Program Curriculum

• Module 1

  Introduction to Incident Response and Threat Landscape (4 hours)

  Understanding Incident Response (IR):

  • Overview of IR lifecycle phases.
  • Incident classification and severity levels.
  • Legal and regulatory considerations.

  Threat Landscape:

  • Types of threats: APTs, ransomware, insider threats.
  • Threat intelligence sources and feeds.
  • Case studies of notable incidents.
• Module 2

  Incident Detection and Triage (4 hours)

  Log Analysis and Event Correlation:

  • Identifying anomalies and patterns.
  • SIEM tools and log aggregation.

  Endpoint Forensics:

  • Collecting volatile data.
  • Memory analysis and timeline creation.

  Initial Triage:

  • Prioritizing incidents.
  • Assessing impact and scope.
• Module 3

  Threat Hunting Techniques (5 hours)

  Proactive Threat Hunting:

  • Developing hypotheses.
  • Leveraging threat intelligence.
  • Conducting network and host-based hunts.

  Indicators of Compromise (IoCs):

  • Identifying IoCs.
  • Creating custom YARA rules.
  • Using open-source threat feeds.
• Module 4

  Advanced Incident Response (4 hours)

  Containment and Eradication:

  • Isolating affected systems.
  • Removing malware and persistence mechanisms.

  Forensic Artifact Analysis:

  • File system forensics.
  • Registry analysis.
  • Browser history examination.
• Module 5

  Nation-State Threats and APTs (4 hours)

  Attribution and TTPs:

  • Understanding nation-state adversaries.
  • Tactics, techniques, and procedures (TTPs).

  Case Studies:

  • Analyzing APT campaigns.
  • Learning from real-world incidents.
• Module 6

  Incident Reporting and Post-Incident Activities (4 hours)

  Creating Incident Reports:

  • Communicating findings to stakeholders.
  • Legal and compliance requirements.

  Lessons Learned and Continuous Improvement:

  • Post-incident review.
  • Updating incident response playbooks.
  • Prerequisites: Participants should have a foundational understanding of cybersecurity principles.

  This course aims to equip responders and threat hunting teams with the necessary skills to effectively handle incidents, identify threats, and safeguard enterprise networks against sophisticated adversaries.