Welcome to FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

Instructor: Eric Zimmerman | 36 CPEs
Associated Certification: 
GIAC Certified Forensic Analyst (GCFA)

Threat hunting and Incident response tactics and procedures have evolved rapidly over the past several years. Your team can no longer afford to use antiquated incident response and threat hunting techniques that fail to properly identify compromised systems.

The key is to constantly look for attacks that get past security systems, and to catch intrusions in progress, rather than after attackers have completed their objectives and done worse damage to the organization.

What You Will Learn


FOR508: Advanced Incident Response and Threat Hunting Course will help you to:

  • Detect how and when a breach occurred
  • Identify compromised and affected systems
  • Perform damage assessments and determine what was stolen or changed
  • Contain and remediate incidents
  • Develop key sources of threat intelligence
  • Hunt down additional breaches using knowledge of the adversary

DAY 0: A 3-letter government agency contacts you to say an advanced threat group is targeting organizations like yours, and that your organization is likely a target. They won't tell how they know, but they suspect that there are already several breached systems within your enterprise. An advanced persistent threat, aka an APT, is likely involved. This is the most sophisticated threat that you are likely to face in your efforts to defend your systems and data, and these adversaries may have been actively rummaging through your network undetected for months or even years.

This is a hypothetical situation, but the chances are very high that hidden threats already exist inside your organization's networks. Organizations can't afford to believe that their security measures are perfect and impenetrable, no matter how thorough their security precautions might be. Prevention systems alone are insufficient to counter focused human adversaries who know how to get around most security and monitoring tools.

The key is to constantly look for attacks that get past security systems, and to catch intrusions in progress, rather than after attackers have completed their objectives and done significant damage to the organization. For the incident responder, this process is known as "threat hunting". Threat hunting uses known adversary behaviors to proactively examine the network and endpoints in order to identify new data breaches.

Threat hunting and Incident response tactics and procedures have evolved rapidly over the past several years. Your team can no longer afford to use antiquated incident response and threat hunting techniques that fail to properly identify compromised systems, provide ineffective containment of the breach, and ultimately fail to rapidly remediate the incident. Incident response and threat hunting teams are the keys to identifying and observing malware indicators and patterns of activity in order to generate accurate threat intelligence that can be used to detect current and future intrusions.

This in-depth incident response and threat hunting course provides responders and threat hunting teams with advanced skills to hunt down, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hacktivists. Constantly updated, FOR508: Advanced Incident Response and Threat Hunting addresses today's incidents by providing hands-on incident response and threat hunting tactics and techniques that elite responders and hunters are successfully using to detect, counter, and respond to real-world breach cases.

The course uses a hands-on enterprise intrusion lab -- modeled after a real-world targeted APT attack on an enterprise network and based on APT group tactics to target a network -- to lead you to challenges and solutions via extensive use of the SIFT Workstation and best-of-breed investigative tools.

During the intrusion and threat hunting lab exercises, you will identify where the initial targeted attack occurred and how the adversary is moving laterally through multiple compromised systems. You will also extract and create crucial cyber threat intelligence that can help you properly scope the compromise and detect future breaches.

During a targeted attack, an organization needs the best incident response team in the field. FOR508: Advanced Incident Response and Threat Hunting will train you and your team to respond, detect, scope, and stop intrusions and data breaches.


FOR508 Course Topics

  • Advanced use of a wide range of best-of-breed open-source tools and the SIFT Workstation to perform incident response and digital forensics.
  • Hunting and responding to advanced adversaries such as nation-state actors, organized crime, and hacktivists.
  • Threat hunting techniques that will aid in quicker identification of breaches.
  • Rapid incident response analysis and breach assessment.
  • Incident response and intrusion forensics methodology.
  • Remote and enterprise incident response system analysis.
  • Windows live incident response and scaling collection of triage data.
  • Investigating and countering living of the land attacks, including PowerShell and WMI.
  • Memory analysis during incident response and threat hunting.
  • Transitioning memory analysis skills to enterprise detection and response (EDR) platforms
  • Detailed instruction on compromise and protection of Windows enterprise credentials.
  • Internal lateral movement analysis and detection.
  • Rapid and deep-dive timeline creation and analysis.
  • Volume shadow copy exploitation for hunting threats and incident response.
  • Detection of anti-forensics and adversary hiding techniques.
  • Discovery of unknown malware on a system.
  • Adversary threat intelligence development, indicators of compromise, and usage.
  • Cyber-kill chain strategies.
  • Step-by-step tactics and procedures to respond to and investigate intrusion cases

Pricing & Registration

This course is part of the SANS Partnership Program. Students affiliated with an eligible institution* may enroll in this course at a discounted rate of $3170. To receive this rate, enter the appropriate discount code when registering. All registrations using a code will be audited to confirm that they are eligible to receive the discounted rate. GPCA Certification 949 USD | OnDemand 949 USD This class is being offered IN-PERSON & LIVE ONLINE, please click on the blue "Register Now" button to the right. If you are affiliated with a Partnership-eligible institution enter discount code 75770-IP (If you are attending In-person) and 75770-LO (If you are attending Live Online) to receive your Partnership pricing! *Eligible institutions include US and Canada-based educational Institutions (any accredited educational institution, including colleges, universities, technical training institutes and K-12 schools) and any US state or local government agency.

FOR508: Advanced Incident Response and Threat Hunting Course will help you to:

  • Detect how and when a breach occurred
  • Identify compromised and affected systems
  • Perform damage assessments and determine what was stolen or changed
  • Contain and remediate incidents
  • Develop key sources of threat intelligence
  • Hunt down additional breaches using knowledge of the adversary

Hands-On Training

One of the biggest complaints you hear in the threat hunting and incident response community is the lack of realistic intrusion data. Most real-world intrusion data are simply too sensitive to be shared.

The FOR508 course authors created a realistic scenario based on experiences surveyed from a panel of responders who regularly combat targeted APT attacks. They helped review and guide the targeted attack "script" used to create the scenario. The result is an incredibly rich and realistic attack scenario across multiple enterprise systems. This APT attack lab forms the basis for training during the week. The network was set up to mimic a standard "protected" enterprise network using standard compliance checklists:

  • Full auditing turned on per recommended Federal Information Security Management Act guidelines
  • Windows domain controller (DC) set up and configured; DC hardened similarly to what is seen in real enterprise networks
  • Systems installed with the real software on them that is used (Office, Adobe, Skype, Tweetdeck, Email, Dropbox, Firefox, Chrome)
  • Fully patched systems (patches are automatically installed)
  • Endpoint Detection and Response (EDR) agents
  • Enterprise A/V and on-scan capability based on the Department of Defense's Host-based Security System
    • Endpoint Protection Software - Anti-virus, Anti-spyware, Safe surfing, Anti-spam, Device Control, Onsite Management, Host Intrusion Prevention (HIPS)
  • Firewall only allows inbound port 25 and outbound ports 25, 80, 443

This exercise and challenge are used to show real adversary traces across host systems, system memory, hibernation/pagefiles, and more:

  • Phase 1 - Patient zero compromise and malware C2 beacon installation
  • Phase 2 - Privilege escalation, lateral movement to other systems, malware utilities download, installation of additional beacons, and obtaining domain admin credentials
  • Phase 3 - Search for intellectual property, profile network, dump email, dump enterprise hashes
  • Phase 4 - Collect data to exfiltrate and copy to staging system. Archive data using .rar and a complex passphrase
  • Phase 5 - Exfiltrate .rar files from staging server, perform cleanup on staging server

You Will Be Able To:

  • Learn and master the tools, techniques, and procedures necessary to effectively hunt, detect, and contain a variety of adversaries and to remediate incidents.
  • Detect and hunt unknown live, dormant, and custom malware in memory across multiple Windows systems in an enterprise environment.
  • Hunt through and perform incident response across hundreds of unique systems simultaneously using PowerShell or F-Response Enterprise and the SIFT Workstation.
  • Identify and track malware beaconing outbound to its command and control (C2) channel via memory forensics, registry analysis, and network connection residue.
  • Determine how the breach occurred by identifying the beachhead and initial attack mechanisms.
  • Identify living of the land techniques, inluduing malicious use of PowerShell and WMI.
  • Target advanced adversary anti-forensics techniques like hidden and time-stomped malware, along with utility-ware used to move in the network and maintain an attacker's presence.
  • Use memory analysis, incident response, and threat hunting tools in the SIFT Workstation to detect hidden processes, malware, attacker command lines, rootkits, network connections, and more.
  • Track user and attacker activity second-by-second on the system you are analyzing through in-depth timeline and super-timeline analysis.
  • Recover data cleared using anti-forensics techniques via Volume Shadow Copy and Restore Point analysis.
  • Identify lateral movement and pivots within your enterprise across your endpoints, showing how attackers transition from system to system without detection.
  • Understand how the attacker can acquire legitimate credentials - including domain administrator rights - even in a locked-down environment.
  • Track data movement as the attackers collect critical data and shift them to exfiltration collection points.
  • Recover and analyze archives and .rar files used by APT-like attackers to exfiltrate sensitive data from the enterprise network.
  • Use collected data to perform effective remediation across the entire enterprise.
"So much content! I am finally able to get into the weeds and learn about things that have been a mystery for so long! FOR508 really breaks down the complicated in a way that is easy to understand while still leaving so much more to be done. I love this class." - Zachary T., US Federal Government

Course Syllabus

FOR508.1: Advanced Incident Response & Threat Hunting


There are ways to gain an advantage against adversaries targeting you -- it starts with the right mindset and knowing what works.

The last decade has not been kind to network defenders. Threats to the modern enterprise are legion and attackers have used the enormous complexity of enterprise networks against us. But the tide is shifting. Over the past decade, we have seen a dramatic increase in sophisticated attacks against organizations. Nation-state attacks originating from the intelligence services of countries like China and Russia, often referred to as Advanced Persistent Threat (APT) actors, have proved difficult to suppress. Massive financial attacks from the four corners of the globe have resulted in billions of dollars in losses. Ransomware and extortion became an existential threat almost overnight. While the odds are stacked against us, the best teams out there are proving that these threats can be managed and mitigated. The adversary is good and getting better. Are we learning how to counter them? Yes, we are.

This course was designed to help organizations increase their capability to detect and respond to intrusions. This is an achievable goal and begins by teaching you the tools and techniques necessary to find evil in your network. This course is designed to make you and your organization an integral part of the solution. Incident responders and threat hunters must be armed with the latest tools, analysis techniques, and enterprise methodologies to identify, track, and contain advanced adversaries with the ultimate goal of rapid remediation of incidents. Further, incident response and threat hunting analysts must be able to scale their efforts across potentially thousands of systems in the enterprise. We start the day by examining the six-step incident response methodology as it applies to incident response for advanced threat groups. The importance of developing cyber threat intelligence to impact the adversaries' "kill chain" is discussed and forensic live response techniques and tactics are demonstrated that can be applied both to single systems and across the entire enterprise.

Understanding attacks is critical to being able to detect and mitigate them. We start our education of attacker techniques on day one, learning common malware characteristics and diving deep into techniques used by adversaries to maintain persistence in the network. Persistence is typically completed early in the attack cycle and students will learn hunting techniques to audit the network and accomplish early discovery. Living off the land binaries (local tools available in most environments) and WMI-based attacks in particular have become standard operating procedure for advanced adversaries and we end the day working with tools and techniques to identify such attacks at scale.

Get ready to hunt!

  • Forensic Lab Setup and Orientation Using the SIFT Workstation
  • Malware Persistence Detection and Analysis
  • Scaling Data Collection and Analysis
  • Finding and Analyzing Malicious WMI attacks

Real Incident Response Tactics

  • Preparation: Key tools, techniques, and procedures that an incident response team needs to respond properly to intrusions
  • Identification/Scoping: Proper scoping of an incident and detecting all compromised systems in the enterprise
  • Containment/Intelligence Development: Restricting access, monitoring, and learning about the adversary in order to develop threat intelligence
  • Eradication/Remediation: Determining and executing key steps that must be taken to help stop the current incident and the move to real-time remediation
  • Recovery: Recording of the threat intelligence to be used in the event of a similar adversary returning to the enterprise
  • Avoiding "Whack-A-Mole" Incident Response: Going beyond immediate eradication without proper incident scoping/containment

Threat Hunting

  • Hunting versus Reactive Response
  • Intelligence-Driven Incident Response
  • Building a Continuous Incident Response/Threat Hunting Capability
  • Forensic Analysis versus Threat Hunting Across Endpoints
  • Threat Hunt Team Roles
  • ATT&CK - MITRE's Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK(TM))

Threat Hunting in the Enterprise

  • Identification of Compromised Systems
  • Finding Active and Dormant Malware
  • Digitally Signed Malware
  • Malware Characteristics
  • Common Hiding Mechanisms
  • Finding Evil by Understanding Normal

Incident Response and Hunting across Endpoints

  • WMIC & PowerShell
  • PowerShell Remoting Scalability
  • PowerShell Remoting Credential Safeguards
  • Kansa PowerShell Remoting IR Framework

Malware Defense Evasion and Identification

  • Service Hijacking/Replacement
  • Frequent Compilation
  • Binary Padding
  • Packing/Armoring
  • Dormant Malware
  • Signing Code with Valid Certificates
  • Anti-Forensics/Timestomping

Malware Persistence Identification

  • AutoStart Locations, RunKeys
  • Service Creation/Replacement
  • Service Failure Recovery
  • Scheduled Tasks
  • DLL Hijacking
  • WMI Event Consumers

Investigating WMI-Based Attacks

  • WMI Overview
  • WMI Attacks Across the Kill Chain
  • Auditing the WMI Repository
  • WMI File System and Registry Residue
  • Command-Line Analysis and WMI Logs
  • WMI Process Anomalies

FOR508.2: Intrusion Analysis


Even the most advanced adversaries leave footprints everywhere. Learn the secrets of the best hunters.

Cyber defenders have a wide variety of tools and artifacts available to identify, hunt, and track adversary activity in a network. Each attacker action leaves a corresponding artifact, and understanding what is left behind as footprints can be crucial to both red and blue team members. Attacks follow a predictable pattern, and we focus our detective efforts on immutable portions of that pattern. As an example, at some point an attacker will need to run code to accomplish their objectives. We can identify this activity via application execution artifacts. The attacker will also need one or more accounts to run code. Consequently, account auditing is a powerful means of identifying malicious actions. An attacker also needs a means to move throughout the network, so we look for artifacts left by the relatively small number of ways there are to accomplish this part of their mission. In this section, we cover common attacker tradecraft and discuss the various data sources and forensic tools you can use to identify malicious activity in the enterprise.

  • Hunting and Detecting Evidence of Execution at Scale with Shimcache and Amcache
  • Discovering Credential abuse with Event Log Collection and Analysis
  • Tracking Lateral Movement with Event Log Analysis
  • Hunting Malicious use of WMI and PowerShell

Stealing and Utilization of Legitimate Credentials

  • Pass the Hash
  • Single Sign On (SSO) Dumping using Mimikatz
  • Token Stealing
  • Cached Credentials
  • LSA Secrets
  • Kerberos Attacks
  • NTDS.DIT theft

Advanced Evidence of Execution Detection

  • Attacker Tactics, Techniques, and Procedures (TTPs) Observed Via Process Execution
  • Prefetch Analysis
  • Application Compatibility Cache (ShimCache)
  • Amcache Registry Examination
  • Scaling ShimCache and Amcache Investigations

Lateral Movement Adversary Tactics, Techniques, and Procedures (TTPs)

  • Compromising Credentials Techniques
  • Remote Desktop Services Misuse
  • Windows Admin Share Abuse
  • PsExec and Cobalt Strike Beacon PsExec Activity
  • Windows Remote Management Tool Techniques
  • PowerShell Remoting/WMIC Hacking
  • Vulnerability Exploitation

Log Analysis for Incident Responders and Hunters

  • Profiling Account Usage and Logons
  • Tracking and Hunting Lateral Movement
  • Identifying Suspicious Services
  • Detecting Rogue Application Installation
  • Finding Malware Execution and Process Tracking
  • Capturing Command Lines and Scripts
  • PowerShell Transcript and ScriptBlock Logging
  • Discovering Cobalt Strike beacon PowerShell Import Activity
  • PowerShell Script Obfuscation
  • WMI Activity Logging
  • Anti-Forensics and Event Log Clearing

FOR508.3: Memory Forensics in Incident Response & Threat Hunting


Using memory analysis sometimes feels like cheating -- finding active attacks shouldn't be this easy.

Memory forensics has come a long way in just a few years. It is now a critical component of many advanced tool suites and the mainstay of successful incident response and threat hunting teams. Memory forensics can be extraordinarily effective at finding evidence of worms, rootkits, PowerShell, and advanced malware used by targeted attackers. In fact, some fileless attacks may be nearly impossible to unravel without memory analysis. Memory analysis was traditionally the domain of Windows internals experts and reverse engineers, but new tools, techniques, and detection heuristics have greatly leveled the playing field making it accessible today to all investigators, incident responders, and threat hunters. Further, understanding attack patterns in memory is a core analyst skill applicable across a wide range of endpoint detection and response (EDR) products, making those tools even more effective. This extremely popular section will cover many of the most powerful memory analysis capabilities available and give you a solid foundation of advanced memory forensic skills to super-charge investigations, regardless of the toolset employed.

  • Remote endpoint incident response, hunting, and analysis using F-Response Enterprise
  • Remote endpoint memory examination using F-Response Enterprise
  • Creating local and remote triage images with KAPE
  • Scaling investigations with Velociraptor
  • Detect unknown live and dormant custom malware in memory across multiple systems in an enterprise environment
  • Examine Windows process trees to identify normal versus anomalies
  • Find APT "beacon" malware over common ports used by targeted attackers to access command and control (C2) channels
  • Find residual attacker command-line activity through scanning strings in memory and by extracting command history buffers
  • Compare compromised system memory against a baseline system using Frequency of Least Occurrence stacking techniques
  • Identify advanced malware hiding techniques, including code injection and rootkits
  • Employing indicators of compromise to automate analysis
  • Analysis of memory from infected systems:
    • Stuxnet
    • TDL3/ TDSS
    • Cozyduke APT29 RAT
    • Rundll32
    • Zeus/Zbot
    • Conficker
    • StormWorm Rootkit
    • Black Energy Rootkit
    • WMI and PowerShell
    • Cobalt Strike Beacons and Powerpick
    • Metasploit
    • Custom APT command and control malware

Remote and Enterprise Incident Response

  • Remote Endpoint Access in the Enterprise
  • Remote Endpoint Host-based Analysis
  • Scalable Host-based Analysis (one analyst examining 1,000 systems) and Data Stacking
  • Remote Memory Analysis

Triage and Endpoint Detection and Response (EDR)

  • Endpoint Triage Collection
  • EDR Capabilities and Challenges
  • EDR and Memory Forensics

Memory Acquisition

  • Acquisition of System Memory from both Windows 32/64-bit Systems
  • Hibernation and Pagefile Memory Extraction and Conversion
  • Virtual Machine Memory Acquisition
  • Memory changes in Windows 10
  • Windows 10 Virtual Secure Mode

Memory Forensics Analysis Process for Response and Hunting

  • Understanding Common Windows Services and Processes
  • Identify Rogue Processes
  • Analyze Process DLLs and Handles
  • Review Network Artifacts
  • Look for Evidence of Code Injection
  • Check for Signs of a Rootkit
  • Acquire Suspicious Processes and Drivers

Memory Forensics Examinations

  • Live Memory Forensics
  • Advanced Memory Analysis with Volatility
  • Webshell Detection Via Process Tree Analysis
  • Code Injection, Malware, and Rootkit Hunting in Memory
  • WMI and PowerShell Processes
  • Extract Memory-Resident Adversary Command Lines
  • Investigate Windows Services
  • Hunting Malware Using Comparison Baseline Systems
  • Find and Dump Cached Files from RAM

Memory Analysis Tools

  • Volatility
  • F-Response
  • Velociraptor
  • Comae Windows Memory Toolkit

Students will receive a full six-month license of F-Response Enterprise Edition, enabling them to use their workstation or the SIFT workstation to connect and script actions on hundreds or thousands of systems in the enterprise. This capability is used to benchmark, facilitate, and demonstrate new incident response and threat hunting technologies that enable a responder to look for indicators of compromise across the entire enterprise network in memory and on disk.

FOR508.4: Timeline Analysis


Timeline analysis will change the way you approach digital forensics, threat hunting, and incident response...forever.

Learn advanced incident response and hunting techniques uncovered via timeline analysis directly from the authors who pioneered timeline analysis tradecraft. Temporal data is located everywhere on a computer system. Filesystem modified/access/creation/change times, log files, network data, registry data, and browser history files all contain time data that can be correlated and analyzed to rapidly solve cases. Pioneered by Rob Lee as early as 2001, timeline analysis has grown to become a critical incident response, hunting, and forensics technique. New timeline analysis frameworks provide the means to conduct simultaneous examinations on a multitude of systems across a multitude of forensic artifacts. Analysis that once took days now takes minutes.

This section will step you through two primary methods of building and analyzing timelines used during advanced incident response, threat hunting, and forensic cases. Exercises will show analysts how to create timelines and how to introduce the key analysis methods necessary to help you use those timelines effectively in your cases.

  • Detecting malware defense evasion techniques
  • Using timeline analysis, track adversary activity by hunting an APT group's footprints of malware, lateral movement, and persistence
  • Target hidden and time-stomped malware and utilities that advanced adversaries use to move in the network and maintain their presence
  • Track advanced adversaries' actions second-by-second through in-depth super-timeline analysis
  • Observe how attackers laterally move to other systems in the enterprise by watching a trail left in filesystem times, registry, event logs, shimcache, and other temporal-based artifacts
  • Learn how to filter system artifact, file system, and registry timelines to target the most important data sources efficiently

Malware Defense Evasion and Detection

  • Indicators of Compromise - YARA
  • Entropy and Packing Analysis
  • Executable Anomalies
  • Digital Signature Analysis

Timeline Analysis Overview

  • Timeline Benefits
  • Prerequisite Knowledge
  • Finding the Pivot Point
  • Timeline Context Clues
  • Timeline Analysis Process

Filesystem Timeline Creation and Analysis

  • MACB Meaning by Filesystem
  • Windows Time Rules (File Copy versus File Move)
  • Filesystem Timeline Creation Using Sleuthkit and fls
  • Bodyfile Analysis and Filtering Using the mactime Tool

Super Timeline Creation and Analysis

  • Super Timeline Artifact Rules
  • Program Execution, File Knowledge, File Opening, File Deletion
  • Timeline Creation with log2timeline/Plaso
  • log2timeline/ Plaso Components
  • Filtering the Super Timeline Using psort
  • Targeted Super Timeline Creation
  • Super Timeline Analysis Techniques
  • Scaling Super Timeline Analysis

FOR508.5: Incident Response & Threat Hunting Across the Enterprise | Advanced Adversary & Anti-Forensics Detection


Advanced adversaries are good. We must be better.

Attackers commonly take steps to hide their presence on compromised systems. While some anti-forensics steps can be relatively easy to detect, others are much harder to deal with. As such, it's important that forensic professionals and incident responders are knowledgeable on various aspects of the operating system and file system which can reveal critical residual evidence. In this section, we focus primarily on the file system to recover files, file fragments, and file metadata of interest to the investigation. These trace artifacts can help the analyst uncover deleted logs, attacker tools, malware configuration information, exfiltrated data, and more. This often results in a deeper understanding of the attacker TTPs and provides more threat intelligence for thorough scoping the intrusion. In some cases, these deep-dive techniques could be the only means for proving that an attacker was active on a system of interest.

  • Volume shadow snapshot analysis
  • Timelines across volume shadow snapshots
  • Anti-Forensics analysis using various components of the NTFS filesystem
  • Timestomp checks against suspicious files
  • Advanced data recovery with records carving and deleted volume shadow copy recovery

Volume Shadow Copy Analysis

  • Volume Shadow Copy Service
  • Options for Accessing Historical Data in Volume Snapshots
  • Accessing Shadow Copies with vshadowmount
  • Volume Shadow Copy Timelining

Advanced NTFS Filesystem Tactics

  • NTFS Filesystem Analysis
  • Master File Table (MFT) Critical Areas
  • NTFS System Files
  • NTFS Metadata Attributes
  • Rules of Windows Timestamps for $StdInfo and $Filename
  • Detecting Timestamp Manipulation
  • Resident versus Nonresident Files
  • Alternate Data Streams
  • NTFS Directory Attributes
  • B-Tree Index Overview and Balancing
  • Finding Wiped/Deleted Files using the $I30 indexes
  • Filesystem Flight Recorders: $Logfile and $UsnJrnl
  • Common Activity Patterns in the Journals
  • Useful Filters and Searches in the Journals
  • What Happens When Data Is Deleted from an NTFS Filesystem?

Advanced Evidence Recovery

  • Markers of Common WIpers and Privacy Cleaners
  • Deleted Registry Keys
  • Detecting "Fileless" Malware in the Registry
  • File Carving
  • Volume Shadow Carving
  • Carving for NTFS and Event Log Records
  • Effective String Searching
  • NTFS Configuration Changes to Combat Anti-Forensics

FOR508.6: The APT Threat Group Incident Response Challenge


This incredibly rich and realistic enterprise intrusion exercise is based on a real-world advanced persistent threat (APT) group. It brings together techniques learned earlier in the course and tests your newly acquired skills in an investigation into an attack by an advanced adversary. The challenge brings it all together using a real intrusion into a complete Windows enterprise environment. You will be asked to uncover how the systems were compromised in the initial intrusion, find other compromised systems via adversary lateral movement, and identify intellectual property stolen via data exfiltration. You will walk out of the course with hands-on experience investigating a real attack, curated by a cadre of instructors with decades of experience fighting advanced threats from attackers ranging from nation-states to financial crime syndicates and hacktivist groups.

  • The Intrusion Forensic Challenge will ask each incident response team to analyze multiple systems in an enterprise network with many endpoints.
  • Learn to identify and track attacker actions across an entire network finding initial exploitation, reconnaissance, persistence, credential dumping, lateral movement, elevation to domain administrator, and data theft/exfiltration.
  • Discover evidence of some of the most common and sophisticated attacks in the wild including Cobalt Strike, Metasploit, PowerShell exploit frameworks, and custom nation-state malware.
  • During the challenge, each incident response team will be asked to answer key questions and address critical issues in the different categories listed below, just as they would during a real breach in their organizations:


1. How and when did the APT group breach our network?

2. List all compromised systems by IP address and specific evidence of compromise.

3. When and how did the attackers first laterally move to each system?


4. How and when did the attackers obtain domain administrator credentials?

5. Once on other systems, what did the attackers look for on each system?

6. Find exfiltrated email from executive accounts and perform damage assessment.

7. Determine what was stolen: Recover any attacker archives, find encryption passwords, and extract the contents to verify exfiltrated data.

8. Collect and list all malware used in the attack.

9. Develop and present cyber threat intelligence based on host and network indicators of compromise.


10. What level of account compromise occurred. Is a full password reset required during remediation?

11. Based on the attacker techniques and tools discovered during the incident, what are the recommended steps to remediate and recover from this incident?

a. What systems need to be rebuilt?

b. What IP addresses need to be blocked?

c. What countermeasures should we deploy to slow or stop these attackers if they come back?

d. What recommendations would you make to detect these intruders in our network again?


If you have attended FOR500, you may want to bring your copy of the FOR500 - Windows SIFT Workstation Virtual Machine, as you can use it for the final challenge and for many of the exercises in FOR508.

Bring/install any other forensic tool you feel could be useful (Splunk, EnCase, FTK, etc). For the final challenge at the end of the course, you can utilize any forensic tool to help you and your team perform the analysis, including commercial capabilities. If you have any dongles, licensed software, etc., you are free to use them.

Please do not plan to use the version of the SIFT Workstation downloaded from the Internet. We will provide you with a version specifically configured for the FOR508 materials on Day 1 of the course.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.


FOR508 is an advanced incident response and threat hunting course that focuses on detecting and responding to advanced persistent threats and organized crime threat groups. We do not cover the introduction or basics of incident response, Windows digital forensics, or hacker techniques in this course.

We recommend that you should have a background in FOR500: Windows Forensics prior to attending this course.

Lab Requirements

Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

This is common sense, but we will say it anyway. Back up your system before class. Better yet, do not have any sensitive data stored on the system. SANS can't responsible for your system or data.


  • CPU: 64-bit Intel i5/i7 (4th generation+) - x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)
  • It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.
  • BIOS settings must be set to enable virtualization technology, such as "Intel-VT".

    Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary. Test it!

  • 16 GB (Gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 16 GB of RAM or higher of RAM is mandatory and minimum.
  • USB 3.0 Type-A port is required. At least one open and working USB 3.0 Type-A port is required. (A Type-C to Type-A adapter may be necessary for newer laptops.) (Note: Some endpoint protection software prevents the use of USB devices - test your system with a USB drive before class to ensure you can load the course data.)
  • 350 Gigabytes of Free Space - Note that about 150 GB is required for downloaded evidence files. This data can be stored on an external drive
  • Local Administrator Access is required. This is absolutely required. Don't let your IT team tell you otherwise. If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • Wireless 802.11 Capability


  • Host Operating System: Latest version of Windows 10 or macOS 10.15.x
  • Please note: It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.
  • Note: Apple systems using the M1 processor cannot perform the necessary virtualization at this time and cannot be used for this course.


  1. Download and install VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+ on your system prior to class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website.
  2. Download and install 7Zip (for Windows Hosts) or Keka (macOS).

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.