Whether you handle an intrusion incident, data theft case, employee misuse scenario, or are engaged in proactive adversary discovery, the network often provides an unparalleled view of the incident. SANS FOR572 covers the tools, technology, and processes required to integrate network evidence sources into your investigations to provide better findings, and to get the job done faster.
Take your system-based forensic knowledge onto the wire. Incorporate network evidence into your investigations, provide better findings, and get the job done faster.
It is exceedingly rare to work any forensic investigation that doesn't have a network component. Endpoint forensics will always be a critical and foundational skill for this career but overlooking their network communications is akin to ignoring security camera footage of a crime as it was committed. Whether you handle an intrusion incident, data theft case, employee misuse scenario, or are engaged in proactive adversary discovery, the network often provides an unparalleled view of the incident. Its evidence can provide the proof necessary to show intent, uncover attackers that have been active for months or longer, or may even prove useful in definitively proving a crime actually occurred.
FOR572: ADVANCED NETWORK FORENSICS: THREAT HUNTING, ANALYSIS AND INCIDENT RESPONSE was designed to cover the most critical skills needed for the increased focus on network communications and artifacts in today's investigative work, including numerous use cases. Many investigative teams are incorporating proactive threat hunting to their skills, in which existing evidence is used with newly-acquired threat intelligence to uncover evidence of previously-unidentified incidents. Others focus on post-incident investigations and reporting. Still others engage with an adversary in real time, seeking to contain and eradicate the attacker from the victim's environment. In these situations and more, the artifacts left behind from attackers' communications can provide an invaluable view into their intent, capabilities, successes, and failures.
In FOR572, we focus on the knowledge necessary to examine and characterize communications that have occurred in the past or continue to occur. Even if the most skilled remote attacker compromised a system with an undetectable exploit, the system still has to communicate over the network. Without command-and-control and data extraction channels, the value of a compromised computer system drops to almost zero. Put another way: Bad guys are talking - we'll teach you to listen.
This course covers the tools, technology, and processes required to integrate network evidence sources into your investigations, with a focus on efficiency and effectiveness. You will leave this week with a well-stocked toolbox and the knowledge to use it on your first day back on the job. We will cover the full spectrum of network evidence, including high level NetFlow analysis, low-level pcap-based dissection, ancillary network log examination, and more. We cover how to leverage existing infrastructure devices that may contain months or years of valuable evidence as well as how to place new collection platforms while an incident is underway.
Whether you are a consultant responding to a client's site, a law enforcement professional assisting cybercrime victims and seeking prosecution of those responsible, an on-staff forensic practitioner, or a member of the growing ranks of threat hunters, this course offers hands-on experience with real-world scenarios that will help take your work to the next level. Previous SANS SEC curriculum students and other network defenders will benefit from the FOR572 perspective on security operations as they take on more incident response and investigative responsibilities. SANS DFIR alumni can take their existing operating system or device knowledge and apply it directly to the network-based attacks that occur daily. In FOR572, we solve the same caliber of real-world problems without the use of disk or memory images.
Most of FOR572's hands-on labs have been developed together with the latest version of FOR508, Advanced Incident Response, Threat Hunting, and Digital Forensics. In these shared scenarios, you'll quickly see a hybrid approach to forensic examination that includes both host and network artifacts is ideal. Although our primary focus is on the network side of that equation, we will point out areas where the host perspective could provide additional context, or where the network perspective gives deeper insight. Both former and future FOR508 students will appreciate the nexus between these extensive evidence sets.
The hands-on labs in this class cover a wide range of tools and platforms, including the venerable tcpdump and Wireshark for packet capture and analysis; NetworkMiner for artifact extraction; and open-source tools including nfdump, tcpxtract, tcpflow, and more. Newly added tools in the course include the free and open-source SOF-ELK platform - a VMware appliance pre-configured with a tailored configuration of the Elastic stack. This "big data" platform includes the Elasticsearch storage and search database, the Logstash ingest and parsing engine, and the Kibana graphical dashboard interface. Together with the custom SOF-ELK configuration files, the platform gives forensicators a ready-to-use platform for log and NetFlow analysis. For full-packet analysis and hunting at scale, the free and open-source Moloch platform is also covered and used in a hands-on lab. Through all of the in-class labs, shell scripting skills are highlighted as quick and easy ways to rip through hundreds of thousands of data records.
FOR572 is an advanced course - we hit the ground running on day one. Bring your entire bag of skills: forensic techniques and methodologies, full-stack networking knowledge (from the wire all the way up to user-facing services), Linux shell utilities, and everything in between. They will all benefit you throughout the course material as you FIGHT CRIME. UNRAVEL INCIDENTS...ONE BYTE (OR PACKET) AT A TIME.
You Will Be Able To
Extract files from network packet captures and proxy cache files, allowing follow-on malware analysis or definitive data loss determinations
Use historical NetFlow data to identify relevant past network occurrences, allowing accurate incident scoping
Reverse engineer custom network protocols to identify an attacker's command-and-control abilities and actions
Decrypt captured SSL/TLS traffic to identify attackers' actions and what data they extracted from the victim
Use data from typical network protocols to increase the fidelity of the investigation's findings
Identify opportunities to collect additional evidence based on the existing systems and platforms within a network architecture
Examine traffic using common network protocols to identify patterns of activity or specific actions that warrant further investigation
Incorporate log data into a comprehensive analytic process, filling knowledge gaps that may be far in the past
Learn how attackers leverage meddler-in-the-middle tools to intercept seemingly secure communications
Examine proprietary network protocols to determine what actions occurred on the endpoint systems
Analyze wireless network traffic to find evidence of malicious activity
Learn how to modify configuration on typical network devices such as firewalls and intrusion detection systems to increase the intelligence value of their logs and alerts during an investigation
Apply the knowledge you acquire during the week in a full-day capstone lab, modeled after real-world nation-state intrusions and threat actors
Foundational network forensics tools: tcpdump and Wireshark refresher
Packet capture applications and data
Unique considerations for network-focused forensic processes
Network evidence types and sources
Network architectural challenges and opportunities for investigators
Investigation OPSEC and footprint considerations
Network protocol analysis
Hypertext Transfer Protocol (HTTP)
Domain Name Service (DNS)
File Transfer Protocol (FTP)
Server Message Block (SMB) and related Microsoft protocols
Simple Mail Transfer Protocol (SMTP)
Commercial network forensic tools
Automated tools and libraries
Open-source NetFlow tools
Capturing wireless traffic
Useful forensic artifacts from wireless traffic
Common attack methods and detection
Log data to supplement network examinations
Microsoft Windows Event Forwarding
HTTP server logs
Firewalls, Intrusion Detection Systems (IDSes), and Network Security Monitoring (NSM) Platforms
Log collection, aggregation, and analysis
Web proxy server examination
Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
Profiling TLS clients without interception
Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
Deep packet work
Network protocol reverse engineering
Round out your team's investigations to include network perspective inherent in all environments
Build baselines that can be used to proactively identify malicious activity early in a compromise, before large-scale damage is done
Provide additional value for existing network data collections that support existing operational requirements
Ensure critical observations from the network are not overlooked in proactive hunting or post-compromise IR actions
What You Will Receive
Custom distribution of the Linux SANS SIFT Workstation Virtual Machine with over 500 digital forensics and incident response tools prebuilt into the environment, including network forensic tools added just for this course
SOF-ELK Virtual Machine - a publicly available appliance running the ELK stack and the course author's custom set of configurations and dashboards. The VM is preconfigured to ingest syslog logs, HTTPD logs, and NetFlow, and will be used during the class to help students wade through the hundreds of millions of records they are likely to encounter during a typical investigation
Moloch Virtual Machine - a standalone VM running the free Moloch application. Moloch ingests and indexes live network data or pcap files, providing a platform that makes full-packet analysis attainable.
Realistic case data to examine during class, from multiple sources including:
Web proxy, firewall, and intrusion detection system logs
Network captures in pcap format
Network service logs
Electronic Downloadable package loaded with case examples, tools, and documentation
Focus: Although many fundamental network forensic concepts align with those of any other digital forensic investigation, the network presents many nuances that require special attention. Today you will learn how to apply what you already know about digital forensics and incident response to network-based evidence. You will also become acclimated to the basic tools of the trade.
Network data can be preserved, but only if directly captured or documented while in transit. Whether tactical or strategic, packet capture methods are quite straightforward. You will re-acquaint yourself with tcpdump and Wireshark, some of the most common tools used to capture and analyze network packets, respectively. However, since long-term full-packet capture is still uncommon in most environments, many artifacts that can tell us about what happened on the wire in the past come from devices that manage network functions. You will learn about what kinds of devices can provide valuable evidence and at what level of granularity. We will walk through collecting evidence from one of the most common sources of network evidence - a web proxy server - then you'll go hands-on to find and extract stolen data from the proxy.
The Linux SIFT Workstation virtual machine, which has been loaded with network forensic tools, will be your primary toolkit for the week.
Lab Environment Preparation
tcpdump and Wireshark Hands-On
Carve Exfiltrated Data
Web Proxy Server Examination
Role of a web proxy
Proxy solutions - commercial and open source
Squid proxy server
Foundational Network Forensics Tools: tcpdump and Wireshark
pcap file format
Berkeley Packet Filter (BPF)
Useful command-line parameters
Useful features for network forensic analysis
Network Evidence Acquisition
Three core types: full-packet capture, Logs, NetFlow
Planning to capture: strategies; commercial and home-built platforms
Network Architectural Challenges and Opportunities
Challenges provided by a network environment
Future trends that will affect network forensics
FOCUS: There are countless network protocols that may be in use in a production network environment. We will cover those that are most likely to benefit the forensicator in typical casework, as well as several that help demonstrate analysis methods useful when facing new, undocumented, or proprietary protocols. By learning the "typical" behaviors of these protocols, we can more readily identify anomalies that may suggest misuse of the protocol for nefarious purposes. These protocol artifacts and anomalies can be profiled through direct traffic analysis as well as through the log evidence created by systems that have control or visibility of that traffic. While this affords the investigator with vast opportunities to analyze the network traffic, efficient analysis of large quantities of source data generally requires tools and methods designed to scale.
Knowing how protocols appear in their normal use is critical if investigators are to identify anomalous behaviors. By looking at some of the more frequently-used and high-impact network communication protocols, we will specifically focus on the ways in which they can be easily misused by an adversary or a malware author.
While no one course could ever exhaustively cover the dizzying list of protocols used in a typical network environment, you will build the skills needed to learn whatever new protocols may come your way. The ability to "learn how to learn" is critical, as new protocols are developed every day. Advanced adversaries also develop their own protocols. As you will see later in this class, successfully understanding and counteracting an adversary's undocumented protocol is a similar process to learning those you will see in this section.
Log data is one of the unsung heroes in the realm of network forensics. While the near-perfect knowledge that comes with full-packet capture seems ideal, it suffers from several shortfalls. It is often unavailable, as many organizations have not yet deployed or cannot deploy comprehensive collection systems. When they are in use, network capture systems quickly amass a huge volume of data, which is often difficult to process effectively and must be maintained in a rolling buffer covering just a few days or weeks. The increasing use of encryption for most network traffic also provides a significant barrier to analysis when using full-packet capture, leaving logs from a terminal point of the communication as the artifact with the most potential impact.
In this section, you will learn various logging mechanisms available to both endpoint and network transport devices. You will also learn how to consolidate log data from multiple sources, providing a broad corpus of evidence in one location. As the volume of log data increases, so does the need to consider automated analytic tools. You'll use the SOF-ELK platform for post-incident log aggregation and analysis, bringing quick and decisive insight to a compromise investigation.
DNS Profiling, Anomalies, and Scoping
SOF-ELK Log Aggregation and Analysis
Hypertext Transfer Protocol (HTTP) Part 1: Protocol
Useful HTTP fields
HTTP tracking cookies
Hypertext Transfer Protocol (HTTP) Part 2: Logs
Expanded mod_forensic logging
Domain Name Service (DNS): Protocol and Logs
Architecture and core functionality
Fast flux and domain name generation algorithms (DGAs)
Forensic Network Security Monitoring
Network Security Monitoring (NSM) emergence from Intrusion Detection Systems (IDSes)
Zeek NSM platform
Proactive/live use case
Post-incident DFIR use case
Logs created and formats used
JSON parsing with the "jq" utility
Community-ID flow hash value
Logging Protocol and Aggregation
Dual role: server and protocol
Source and collection platforms
Deployment model and capabilities
Windows Event Forwarding
Log Data Collection, Aggregation, and Analysis
Benefits of aggregation: scale, scope, independent validation, efficiency
Known weaknesses and mitigations
Evaluating a comprehensive log aggregation platform
Elastic Stack and the SOF-ELK Platform
Basics and pros/cons of the Elastic stack
Use as a data exploration platform
Focus: Network connection logging, commonly called NetFlow, may be the single most valuable source of evidence in network investigations. Many organizations have extensive archives of flow data due to its minimal storage requirements. Since NetFlow does not capture any content of the transmission, many legal issues with long-term retention are mitigated. Even without content, NetFlow provides an excellent means of guiding an investigation and characterizing an adversary's activities from pre-attack through operations. Whether for moving within a victim's environment or for data exfiltration, adversaries must move their quarry around through the use of various file access protocols. By knowing some of the more common file access and transfer protocols, a forensicator can quickly identify an attacker's theft actions.
Just as even a fuzzy photo can provide valuable leads in a traditional investigation, NetFlow data can provide a network forensicator with extremely high-value intelligence about network communications. The key to extracting that value is in knowing how to use NetFlow evidence to drive more detailed investigative activities.
NetFlow is also an ideal technology to use in baselining typical behavior of an environment, and therefore, deviations from that baseline that may suggest malicious actions. Threat hunting teams can also use NetFlow to identify prior connections consistent with newly-identified suspicious endpoints or traffic patterns.
In this section, you will learn the contents of typical NetFlow protocols, as well as common collection architectures and analysis methods. You'll also learn how to distill full-packet collections to NetFlow records for quick initial analysis before diving into more cumbersome pcap files.
You'll then examine the File Transfer Protocol, including how to reconstruct specific files from an FTP session. While FTP is commonly used for data exfiltration, it is also an opportunity to refine protocol analysis techniques, due to its multiple-stream nature.
Lastly, you'll explore a variety of the network protocols unique to a Microsoft Windows or Windows-compatible environment. Significant time will be spent exploring the SMB protocol, used for file transfers and countless other purposes in a Microsoft Windows domain structure. Attackers frequently use these protocols to "live off the land" within the victim's environment. By using existing and expected protocols, the adversary can hide in plain sight and avoid deploying malware that could tip off the investigators to their presence and actions.
Visual NetFlow Analysis with SOF-ELK
Tracking Lateral Movement with NetFlow
SMB Session Analysis and Reconstruction
NetFlow Collection and Analysis
Origins and evolution
NetFlow v5 and v9 protocols
NetFlow artifacts useful for examining encrypted traffic
Open-Source Flow Tools
Using open-source tool sets to examine NetFlow data
nfcapd, nfpcapd, and nfdump
SOF-ELK: NetFlow ingestion and dashboards
File Transfer Protocol (FTP)
History and current use
Shortcomings in today's networks
Capture and analysis
Architecture and capture positioning
SMB v2, and v3
Focus: Commercial tools are an important part of a network forensicator's toolkit. We'll explore the various roles that commercial tools generally fill, as well as how they may best be integrated to an investigative workflow. With the runaway adoption of wireless networking, investigators must also be prepared to address the unique challenges this technology brings to the table. However, regardless of the protocol being examined or budget used to perform the analysis, having a means of exploring full-packet capture is a necessity, and having a toolkit to perform this at scale is critical.
Commercial tools hold clear advantages in some situations a forensicator may typically encounter. Most commonly, this centers on scalability. Many open-source tools are designed for tactical or small-scale use. Whether using them for large-scale deployments or for specific niche functionalities, these tools can immediately address many investigative needs.
Additionally, we will address the forensic aspects of wireless networking. We will cover similarities with and differences from traditional wired network examinations, as well as what interesting artifacts can be recovered from wireless protocol fields. Some inherent weaknesses of wireless deployments will also be covered, including how attackers can leverage those weaknesses during an attack, and how they can be detected.
Finally, we will look at methods that can improve at-scale hunting from full-packet captures, even without commercial tooling. We will look at the open-source Moloch platform and how it can be used in live and forensic workflows. You'll receive a ready-to-use Moloch virtual machine and load source data from an incident we previously investigated, seeking additional clarity from the previously captured full-packet data.
Automated Extraction with NetworkMiner
Using Command-Line Tools for Analysis
Network Forensic Analysis Using Moloch
Simple Mail Transfer Protocol (SMTP)
Lifecycle of an email message
Artifacts embedded along the delivery pathway
Adaptations and extensions
Object Extraction with NetworkMiner
Value of commercial tools in a DFIR workflow
Capabilities and user interface
Use cases for object extraction
Limitations and mitigations
Wireless Network Forensics
Translating analysis of wired networks to the wireless domain
Capture methodologies: Hardware and Software
Useful protocol fields
Typical attack methodologies based on protection mechanisms
Automated Tools and Libraries
Common tools that can facilitate large-scale analysis and repeatable workflows
Libraries that can be linked to custom tools and solutions
Chaining tools together effectively
Full-Packet Hunting with Moloch
Moloch architecture and use cases
Methods of ingesting packet data for DFIR workflows
Session awareness, filtering, typical forensic use cases
Raw packet searching with hunt jobs
Enrichment of extracted metadata
Custom decoding with CyberChef
Focus: Advancements in common technology have made it easier to be a bad guy and harder for us to track them. Strong encryption methods are readily available and custom protocols are easy to develop and employ. Despite this, there are still weaknesses even in the most advanced adversaries' methods. As we learn what the attackers have deliberately hidden from us, we must operate carefully to avoid tipping our hats regarding the investigative progress - or the attacker can quickly pivot, nullifying our progress.
Encryption is frequently cited as the most significant hurdle to effective network forensics - for good reason. When properly implemented, encryption can be a brick wall in between an investigator and critical answers. However, technical and implementation weaknesses can be used to our advantage. Even in the absence of these weaknesses, the right analytic approach to encrypted network traffic can still yield valuable information about the content. We will discuss the basics of encryption and how to approach it during an investigation. The section will also cover flow analysis to characterize encrypted conversations.
We will also discuss undocumented protocols and the misuse of existing protocols for nefarious purposes. Specifically, we will address how to derive intelligence value with limited or nonexistent knowledge of the carrier protocol.
Finally, we will look at how common missteps can provide the attacker with clear insight to the forensicator's progress. This often leads to the attacker changing their tactics, confounding the investigator and even erasing all the progress made to that point. We'll address best practices on conducting investigations and in a compromised environment and ways to share hard-earned intelligence that mitigate the risks involved.
Undocumented Protocol Features
Encoding, Encryption, and SSL/TLS
Profiling SSL/TLS connections with useful negotiation fields
Perfect forward secrecy
Malicious uses and their artifacts
Benevolent uses and associated limitations
Common MITM tools
Network Protocol Reverse Engineering
Using known protocol fields to dissect unknown underlying protocols
Pattern recognition for common encoding algorithms
Addressing undocumented binary protocols
What to do after breaking the protocol
Investigation OPSEC and Threat Intel
Basic analysis can tip off attackers
How to mitigate risk without compromising quality
Plan to share smartly
Protect intelligence to mitigate risks
Focus: This section will combine all of what you have learned prior to and during this week. In groups, you will examine network evidence from a real-world compromise by an advanced attacker. Each group will independently analyze data, form and develop hypotheses, and present findings. No evidence from endpoint systems is available - only the network and its infrastructure.
Students will test their understanding of network evidence and their ability to articulate and support hypotheses through presentations made to the instructor and class. The audience will include senior-level decision makers, so all presentations must include executive summaries as well as technical details. Time permitting, students should also include recommended steps that could help to prevent, detect, or mitigate a repeat compromise.
Network Forensic Case
Analysis using only network-based evidence
Determine the original source of an advanced attacker's compromise
Identify the attacker's actions while in the victim's environment
Confirm what data the attacker stole from the victim
Present executive-level summaries of your findings at the end of the day-long lab
Document and provide low-level technical backup for findings
Establish and present a timeline of the attacker's activities
GIAC Network Forensic Analyst
The GIAC Network Forensic Analyst (GNFA) certification validates a
practitioner's ability to perform examinations employing network
forensic artifact analysis. GNFA certification holders have demonstrated
an understanding of the fundamentals of network forensics, normal and
abnormal conditions for common network protocols, processes and tools
used to examine device and system logs, and wireless communication and
Network architecture, network protocols, and network protocol reverse engineering
Encryption and encoding, NetFlow analysis and attack visualization, security event & incident logging
Network analysis tools and usage, wireless network analysis, & open source network security proxies
Important! Bring your own system configured according to these instructions.
A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.
Back up your systembefore class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.
MANDATORY FOR572 SYSTEM HARDWARE REQUIREMENTS
CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
CRITICAL: Apple systems using the M1/M2 processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.
BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions.Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
16GB of RAM or more is required.
250GB of free storage space or more is required.
At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.
MANDATORY FOR572 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS
Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts), or VMWare Fusion Pro 12.2+ or VMware Fusion Player 11.5+ (for macOS hosts) prior to class beginning.If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Workstation Player offers fewer features than VMware Workstation Pro. For those with Windows host systems, Workstation Pro is recommended for a more seamless student experience.
On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
Download and install7-Zip(for Windows Hosts) orKeka(for macOS hosts). These tools are also included in your downloaded course materials.
Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloadsas soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.
Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.
Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.
If you have additional questions about the laptop specifications, please firstname.lastname@example.org
"When I first became interested in computer and network security in the mid-1990s, the idea of "attacking" another computer network was still science fiction. Today, commercial, governmental, military, and intelligence entities have robust, integrated information security processes. Within the forensic community, we have seen developments that show the agility we must have to remain effective in the face of dynamic adversaries. Endpoint forensic practices will remain the keystone of digital forensics for the foreseeable futur - this is where the events ultimately occur, after all.
"We created FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response to address the most transient domain of digital forensics. Many enterprises have grown to the scale that identifying which handful of endpoints to examine among thousands is a significant challenge. Additionally, the network has become its own medium for incident response and investigation. Our ability to use evidence from all kinds of network devices as well as from captured network data itself will be critical to our success in addressing threats today and tomorrow. From low-grade "script kiddie" attacks to long-term, strategic state-sponsored espionage activity, the network is one of the few common elements found throughout the life cycle of an incident. FOR572 will provide you with the tools and methods to conduct network investigations within environments of all sizes, using scenarios developed from real-world cases. You will finish the course with valuable knowledge that you will use the first day back on the job, and with the methodologies that will help address future generations of adversaries' capabilities." - Phil Hagen
"When I first started my career in computer security, the term "advanced persistent threat" was unknown, yet I had personally recovered terabytes of data obtained from both commercial and government networks. The biggest cybersecurity threat in the news was the latest worm that would propagate through unsuspecting systems and cause more of a nuisance than actual destruction. What was known as the Russian Business Network wasn't even around yet. Network security monitoring was still in its infancy, with very little formal documentation or best practices, most of which were geared towards system administrators. While the Internet has continued to expand, we have all become more interconnected and the threat against our networks continues to grow. We wrote FOR572 as the class we wish we had when we were entering the field of network forensics and investigations - a class that not only provides background when needed but is primarily tailored toward finding evil using multiple data sources and performing a full scope investigation. I am confident this course provides the most up-to-date training covering topics both old and new, based on real-life experiences and investigations." - Mat Oldham
"Phil is probably one of the best instructors I've ever learned from. He's an excellent guy, smart, has a ton of relevant industry knowledge that he can bring in while teaching, and knows how to keep the content interesting." - Ronald Bartwitz, Southern Company
Ways to Learn
Cybersecurity learning – at YOUR pace! OnDemand provides unlimited access to your training wherever, whenever. All labs, exercises, and live support from SANS subject matter experts included.
The full SANS experience live at home! Get the ultimate in virtual, interactive SANS courses with leading SANS instructors via live stream. Following class, plan to kick back and enjoy a keynote from the couch.
In Person (6 days)
Did someone say ALL-ACCESS? On-site immersion via in-classroom course sessions led by world-class SANS instructors fill your day, while bonus receptions and workshops fill your evenings.
Who Should Attend FOR572?
Incident response team members and forensicators who are expanding their investigative scope from endpoint systems to the network
Hunt team members who proactively seek adversaries already in their network environments through leveraging new intelligence against previously collected evidence
Law enforcement officers, federal agents, and detectives who want to become network forensic subject matter experts
Security Operations Center (SOC) personnel and information security practitioners who support hunt operations, seeking to identify attackers in their network environments
Network defenders who are taking on added investigative and/or incident response workloads
Information security managers who need to understand network forensics in order to manage risk, convey information security implications, and manage investigative teams
Network engineers who are proactively orienting their networks to best meet investigative requirements
Information technology professionals who want to learn how network investigations take place
Anyone interested in computer network intrusions and investigations who has a solid background in computer forensics, information systems, and information security
NICE Framework Work Roles:
Cyber Defense Incident Responder (OPM 531)
Cyber Operator (OPM 321)
Cyber Crime Investigator (OPM 221)
Law Enforcement /CounterIntelligence Forensics Analyst(OPM 211)
Cyber Defense Forensics Analyst (OPM 212)
"Best course material on network forensics available. I've learned so many quick tips about how to do things more effectively."
- Mike Ahrendt, KPMG
Need to justify a training request to your manager?
Use this justification letter template to share the key details of this training and certification opportunity with your boss.