Malware and ransomware forensics training
Learn to reconstruct a cyberattack, analyse a piece of malware and turn technical evidence into actionable conclusions. Through a realistic ransomware scenario, develop the methods and reflexes needed to investigate a compromise end to end.
OFD-320 · Advanced · 2 days · 10 participants max. · Ransomware scenario + CTF
Why train in malware forensics?
In a compromise, identifying the malware is not enough: you need to understand how it got in, what it ran, how far it spread and which traces support the conclusions. Malware forensics has become a key skill for SOCs, CSIRT teams and threat analysts.
Dive into a realistic ransomware attack and reconstruct each stage of the cyber kill chain. From digital evidence, you will identify the exploitation, lateral movement, privilege escalation and persistence techniques used to compromise the environment.
The course alternates focused input, live demonstrations and gamified workshops on a CTF platform. You will follow the whole investigation process: initial detection, static and dynamic analysis, memory analysis, reverse engineering, identifying evasion mechanisms and writing a well-supported forensic report.
On the programme
- Cyber Kill Chain
- MITRE ATT&CK · TTPs
- Static · dynamic · memory analysis
- IDA · Ghidra · Volatility · Wireshark
What you will be able to put into practice
By the end of the course, you will be able to:
- Identify
and characterise the main types of malware, such as adware, backdoors, ransomware and rootkits, from their behaviour and technical indicators.
- Structure
an investigation with recognised frameworks, drawing on MITRE ATT&CK, TTPs and the principles of threat intelligence.
- Reconstruct
the stages of a cyberattack from logs, file systems, malicious samples and other digital evidence.
- Use
the essential malware analysis and forensic tools, including IDA, Ghidra, Volatility and Wireshark, to examine an unknown program and its execution environment.
- Identify
the main evasion techniques, including anti-debugging and anti-disassembly mechanisms, and understand the approaches used to get round them.
- Produce
an actionable forensic report presenting the method, the facts observed, the indicators identified and the evidence behind the conclusions.
The format in practice
Duration
2 days
Group size
10 max.
10 participants max. per trainer
Format
- Focused input
- Live demonstrations
- Ransomware scenario
- CTF workshops
Prerequisites
- Sound grounding in Windows, Linux and networking
- General cybersecurity knowledge
- Notions of assembly are a plus
Certification
A theory and practical exam of about 1 hour. Certification awarded for a score of at least 2/3
Each participant receives this digital badge in their name, level 3 of 3 in the Offensive & defensive series.
Assessment
- Final forensic investigation
- Reasoned answers
- Assessment of method and command of the tools
Who it is for
- SOC analysts
- CSIRT and CERT teams
- Threat intelligence analysts
- Cybersecurity specialists and advanced students
Methods
- A ransomware scenario as the common thread
- Live demonstrations
- CTF challenges
- Progressive analysis and safe handling of samples
Materials
- Course materials
- Exercises and solutions
- CTF platform
- Preconfigured virtual machines
- Access for 30 days
Practice
- DFIR
- Malware analysis
- Incident response
Other courses you may be interested in
Strengthen your ability to investigate malware
Let's design a course around your teams' experience, the threat scenarios you want to study and the depth you expect in forensic analysis and reverse engineering.