Visão Geral

Este curso aprofunda a análise de memória volátil para investigação de malware, processos, credenciais, conexões, injeção de código e outros artefatos relevantes para DFIR.

Objetivo

Após realizar este curso, você será capaz de:

• Analisar imagens de memória
• Investigar processos e conexões
• Identificar malware residente
• Extrair evidências forenses

Publico Alvo

• DFIR Professionals
• Malware Analysts
• Incident Responders
• Threat Hunters

Pre-Requisitos

• Conhecimentos avançados de Windows
• Conhecimentos básicos de memória
• Familiaridade com processos
• Conhecimentos de Digital Forensics
• Noções de malware analysis

Conteúdo Programatico

Module 1: Advanced Memory Forensics

1. Memory forensic methodology
2. Volatile memory acquisition
3. Memory image validation
4. Windows memory architecture
5. User and kernel space
6. Memory artifacts
7. Forensic integrity
8. Memory analysis workflows
9. Evidence preservation
10. Advanced memory investigation

Module 2: Advanced Process Analysis

1. Process structures
2. Process enumeration
3. Hidden processes
4. Parent-child relationships
5. Process injection
6. Suspicious threads
7. DLL analysis
8. Handles
9. Process artifacts
10. Advanced process investigation

Module 3: Memory-Based Malware Analysis

1. Malware in memory
2. Code injection
3. Reflective loading concepts
4. Suspicious memory regions
5. Injected code indicators
6. Rootkit concepts
7. Kernel artifacts
8. Evasion techniques
9. Malware identification
10. Memory-based malware investigation

Module 4: Credential and Token Analysis

1. Authentication artifacts
2. Security tokens
3. User sessions
4. Privileged sessions
5. Credential exposure
6. Authentication anomalies
7. Credential theft indicators
8. Identity correlation
9. Token analysis
10. Credential forensic investigation

Module 5: Network Memory Forensics

1. Network connections
2. Listening ports
3. Socket analysis
4. Process-to-network correlation
5. C2 indicators
6. Suspicious connections
7. Remote sessions
8. Network timeline
9. Network evidence
10. Memory-based network investigation

Module 6: Advanced Windows Artifacts

1. Kernel structures
2. Drivers
3. Services
4. Registry artifacts
5. Handles
6. DLLs
7. User sessions
8. Command execution artifacts
9. Security artifacts
10. Windows memory artifact correlation

Module 7: Timeline and Attack Reconstruction

1. Memory timelines
2. Process timelines
3. Network timelines
4. Authentication timelines
5. Malware timelines
6. IOC correlation
7. Attack chain reconstruction
8. Evidence validation
9. Investigation findings
10. Forensic reporting

Module 8: Practical Memory Investigation

1. Memory acquisition
2. Process analysis
3. Injection analysis
4. Malware investigation
5. Credential analysis
6. Network analysis
7. Timeline reconstruction
8. IOC extraction
9. Evidence documentation
10. Memory forensics case study