Once evidence points to malicious software or an active attack, two skills come together. Malware analysis explains what a sample does, how it behaves on a system, and what traces it leaves behind. Incident response is the structured process for detecting, containing, and recovering from an incident.
You'll learn the main approaches to analysing malware, including static and dynamic analysis, and see a real ransomware family examined through the MITRE ATT&CK framework. You'll also study the incident response lifecycle and how forensic techniques help preserve evidence and find the root cause while an incident is still happening.
Next up is Reporting & Expert Evidence, where you'll learn to present your findings clearly and defend them.
An EC-Council talk on examining the AvosLocker ransomware and the tactics behind it using the MITRE ATT&CK framework.
An explanation of the incident response lifecycle and how security incidents are handled, based on NIST SP 800-61.
How digital forensics fits into incident response, including preserving evidence in real time and analysing malicious artifacts, logs, and network traffic.