Incident Analysis

This training is a practical Incident Analysis workshop, focusing on Windows systems and a bit traffic analysis with lots of hands on exercises. It is designed for anybody with IT background, willing to learn some of the essential steps during an incident analysis. This is not an advanced class, but more of an incident analysis 101 with a steep learning curve. Topics such as incident handling and incident response will not be part of this course.

During this course you will (hopefully ;-) ) learn a lot about windows/malware internals, and how to:

Identify Indicators of Compromise
Analyze network traffic for suspicious behavior
Investigate disk images
Analyze memory dumps with volatility
Differentiate malware from harmless software
Analyze malware (behavior)
Corelate gathered logfiles to a specific incident

The language of this course depends on the attendees: if only Germans attend the training, it will be done in Deutsch, otherwise the training will be done in English.

Prerequisites

TCP/IP Knowledge
Be familiar with a shell

Good to have, but not necessary:

Experience with at least one programming language
Basic knowledge about hacking techniques

Requirements

A laptop with administrative privileges and pre-installed VirtualBox
Wireshark usage

About the Speakers

Andreas Dewald

Dr.-Ing. Andreas Dewald is working as an IT-Security Researcher at ERNW Research GmbH in Heidelberg and is an associated Post-Doc of the University of Erlangen-Nuremberg (FAU), where he worked as a researcher and lecturer from 2012 to January 2016 at the Chair for IT-Security Infrastructures. From 2013 to 2016, he led the Applied Forensic Computing research group after he finished his PhD in December 2012. Supervised by Prof. Dr.-Ing. Felix Freiling, his thesis was about the formalization of digital evidence and its embedding in forensic computing. Until October 2013, Andreas Dewald, from the FAU side, mentored the first German master’s degree program in Digital Forensics, which is run as a cooperation by the University of Applied Sciences in Albstadt-Sigmaringen. From 2009 to 2012, he worked as a research assistant at the University of Mannheim, where he had previously studied Computer Science. For his master’s thesis “Detection and Prevention of Malicious Websites” Andreas Dewald was awarded with the science prize from the German society for privacy and data security (GDD).