Focal Point- Windows System Analysis

In this class you will learn:

• Identify the core components of the Windows operating system and ascertain their current state using built-in or other trusted tools
• Analyze a running system and detect abnormal behavior relating to processes, DLLs, network connections, the registry and Windows services
• Use event log analysis to verify and correlate the artifacts of anomalous behavior, and determine the scope of an intrusion
• Use PowerShell to interact with the operating system and build scripts to automate repetitive analytic tasks
• Create and use a system baseline to identify unexpected items such as rogue accounts or configuration changes
• Conduct remote investigations of potentially compromised Windows workstations and servers

Course Outline:

1. OS Overview
2. Processes
3. Dynamic Linked Libraries (DLLs)
4. Network Connections
5. The Registry
6. Services
7. Logs and Timelines
8. PowerShell Basics
9. Querying the Operating System
10. Scripting with PowerShell
11. Baselining with PowerShell
12. Remote Administration

Labs:

1. OS Familiarization
2. Process Explorer Familiarization
3. Process Scenario
4. Inspecting DLLs
5. Memory Mapping
6. Process Injection
7. TCPView and Netstat
8. Registry Familiarization
9. Registry Analysis
10. Analyzing Services

• This is an introductory course ideal for those seeking a career in malware analysis, incident response, or digital forensics.
• Students should be familiar with the general use of Windows systems, including the command line interface, and have at least a basic understanding of TCP/IP networking

• Novice Malware Analysis 
• Incident Response Team Members
• Network Security Professionals
• Forensic Analysis