The course
On this 3 day practical training course, extend your knowledge beyond conventional static computer forensics analysis. You will be guided through the process of conducting malware analysis, from the principles surrounding the different analysis environments and 7Safe's malware investigation methodology to investigating network activity stemming from malicious software infection. Delegates who successfully complete the exam included at the end of the training course will be awarded the Certified Malware Investigator (CMI) qualification.
Analysis Environments
a. Identify and define the five analysis environments
b. Identify situations in which each of the investigation environments could be used effectively
c. Identify their respective levels of risk both to the original data as well as other systems
2. Malicious Software
a. Define the term “malicious software”
b. Identify and define different types of malicious software
c. Identify similarities and differences between different types of malicious software
3. Malware Investigation
a. Identify the stages of malware investigation
b. Critically assess the capabilities and limitations of anti-malware tools
c. Identify the different means of running software at system start-up
4. Methods of Deception
a. Identify mechanisms of malware delivery
b. Identify mechanisms of disguise
c. Identify client security circumvention
5. Mounted Analysis
a. Mounting forensic images as logical drives
b. Using malware scanners against the mounted image
c. Documenting the results of malware scans
d. Using online scanners for further clarification
6. Booted Analysis
a. Identify approaches to creating a booted analysis environment
b. Experiment with making a Virtual Machine
c. Identifying password implications
d. Identifying and explaining the potential differences between mounted and booted analysis results
7. Network Analysis
a. Identify key reasons for network analysis
b. Methods of building a network for analysis
c. Explaining network communication protocols
d. Using traffic analysis tools for network analysis
e. External Port Analysis
f. Identifying and explaining the potential differences between network and other analysis results
8. Virtualisation Malware
a. Explain how hardware Hypervisor support allows for virtualisation malware
b. Define Type I, Type II and Type III malware
9. Simplifying Complex Evidence
a. Aiming the report at a subject knowledge level fitting the target audience
b. Discuss a sample report outline
- Includes the CMI qualification
- Analysing and interpreting malicious software
- Understanding the Windows Registry
- Investigating network activity initiated by malicious software infection
- Simplifying complex evidence
- Collating and reporting results
Download
PDF
|
Course outline
Read the Malware Investigation: Hands-On course outline to find out more about the many topics covered in CMI Malware Investigation Training |
Frequently Asked Questions (FAQ)
