FOR589: Cybercrime Investigations

FOR589: Cybercrime Intelligence is a course focused on navigating, discovering, detecting, and disrupting threats from the cybercrime economy. While introductory content is provided, familiarity with intelligence, dark web access, web data collection, cryptocurrency tracing, or digital forensics and incident response is beneficial. First time SANS students will be successful in this course as the technical demands of this course are on par with other beginner SANS courses.

Students may benefit from having taken one of the SANS courses listed below, or equivalent training. However, while these courses are helpful, they are not required.

• SEC497: Practical Open-Source Intelligence (OSINT)
• SEC587: Advanced Open-Source Intelligence (OSINT) Gathering and Analysis
• FOR578: Cyber Threat Intelligence
• FOR528: Ransomware for Incident Responders
• SEC504: Hacker Tools, Techniques, and Incident Handling
• FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

MANDATORY FOR589 SYSTEM HARDWARE REQUIREMENTS

• CPU: 64-bit Intel i5/i7 (4th generation+) processor, x64 bit 2.0+ GHz processor, or more recent processor is mandatory for this class. (Important - Please Read: a 64-bit system processor is mandatory.)
• CRITICAL NOTE: Apple Silicon devices (starting with M1 processors) cannot perform the necessary virtualization and therefore cannot in any way be used for this course.
• It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop.
• BIOS settings must be set to enable virtualization technology, such as "Intel-VT."
• Be certain that you can access your BIOS if it is password-protected in case changes are necessary. Test it!
• 16 gigabytes (GB) of RAM or higher is mandatory for this class. (Important - Please Read: 16 GB of RAM or higher of RAM is mandatory and minimum.)
• USB 3.0 Type-A port is required. At least one open and working USB 3.0 Type-A port is required. (A Type-C to Type-A adapter may be necessary for newer laptops.) (Note: Some endpoint protection software prevents the use of USB devices, so test your system with a commercial USB drive before class to ensure that you can load the course data.)
• 150 GB of free space on your system hard drive is critical to host the VMs we distribute.
• Local administrator access is absolutely required. Do not let your IT team tell you otherwise. If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
• Wireless 802.11 capability

MANDATORY FOR589 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS

• Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
• Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
• Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs. Please note: It is necessary to fully update your host operating system prior to the class to ensure that you have the right drivers and patches installed to utilize the latest USB 3.0 devices.
• Those who use a Linux host must also be able to access ExFAT partitions using the appropriate kernel or FUSE modules.
• You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from completing the labs.
• Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled, or you must have the administrative privileges to disable it.

PLEASE INSTALL THE FOLLOWING SOFTWARE PRIOR TO CLASS:

1. Download and install VMware Workstation Pro 17+ (for Windows hosts), or VMWare Fusion Pro 13+ (for macOS hosts) prior to class beginning. Workstation Pro and Fusion Pro are now available free for personal use from the VMware website. Licensed commercial subscriptions to these products can also be used.
2. On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
3. Microsoft Office (any version) or OpenOffice installed on your host. Note that you can download Office Trial Software online (free for 30 days).
4. Download and install 7Zip (for Windows Hosts) or Keka (macOS). These may be included in your SANS courseware .ISO files.

Your course media is delivered via download from the SANS "Course Material Downloads" page in your SANS account. The media files for the class can be large, some in the 40 to 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to PDFs. The number of classes using eWorkbooks will grow quickly. Considering this, we have found that a second monitor and/or a tablet device can be useful to keep the class materials visible while the instructor is presenting or while you are working on lab exercises.

If you have additional questions about the laptop specifications, please contact customer service.

"Cybercrime isn’t just a threat—it’s the threat redefining the modern battlefield for security professionals. In FOR589: Cybercrime Investigations, we train defenders to get left of boom—to investigate, infiltrate, and dismantle criminal networks before they strike. As financially motivated attacks surge, so does the need for those who can uncover the actors, follow the money, and build intelligence that leads to action. This course teaches students to trace illicit activity across forums, blockchains, and underground economies—equipping them with the knowledge and foresight to outsmart attackers and stop threats before they happen. FOR589 is where intelligence meets action—break the criminal cycle and reduce the blast radius."

- Sean O'Connor

"More organizations need to realize that cybercrime is the number one threat to their organization's IT operations. Illicit fortunes amassed by organized cybercrime groups have led to an emboldened underground economy that currently revolves around ransomware. This is because ransomware attacks persist as one of the most profitable and destructive methods of monetizing access to any type of network. The Colonial Pipeline ransomware incident in 2021 was the most disruptive cyberattack on U.S. critical infrastructure to date, which showcased that unabated cybercrime directly leads to real-world catastrophes. It is thus more important than ever to understand the core drivers behind this threat. SANS FOR589 will arm students with the knowledge to investigate sources of cybercrime, track cybercriminals financially, infiltrate underground communities, and, ultimately, disrupt the adversaries."

- Will Thomas

"Cybercriminals frequently penetrate networks with the primary goal of financial gain. Unfortunately, many organizations leave their sensitive data and intellectual property vulnerable to theft and exploitation, which leaves them with few options when they fall victim to a ransomware attack. They will often pay these ransoms, fueling the financial capabilities of these adversaries and escalating the threat of subsequent breaches. In FOR589, we equip students with the skills to delve into the depths of the cybercrime underworld. This exploration is key to comprehending the motives and proficiencies of cyber adversaries, which is essential for bolstering an organization's defenses and mitigating the likelihood of future security incidents, hopefully breaking this vicious cycle. In FOR589 we will teach students how to safely explore this criminal ecosystem and also provide practical training for tracing cryptocurrency transactions, offering even more intelligence by monitoring financial flows across blockchains."

- Conan Beach