Course Objective & Scope
During an investigation, rapidly determining what a suspicious binary or script does, which C2 infrastructure it contacts and how it achieves persistence is essential for containment and detection engineering. Conducted entirely in an isolated lab, this advanced programme covers safe sample handling, static and dynamic analysis, deobfuscating scripts, basic unpacking and foundational reverse engineering.
Participants monitor process, registry and network behaviour on representative malware artefacts, inspect key routines in Ghidra and debuggers, extract high-confidence IOCs and write YARA/Sigma rules for enterprise EDR/SIEM deployment.
Who Should Attend?
- L2/L3 SOC analysts and incident response (DFIR) specialists
- Cyber threat intelligence (CTI) and threat hunting researchers
- Cybersecurity engineers building practical malware analysis skills
- Prerequisite: familiarity with Windows/Linux internals, network protocols and basic programming/scripting
Key Takeaways
- Set up and operate an air-gapped, snapshot-backed malware analysis lab safely
- Perform rapid static triage using PE/ELF headers, import tables, strings and entropy analysis
- Conduct dynamic behavioural analysis with Process Monitor, System Informer and simulated network services
- Deobfuscate malicious PowerShell/JS/Office macro scripts and unpack common packers
- Inspect critical code paths in Ghidra to extract C2/persistence IOCs and author effective YARA rules
Curriculum
Isolated Analysis Lab and Static Triage
- VM isolation, snapshot hygiene and network simulation with INetSim/FakeNet-NG
- Inspecting hashes, file formats (PE/ELF), section entropy, strings and Windows API import tables
Analysing Malicious Scripts and Documents
- Examining obfuscated PowerShell, VBScript, JavaScript and Office/PDF droppers and loaders
- Deobfuscating script layers and capturing second-stage payloads
Dynamic Behavioural and Memory Analysis
- Live monitoring of process trees, filesystem changes, Registry persistence and network traffic (Wireshark)
- Detecting process injection/hollowing and dumping unpacked payloads from memory
Code-Level Analysis with Ghidra and Debuggers
- Core x86/x64 constructs, control-flow graphs and function analysis in the Ghidra decompiler
- Setting breakpoints in x64dbg, basic manual unpacking and bypassing simple anti-analysis checks
IOC Extraction, YARA Rule Authoring and Reporting
- Distinguishing atomic, computed and behavioural indicators across the Pyramid of Pain
- Writing and testing high-precision YARA rules and completing an enterprise malware analysis report
Other Courses in This Category
-
All 8 domains of the (ISC)² CISSP Common Body of Knowledge (CBK), risk and governance mindset, security architecture and scenario-based question analysis for experienced security professionals.
- Live Course
- 5 modules
-
The CIA triad, modern threat vectors, identity and access management, network security and baseline hardening practices for IT and software teams who need to identify and mitigate enterprise security risks.
- Live Course
- 5 modules
-
Identity, device posture, network micro-segmentation and continuous verification using NIST SP 800-207 and the CISA Zero Trust Maturity Model for infrastructure and security architects planning enterprise adoption.
- Live Course
- 5 modules
-
OWASP Top 10, threat modeling, secure coding, SAST/DAST/SCA integration and Secure SDLC controls for software and AppSec teams aiming to find and fix vulnerabilities before production.
- Live Course
- 5 modules
-
OWASP API Security Top 10, BOLA/BFLA, OAuth 2.1 and JWT security, GraphQL/gRPC attack surfaces and API gateway controls for engineering and security teams protecting enterprise APIs.
- Live Course
- 5 modules
-
Open-source dependency risks, SBOMs (CycloneDX/SPDX), the SLSA framework, artifact signing with Sigstore/Cosign and CI/CD hardening for DevSecOps and platform teams securing the software supply chain.
- Live Course
- 5 modules
Get in touch
