders alike.
Provider Information
Shadowscape
802 W. Bannock St.
Suite 1005
Boise, ID 83702
Course Overview
Intel-Driven Digital Forensics Incident Response (DFIR-I) or Purple Team Ops (TI-II) recommended
Learning Objectives
Students should expect to learn principles of malware triage and exploitation within the scope of network defense. Students will be given multiple examples of real-world malware and be taught how to determine the likely intended target and operational capabilities of it. Students will setup sandboxes to execute and analyze the characteristics of the malware to gain further insight into the motive of the author. This will include malware with multiple different extension types such as executables, dll files, PDFs and Office documents. Students that complete this training should expect to be able to confidently handle suspicious files and report on them to ultimately aid in the investigative process of an intrusion campaign.
Framework Connections
The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):
Competency Areas
Feedback
If you would like to provide feedback on this course, please e-mail the NICCS team at NICCS@mail.cisa.dhs.gov. Please keep in mind that NICCS does not own this course or accept payment for course entry. If you have questions related to the details of this course, such as cost, prerequisites, how to register, etc., please contact the course training provider directly. You can find course training provider contact information by following the link that says “Visit course page for more information...” on this page.