FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics (New)

Provided by

Enquire about this course

About the course

Cyber Security Training in London 2019
SANS is recognised around the world as the best place to develop the deep, hands-on cyber security skills most needed right now. Join us for SANS London February (February 11-16 at the Grand Connaught Rooms) for immersion training that will provide you with the skills to defend your organisation against security breaches and prevent future attacks.

“I get to connect with industry peers and gain a deeper understanding about what I do any why it is important. More tools for the tool belt.” - Thomas Dowling, Rackspace

Spotlight course:
All SANS courses are world-class cyber security courses, but every event we like to choose a course and ask the instructors to give a bit more insight into the course.

Take advantage of these opportunities to get the most of your training:

  • Distinguish yourself as an information security leader by preparing for your GIAC Certification.
  • Network with like-minded security professionals facing similar challenges.
  • Attend evening bonus sessions led by SANS instructors and gain insight into the latest cyber security topics.
  • Extend your SANS course by four months with an OnDemand Bundle.

Our mission at SANS is to deliver cutting-edge information security knowledge and skills to all students in order to protect people and assets. At the heart of everything we do is the SANS Promise: Students will be able to use the new skills they have learned as soon as they return to work. See that promise in action at SANS London February 2019.

“SANS provides you with trainers who have real-world experience. They are actively participating in investigations and providing up-to-date research on current trends.” - Leo Sanchez, Tetra Pak

To follow or tweet about this event, use the hashtag #SANSLondon. Follow SANS at:

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics New
Mon, February 11 - Sat, February 16, 2019

Contents | Additional Info
Instructor: Alissa Torres
Cost: 6,275 EUR
GCFA Certification
Affiliate Pricing
36 CPEs
Laptop Required
Masters Program
DoDD 8140
(CNDSP Incident Responder)
Cyber Guardian

Great course! This not only helps me in forensics but also in creating use-cases for our other intrusion analysis tools.

Joseph Murray, Deloitte

My SOC focuses a lot on incident response and quick forensics, so the course material is extremely valuable.



FOR508: Advanced Incident Response and Threat Hunting Course will help you to:


  • Detect how and when a breach occurred
  • Identify compromised and affected systems
  • Perform damage assessments and determine what was stolen or changed
  • Contain and remediate incidents
  • Develop key sources of threat intelligence
  • Hunt down additional breaches using knowledge of the adversary

DAY 0: A 3-letter government agency contacts you to say an advanced threat group is targeting organizations like yours, and that your organization is likely a target. They won't tell how they know, but they suspect that there are already several breached systems within your enterprise. An advanced persistent threat, aka an APT, is likely involved. This is the most sophisticated threat that you are likely to face in your efforts to defend your systems and data, and these adversaries may have been actively rummaging through your network undetected for months or even years.

This is a hypothetical situation, but the chances are very high that hidden threats already exist inside your organization's networks. Organizations can't afford to believe that their security measures are perfect and impenetrable, no matter how thorough their security precautions might be. Prevention systems alone are insufficient to counter focused human adversaries who know how to get around most security and monitoring tools.

The key is to constantly look for attacks that get past security systems, and to catch intrusions in progress, rather than after attackers have completed their objectives and done significant damage to the organization. For the incident responder, this process is known as "threat hunting". Threat hunting uses known adversary behaviors to proactively examine the network and endpoints in order to identify new data breaches.

Threat hunting and Incident response tactics and procedures have evolved rapidly over the past several years. Your team can no longer afford to use antiquated incident response and threat hunting techniques that fail to properly identify compromised systems, provide ineffective containment of the breach, and ultimately fail to rapidly remediate the incident. Incident response and threat hunting teams are the keys to identifying and observing malware indicators and patterns of activity in order to generate accurate threat intelligence that can be used to detect current and future intrusions.

This in-depth incident response and threat hunting course provides responders and threat hunting teams with advanced skills to hunt down, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hactivists. Constantly updated, FOR508: Advanced Incident Response and Threat Hunting addresses today's incidents by providing hands-on incident response and threat hunting tactics and techniques that elite responders and hunters are successfully using to detect, counter, and respond to real-world breach cases.

The course uses a hands-on enterprise intrusion lab -- modeled after a real-world targeted APT attack on an enterprise network and based on APT group tactics to target a network -- to lead you to challenges and solutions via extensive use of the SIFT Workstation and best-of-breed investigative tools.

During the intrusion and threat hunting lab exercises, you will identify where the initial targeted attack occurred and how the adversary is moving laterally through multiple compromised systems. You will also extract and create crucial cyber threat intelligence that can help you properly scope the compromise and detect future breaches.

During a targeted attack, an organization needs the best incident response team in the field. FOR508: Advanced Incident Response and Threat Hunting will train you and your team to respond, detect, scope, and stop intrusions and data breaches.



FOR508 Course Topics

  • Advanced use of a wide range of best-of-breed open-source tools and the SIFT Workstation to perform incident response and digital forensics.
  • Hunting and responding to advanced adversaries such as nation-state actors, organized crime, and hacktivists.
  • Threat hunting techniques that will aid in quicker identification of breaches.
  • Rapid incident response analysis and breach assessment.
  • Incident response and intrusion forensics methodology.
  • Remote and enterprise incident response system analysis.
  • Windows live incident response and scaling collection of triage data.
  • Investigating and countering living of the land attacks, including PowerShell and WMI.
  • Memory analysis during incident response and threat hunting.
  • Transitioning memory analysis skills to enterprise detection and response (EDR) platforms
  • Detailed instruction on compromise and protection of Windows enterprise credentials.
  • Internal lateral movement analysis and detection.
  • Rapid and deep-dive timeline creation and analysis.
  • Volume shadow copy exploitation for hunting threats and incident response.
  • Detection of anti-forensics and adversary hiding techniques.
  • Discovery of unknown malware on a system.
  • Adversary threat intelligence development, indicators of compromise, and usage.
  • Cyber-kill chain strategies.
  • Step-by-step tactics and procedures to respond to and investigate intrusion cases

Course Syllabus
  FOR508.1: Advanced Incident Response & Threat Hunting
  FOR508.2: Intrusion Analysis
  FOR508.3: Memory Forensics in Incident Response & Threat Hunting
  FOR508.4: Timeline Analysis
  FOR508.5: Incident Response & Hunting Across the Enterprise | Advanced Adversary & Anti-Forensics Detection
  FOR508.6: The APT Threat Group Incident Response Challenge


Statements From Our Authors
"In describing the advanced persistent threat (APT) and advanced adversaries, many experts have said, 'There are people smarter than you, who have more resources than you, and who are coming for you. Good luck with that.' They were not joking. The results over the past several years clearly indicate that hackers employed by nation-states and organized crime are racking up success after success. The APT has compromised hundreds of organizations. Organized crime organizations using botnets are exploiting Automated Clearing House (ACH) fraud daily. Similar groups are penetrating banks and merchants, stealing credit card data. Fortune 500 companies are beginning to detail data breaches and hacks in their annual stockholder reports.

"In other words, the enemy is getting better and bolder, and their success rate is impressive.

"We can stop them, but to do so, we need to field more sophisticated incident responders and digital forensics investigators. We need lethal digital forensics experts who can detect and eradicate advanced threats immediately. A properly trained incident responder could be the only defense your organization has left during a compromise. Forensics 508: Advanced Digital Forensics, Incident Response, and Threat Hunting is crucial training for you to become the lethal forensicator who can step up to these advanced threats. The enemy is good. We are better. This course will help you become one of the best."

- Rob Lee

"We live in a world of unimaginable amounts of data stored on immensely large and complicated networks. Our adversaries use this complexity against us to slice through our defenses and take virtually anything they want, anytime they want it. While this is our current state, it will not be our future. Incident response is at an inflection point. Old models are being upgraded to make defenders more effective and nimble in response to more sophisticated and aggressive attackers. The most successful incident response teams are evolving rapidly due to near-daily interaction with adversaries. New tools and techniques are being developed, providing better visibility and making the network more defensible. There are an increasing number of success stories, with organizations quickly identifying intrusions and rapidly remediating them.

We created this course to build upon those successes. Like the field itself, the course is continuously updated, bringing the latest advances into the classroom. Whether you are just moving into the incident response field or are already leading hunt teams, FOR508 facilitates learning from others' experiences and develops the necessary skills to take you to the next level."

- Chad Tilbury



Start date Location / delivery
08 Jul 2019 London
23 Sep 2019 London

Related article

As we become more reliant on digital technologies, the cyber security industry has grown in order to protect organisations against online attacks. ...