What You Will Learn
Learn to turn malware inside out! This popular reversing course explores malware analysis tools and techniques in depth. FOR610 training has helped forensic investigators, incident responders, security engineers, and IT administrators acquire the practical skills to examine malicious programs that target and infect Windows systems.
Understanding the capabilities of malware is critical to your ability to derive threat intelligence, respond to cybersecurity incidents, and fortify enterprise defenses. This course builds a strong foundation for reverse-engineering malicious software using a variety of system and network monitoring utilities, a disassembler, a debugger, and many other freely available tools.
The course begins by establishing the foundation for analyzing malware in a way that dramatically expands upon the findings of automated analysis tools. You will learn how to set up a flexible laboratory to examine the inner workings of malicious software, and how to use the lab to uncover characteristics of real-world malware samples. You will also learn how to redirect and intercept network traffic in the lab to explore the specimen's capabilities by interacting with the malicious program.
The course continues by discussing essential assembly language concepts relevant to reverse engineering. You will learn to examine malicious code with the help of a disassembler and a debugger in order to understand its key components and execution flow. In addition, you will learn to identify common malware characteristics by looking at suspicious Windows API patterns employed by malicious programs.
Malware is often obfuscated to hinder analysis efforts, so the course will equip you with the skills to unpack executable files. You will learn how to dump such programs from memory with the help of a debugger and additional specialized tools, and how to rebuild the files' structure to bypass the packer's protection. You will also learn how to examine malware that exhibits rootkit functionality to conceal its presence on the system, employing code analysis and memory forensics approaches to examining these characteristics.
FOR610 malware analysis training also teaches how to handle malicious software that attempts to safeguard itself from analysis. You will learn how to recognize and bypass common self-defensive measures, including code injection, sandbox evasion, flow misdirection, and other measures.
The course culminates with a series of Capture-the-Flag challenges designed to reinforce the techniques learned in class and provide additional opportunities to learn practical, hands-on malware analysis skills in a fun setting.
Hands-on workshop exercises are a critical aspect of this course. They enable you to apply malware analysis techniques by examining malicious software in a controlled and systemic manner. When performing the exercises, you will study the supplied specimens' behavioral patterns and examine key portions of their code. To support these activities, you will receive pre-built Windows and Linux virtual machines that include tools for examining and interacting with malware.
In summary, FOR610 malware analysis training will teach you how to:
- Build an isolated, controlled laboratory environment for analyzing the code and behavior of malicious programs
- Employ network and system-monitoring tools to examine how malware interacts with the file system, registry, network, and other processes in a Windows environment
- Control relevant aspects of the malicious program's behavior through network traffic interception and code patching to perform effective malware analysis
- Use a disassembler and a debugger to examine the inner workings of malicious Windows executables
- Bypass a variety of packers and other defensive mechanisms designed by malware authors to misdirect, confuse, and otherwise slow down the analyst
- Recognize and understand common assembly-level patterns in malicious code, such as code L injection, API hooking, and anti-analysis measures
- Assess the threat associated with malicious documents, such as PDF and Microsoft Office files
- Derive Indicators of Compromise (IOCs) from malicious executables to strengthen incident response and threat intelligence efforts.
Why Choose Our Course
The malware analysis process taught in FOR610 helps incident responders and other security professionals assess the severity and repercussions of a situation that involves malicious software so that they can plan recovery steps. Forensics investigators also learn about the key characteristics of malware discovered during the examination, including how to establish Indicators of Compromise and obtain other threat intelligence details for analyzing, scoping, and containing the incident.
What threat does the malicious or suspicious program pose? What do its mechanics reveal about the adversary's goals and capabilities? How effective are the company's security controls against such infections? What security measures can strengthen the organization's infrastructure from future attacks of this nature? This course teaches the skills necessary to answer these and other questions critical to an organization's ability to handle malware threats and related incidents.
What You Will Receive
When attending FOR610, you will receive an electronic toolkit packed with helpful malware analysis tools. You will use them to perform exercises in class, and you can also use them later to interrogate suspicious files when you return to your job. The tools have been preinstalled and configured for your convenience into two virtual machines that you will receive in the course toolkit:
- A Windows REM Workstation virtual machine with preinstalled analysis tools, along with the corresponding Microsoft Windows license.
- A REMnux virtual machine set up to run the lightweight Linux distribution used by many malware analysts world-wide.
The toolkit also includes many real-world malware samples that you will examine during the course when performing hands-on lab exercises, as well as MP3 audio files of the complete course lectures.
You will also receive electronic training materials with detailed explanations and illustrations of the concepts, tools, and techniques covered in the course. The materials include an electroninc workbook that provides detailed, step-by-step instructions for all the hands-on lab exercises performed in the course to facilitate the learning experience.
Syllabus (36 CPEs)Download PDF
Section 1 lays the groundwork for malware analysis by presenting the key tools and techniques useful for examining malicious programs. You will learn how to save time by exploring Windows malware in several phases. Static properties analysis examines meta data and other file attributes to perform triage and determine the next course of action. Behavioral analysis focuses on the program's interactions with its environment, such as the registry, file system, and network. Code analysis focuses on the specimen's inner workings and makes use of debugging tools such as x64bg. You will learn how to set up and use a flexible laboratory to perform such an analysis in a controlled manner, becoming familiar with the supplied Windows and Linux (REMnux) virtual machines. You will then learn how to begin examininng malware in your lab-with guidance and explanations from the instructor to reinforce the concepts discussed throughout the day.
The tools introduced in this section include PeStudio, Process Hacker, Process Monitor, x64dbg, API Monitor, and others.
- Assembling a toolkit for effective malware analysis
- Examining static properties of suspicious programs
- Performing behavioral analysis of malicious Windows executables
- Performing dynamic code analysis of malicious Windows executables
- Interacting with malware in a lab to derive additional behavioral characteristics
Section 2 focuses on examining malicious Windows executables at the assembly level. You will discover approaches for studying the building blocks of a specimen by looking at it through a disassembler. The section begins with an overview of key code-reversing concepts and presents a primer on essential x86 Intel assembly concepts, such as instructions, function calls, variables and jumps. You will also learn how to examine common assembly constructs such as functions, loops, and conditional statements. The material will then build on this foundation and expand your understanding to make you feel comfortable examining assembly instructions frequently seen in malware. Throughout the discussion, you will learn to recognize common characteristics at a code level, including HTTP command and control, keylogging, and command execution.
This section discusses the concepts outlined above while also walking students through the key capabilities of Ghidra for performing static code analysis.
- Understanding core x86 assembly concepts to perform malicious code analysis
- Identifying key assembly logic structures with a disassembler
- Following program control flow to understand decision points during execution
- Recognizing common malware characteristics at the Windows API level (registry manipulation, keylogging, HTTP communications, droppers)
- Extending assembly knowledge to include x64 code analysis
Section 3 focuses on examining malicious web pages and documents, which adversaries can use to directly perform malicious actions on the infected system and launch attacks that lead to the installation of malicious executable files. The section begins by discussing how to examine suspicious websites that might host client-side exploits. Next, you will learn how to deobfuscate malicious scripts with the help of script debuggers and interpreters, examine malicious Microsoft Office macros, and assess the threats associated with PDF and RTF files using several techniques.
The tools introduced in this section include Fiddler, SpiderMonkey, pdf-parser.py, scdbg, and others.
- Interacting with malicious websites to assess the nature of their threats
- Analyzing suspicious PDF files
- Examining malicious Microsoft Office documents, including files with macros
- Analyzing malicious RTF document files
The tools introduced in this section include CFF Explorer, Scylla, OllyDumpEx, Volatility, and others.
- Recognizing packed malware
- Getting started with unpacking
- Using debuggers for dumping packed malware from memory
- Examing obfuscated PowerShell scripts
- Analyzing multi-technology and fileless malware
- Code injection and API hooking
- Using memory forensics for malware analysis
Section 5 takes a close look at the techniques that malware authors commonly use to protect malicious software from being examined. You will learn how to recognize and bypass anti-analysis measures designed to slow you down or misdirect you. In the process, you will gain more experience performing static and dynamic analysis of malware that is able to unpack or inject itself into other processes. You will also expand your understanding of how malware authors safeguard the data that they embed inside malicious executables. As with the other topics covered throughout the course, you will be able to experiment with such techniques during hands-on exercises.
This section brings together many of the tools covered earlier in the course, including Ghidra and x64dbg. It also introduces FLOSS, ScyllaHide, and others.
- How malware detects debuggers and protects embedded data
- Unpacking malicious software that employs process hollowing
- Bypassing the attempts by malware to detect and evade the analysis toolkit
- Handling code misdirection techniques, including SEH and TLS Callbacks
- Unpacking malicious executable by anticipating the packer's actions
Section 6 assigns you to the role of a malware analyst working as a member of an incident response or forensics team. You will be presented with a variety of hands-on challenges involving real-world malware in the context of a fun tournament. These challenges further your ability to perform typical malware analysis tasks and offer additional learning opportunities. The challenges are designed to reinforce skills covered in the first five sections of the course, making use of the popular SANS NetWars educational platform. By applying the techniques learned earlier in the course, you will consolidate your knowledge and shore up skill areas where you might need additional practice. Students at live events who score the highest in the malware analysis challenge will be awarded a coveted SANS Lethal Forensicator coin, bestowing on them the title of "REM Master."
- Behavioral malware analysis
- Dynamic malware analysis (using a debugger)
- Static malware analysis (using a disassembler)
- PDF document analysis
- Microsoft Office document analysis
- Memory analysis
GIAC Reverse Engineering Malware
The GIAC Reverse Engineering Malware (GREM) certification is designed for technologists who protect the organization from malicious code. GREM-certified technologists possess the knowledge and skills to reverse-engineer malicious software (malware) that targets common platforms, such as Microsoft Windows and web browsers. These individuals know how to examine inner-workings of malware in the context of forensic investigations, incident response, and Windows system administration. Become more valuable to your employer and/or customers by highlighting your cutting-edge malware analysis skills through the GREM certification.
Analysis of Malicious Document Files, Analyzing Protected Executables, and Analyzing Web-Based Malware
In-Depth Analysis of Malicious Browser Scripts and In-Depth Analysis of Malicious Executables
Malware Analysis Using Memory Forensics and Malware Code and Behavioral Analysis Fundamentals
Windows Assembly Code Concepts for Reverse-Engineering and Common Windows Malware Characteristics in Assembly
FOR610 attendees should:
- Have a computer system that matches the stated laptop requirements; some software needs to be installed before students come to class.
- Be familiar with using Windows and Linux operating environments and be able to troubleshoot general OS connectivity and setup issues.
- Be familiar with VMware and be able to import and configure virtual machines.
- Have a general idea about core programming concepts such as variables, loops, and functions in order to quickly grasp the relevant concepts in this area; however, no programming experience is necessary.
Important! Bring your own system configured according to these instructions!
A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.
This is common sense, but we will say it anyway: Back up your system before class. Better yet, do not have any sensitive data stored on the system. SANS can't responsible for your system or data.
MANDATORY FOR610 SYSTEM HARDWARE REQUIREMENTS:
- CPU: 64-bit Intel i5/i7 (4th generation+) - x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class. Important - Please Read: a 64-bit system processor is mandatory.
- It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machines will run on your laptop. VMware provides a free tool for Windows that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.
- Note: Apple systems using the M1 processor cannot perform the necessary virtualization at this time and cannot be used for this course.
- BIOS settings must be set to enable virtualization technology, such as "Intel-VT". Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary. Test it before class!
- 16 GB (Gigabytes) of RAM or higher is mandatory for this class Important - Please Read: 16 GB of RAM or higher of RAM is mandatory and minimum.
- USB 3.0 Type-A port is required. At least one open and working USB 3.0 Type-A port is required. Therefore, a Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices - test your system with a USB drive before class to ensure you can load the course data.
- 200 Gigabytes of Free Space on your System Hard Drive. Free Space on Hard Drive is critical to host the VMs we distribute.
- Local Administrator access is required. This is absolutely required. Don't let your IT team tell you otherwise. If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
- Wi-Fi 802.11 capability is mandatory. You'll need to connect to an in-class Wi-Fi network when participating in this course at a life event. Without working Wi-Fi, you'll be unable to participating in important aspects of the course.
MANDATORY FOR610 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS:
- Host Operating System: Your system must be running either Windows 10 Pro, Linux or macOS 10.14 or later that also can install and run VMware virtualization products described below.
- It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.
- Those who use a Linux host must also be able to access exFAT partitions using the appropriate kernel or FUSE modules.
- Download and install 7-Zip (for Windows Hosts) or Keka (macOS). Without these extraction tools, you'll be unable to extract large archives we'll supply to you in class.
INSTALL VMWARE "PRO" SOFTWARE:
- Download and install VMware Workstation 15.5 Pro, VMware Fusion 11.5 Pro or higher versions before class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website.
- You must get the versions of the products that have "Pro" in their name. The free non-Pro versions of these products (e.g., VMware Workstation Player) are not sufficient for this course because they do not support snapshot functionality, which we will need to use.
- Other virtualization software, such as VirtualBox and Hyper-V, are not appropriate because of compatibility and troubleshooting problems you might encounter during class.
- VMware Workstation Pro on Windows 10 is not compatible with Windows 10 Credential Guard and Device Guard technologies. Please disable these capabilities for the duration of the class, if they're enabled on your system, by following instructions from VMware.
Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.
SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.
"I'm amazed how much information a skilled analyst can derive from the malicious files that find their way onto infected systems. Knowing how to reverse-engineer malware allows you to determine the severity of the intrusion, the context of the attack, the intent of the adversary, the containment steps, and numerous other details that help the organization handle the incident. The FOR610 course is the on-ramp for professionals who wish to acquire such malware analysis, building upon the expertise they already have, to learn how to examine malicious software using a variety of practical techniques."
- Lenny Zeltser
"To combat adversaries effectively, you must understand the tools they are using against you. This course teaches the critical skills necessary to systematically reverse engineer code and understand its functionality, dependencies, and limitations. Attackers often go to great lengths to produce unique, robust malware to achieve their objectives. Organizations must have an equally skilled malware analysis capability to dissect that code and learn from it to mitigate future attacks."
- Anuj Soni