X

Summer Sale

25% off

Excluding Windows Digital Foresenics and Cyberseciruty for executives online training

Windows Incident Response Offline Training

Dive into the field of incident response and digital forensics with experts from Kaspersky’s Global Emergency Response Team (GERT).

Gain valuable knowledge and skills by directly participating in on-site instructor-led training in Dubai

Working in a fully-equipped virtual environment and receiving feedback from a trainer during practice, you will take your expertise in incident detection, evidence acquisition, log-file analysis, network analysis and creation of IOCs to the next level.

On site training

Place: Arenco Tower, Dubai Internet City, UAE

Dates: December 4th – December 8th 2023

Level: Intermediate

$2,200 ($1100for the first 6 students)

Level: Intermediate

$2,200 ($1100for the first 6 students)

Background

Are you looking to improve the expertise of your in-house digital forensics and incident response team? Or do you want to train yourself in the area of incident response to identify the complex attacks? This Kaspersky Windows Incident Response course brings you concentrated knowledge from the company’s Global Emergency Response Team (GERT) experts.

The Kaspersky office in Dubai is offering a unique opportunity to attend instructor-led onsite training! Gain the knowledge and skills straight from the experts, ask them all your questions, share experience with other participants, and become a part of the InfoSec expert community.

The course’s curriculum is heavily focused on putting the course material into practice. Our experts will take you through all the stages of incident response based on real-life events with simulations of true ransomware cases.

You will master incident detection, evidence acquisition, log-file analysis, network analysis and creation of IoCs, and also receive an introduction to memory forensics. You will be working in a simulated virtual environment with all the necessary tools to practice IR. Your instructor will be Ayman Shaaban, who has handled security incidents for Kaspersky incident response customers around the globe. Not only will you gain clear theoretical knowledge but you will also tap into his up-to-date experience, skills and advice.

Course Leader

Ayman Shaaban

Digital Forensics and Incident Response Manager

Ayman joined Kaspersky in 2014 as a security researcher and member of GERT. Currently, he works as DFIR manager in GERT. Ayman started his cybersecurity career in 2009. During his career, he has participated in building digital forensics labs and providing response and analysis for cyber incidents in different industries. He developed training courses on DFIR and delivered these courses to different entities around the globe. Ayman has a BSc in Communications Engineering and an MSc in cybersecurity. Ayman obtained different DFIR certificates and his book “Practical Windows Forensics” was published in 2016.

Overview & Objectives

Identify a cyber incident and how to respond to it
Understand various attack techniques
Differentiate between APTs and other threats
Apply live analysis on victim machines

Acquire evidence in a forensically-sound environment
Upgrade your skills in memory forensics
Apply log file analysis with regular expressions and ELK
Create better network and host-based IoCs
Test your network traffic forensics skills

Syllabus

Download course program

Introduction

Introducing the incident response process and its workflow
Understand the phases of incident response process
What to consider while responding to a cyber-incident
Explaining the difference between normal threats and APTs

Incident response process

Applying the incident response process to different incident scenarios
Applying Cyber Kill Chain on the simulated environment
Understand various attack techniques and the anatomy of a targeted attack through the Cyber Kill Chain

Incident detection

Applying live analysis on victim machines for quicker response
Understand the difference between live analysis and post-mortem – and when to apply each of them
Discussing incident analysis reporting and recommendations on building CSIRT

Evidence acquisition

Identify digital evidence; HDD, memory and network traffic with an introduction on their forensics analysis Forensically-sound evidence acquisition techniques
Introducing post-mortem analysis and digital forensics

Memory analysis

Introducing memory forensics
Memory analysis with Volatility

Log file analysis

Log file analysis with regular expressions and ELK

Network analysis

Introducing network traffic forensics
Write Suricata rules to detect network-based IOCs for the investigated attack

Cyber threat intelligence

Introducing cyber threat intelligence
Creating IoCs (Indicators of
Compromise), with YARA

Exam

The last day of the course will be an exam for the attendees where they will apply the newly-gained skills and knowledge to investigate different cases with various virtual environments.

Who it’s for?

InfoSec professionals

For cybersecurity professionals who would like to upgrade technical analysis skills in the domain of incident response

Enterprises

For incident response and digital forensics teams, who are facing threats daily and willing to continuously enhance their practical skills in incident remediation.

How you’ll learn

Live lectures

Learn from Incident Response expert Ayman of the Global Emergency Response Team, GERT, who has years of experience working on real investigations.

Practical tasks in a Virtual Lab

Practice in our fully configured virtual lab on cases based on real incidents.

Use our equipment

The course is designed with an emphasis on practicing the skills you learned. Kaspersky will provide all necessary equipment for effective training.

Benefits

Support of experts

Communicate with experts and ask all the questions you need

Language

Course delivered in English

Comunity

Empower your professional network by meeting lead InfoSec specialists

Access to Virtual lab

Practice in a Virtual lab with hands-on training

Learning equipment

All the equipment needed for training is provided