Visão Geral

Este curso integra Digital Forensics e Incident Response para investigação completa de incidentes, desde aquisição e análise de evidências até contenção, erradicação, recuperação e documentação.

Objetivo

Após realizar este curso, você será capaz de:

• Integrar forensics e incident response
• Investigar evidências digitais
• Reconstruir ataques
• Executar processos de resposta

Publico Alvo

• DFIR Professionals
• Incident Responders
• SOC e Blue Team
• Cybersecurity Professionals

Pre-Requisitos

• Conhecimentos de incident response
• Conhecimentos de Windows e Linux
• Conhecimentos básicos de Digital Forensics
• Familiaridade com SIEM
• Conhecimentos de redes

Conteúdo Programatico

Module 1: DFIR Fundamentals

1. DFIR concepts
2. Digital Forensics
3. Incident Response
4. DFIR lifecycle
5. Investigation planning
6. Evidence preservation
7. Incident scoping
8. Investigation methodology
9. DFIR documentation
10. DFIR operational workflow

Module 2: Evidence Acquisition

1. Disk acquisition
2. Memory acquisition
3. Log acquisition
4. Network evidence
5. File acquisition
6. Evidence hashing
7. Evidence validation
8. Chain of custody
9. Acquisition documentation
10. Evidence preservation

Module 3: Endpoint Forensics

1. Windows artifacts
2. Linux artifacts
3. Event Logs
4. Registry
5. Processes
6. Services
7. Scheduled Tasks
8. Browser artifacts
9. File system artifacts
10. Endpoint investigation

Module 4: Network Forensics

1. Packet capture
2. Network flows
3. DNS
4. HTTP
5. HTTPS
6. Command and Control
7. Lateral Movement
8. Data exfiltration
9. Network timelines
10. Network investigation

Module 5: Threat Investigation

1. Initial Access
2. Execution
3. Persistence
4. Credential Access
5. Privilege Escalation
6. Discovery
7. Lateral Movement
8. Command and Control
9. Impact
10. Attack reconstruction

Module 6: Incident Response

1. Detection
2. Triage
3. Containment
4. Evidence preservation
5. Eradication
6. Recovery
7. Credential remediation
8. System restoration
9. Post-incident monitoring
10. Response documentation

Module 7: Threat Hunting and Intelligence

1. Threat hunting
2. IOC analysis
3. TTP analysis
4. MITRE ATT&CK
5. Threat intelligence
6. Behavioral analysis
7. Attack path analysis
8. Hunt hypotheses
9. Detection development
10. Intelligence reporting

Module 8: Practical DFIR Investigation

1. Incident triage
2. Evidence acquisition
3. Endpoint analysis
4. Network analysis
5. Timeline construction
6. Attack reconstruction
7. Containment
8. Eradication
9. Recovery
10. DFIR case study