Kaspersky

Cybersecurity
Training
Kaspersky Cybersecurity Training
Cybersecurity education is the critical tool for enterprises faced with an increasing volume of constantly
evolving threats. IT Security staff need to be skilled in the advanced techniques that form a key component
of effective enterprise threat management and mitigation strategies.

These courses offer a broad curriculum in cybersecurity topics and techniques and assessment ranging from
basic to expert. All are available either in-class on customer premises or at a local or regional Kaspersky
office, if applicable.

Courses are designed to include both theoretical classes and hands-on ‘labs’. On completion of each course,
attendees will be invited to complete an evaluation to validate their knowledge.

Kaspersky
Cybersecurity Services Service Benefits
Kaspersky
Windows Digital Forensics and Advanced Windows
Threat Intelligence Digital Forensics
Improve the expertise of your in-house digital forensics and incident response team.
Courses are designed to fill experience gaps – developing and enhancing practical skills
in searching for digital cybercrime tracks and in analyzing different types of data for
Kaspersky restoring attack timelines and sources. Having completed the course, students will be
Threat Hunting able to successfully investigate computer incidents and improve the security level of
the business.

Kaspersky Malware Analysis and Reverse Engineering

Cybersecurity Training
and Advanced Malware Analysis and Reverse
Windows Digital Forensics
Malware Analysis and Reverse
Engineering
Engineering
Advanced Windows Digital These courses are intended for security researchers and incident response personnel,
Forensics malware analysts, security engineers, network security analysts, APT hunters and IT security
Advanced Malware Analysis staff. Students will become familiar with the scope of reverse engineering applications,
and Reverse Engineering assembly language, corresponding tools, common techniques used by malware authors
Windows Incident Response to maintain persistence, avoid detection, inject into system processes memory etc.
Efficient Threat Detection The advanced course will cover most of the steps required to analyze a modern APT
with Yara
toolkit, from receiving the initial sample, all the way to producing a deep technical
description with IOCs.

Kaspersky Windows Incident Response

Incident Response
Course will guide your in-house team through all of the stages of the incident response
process and equip them with the comprehensive knowledge needed for successful
incident remediation.
Kaspersky
Security Assessment
Efficient Threat Detection with Yara
Will help to learn how to write the most effective Yara rules, how to test them and improve
them to the point where they find threats that nothing else does.

Hands-On Experience
From a leading security vendor, working and learning alongside our global experts who
inspire participants through their own experience at the ‘sharp end’ of cybercrime
detection and prevention.

1
Program Description

Topics Duration Skills gained

Windows Digital Forensics

Through a real-life simulated cyber targeted attack incident, the course will cover 5 days • Acquiring various digital evidence and dealing with it in
the following topics: forensically sound environment
• Introducing digital forensics • Find traces of incident-related malicious activities from
• Live response and evidence acquisition the Windows OS artifacts
• Post-mortem analysis of Windows machines • Utilizing time stamps from different Windows artifacts
• Windows OS registry internals to reconstruct an incident scenario
• Windows OS events • Finding and analyzing browser and email history
• Windows OS artifacts analysis • Be able be apply the tools and instruments of digital
• Browsers artifacts forensics forensics
• Email analysis • Understating the process of creating a digital forensics lab
• Forensics challenges with SSD disks
• Recommendations when building a digital forensics lab
• Testing the newly gained skills with a practical challenge using different Windows artifacts

Malware Analysis & Reverse Engineering

• Basic analysis using IDA Pro 5 days • Get preliminary knowledge about OS and assembly language
• Dynamic analysis using popular virtualization solutions and debuggers • Conduct static and dynamic malware analysis obtaining
• Malicious documents analysis full understanding of its behavior and functionality
• Unpacking • Deal with malware anti-analysis tricks, self-protective
• Decryption techniques and protection software bypasses
• Shellcodes analysis • Identify and reverse engineer standalone and embedded
• Exploit analysis shellcodes
• Reversing tips and tricks • Be able to analyze PDF exploits from scratch

Advanced Windows Digital Forensics

Through a real-life simulated cyber targeted attack incident, the course will cover 5 days • Conducting deep file system analysis
the following topics: • Identifying and recovering deleted files using different
• Numerical systems techniques
• FAT file system • Analyzing network traffic with different tools
• NTFS file system • Identifying and tracking malicious activities in memory dump
• Deep Windows forensics • Identifying and dumping interesting parts from memory
• Data and file recovery from file system, shadow copies and using file carving for further analysis
• Forensics challenges in Cloud computing • Reconstructing the incident timeline using file system
• Memory forensics timestamps
• Network forensics • Creating one timeline for all Windows OS artifacts
• Timeline vs SuperTimeline analysis for a better understating of the incident scenario
• Testing the newly gained skills with a practical challenge with acquired digital evidence

Advanced Malware Analyisis & Reverse Engineering

• Unpacking 5 days • Be able to analyze a modern APT toolkit, from receiving
• Decryption the initial sample, all the way to producing a technical
• Developing own decryptors for common scenarios description of the attacker’s TTPs with IOCs
• Byte code decompilation • Producing static decryptors for real-life scenarios and then
• Code decomposition continuing with in-depth analysis of the malicious code
• Disassembly • Be able to analyze malicious documents that are typically
• Reconstruction of modern APT architectures used to deliver initial payloads and know how to extract them
• Recognizing typical code constructs • Ensuring damage assessment and incident response
• Identification of cryptographic and compression algorithms efforts are accurate and effective
• Classification and attribution based on code and data
• Class and structure reconstruction
• APT plugin architectures (based on recent APT samples)

Windows Incident Response

• In a real-life simulated environment, an incident will take place and the course will 5 days • Understanding the phases of incident response
cover the following topics on that scenario: • What to consider while responding to a cyber incident
• Introducing the incident response process and its workflow • Understanding various attack techniques and targeted
• Explaining the difference between normal threats and APTs attack anatomy through the Cyber Kill Chain
• Explaining APT Cyber Kill Chain • Responding to different incidents with appropriate actions
• Applying the incident response process to different incident scenarios • The ability to differentiate APTs from other threats
• Applying Cyber Kill Chain on the simulated environment • Confirming cyber incidents using live analysis tools
• Applying live analysis on victim machines for first responders • Understanding the difference between live analysis and
• Forensically sound evidence-acquisition techniques post-mortem - and when to apply each of them
• Introducing post-mortem analysis and digital forensics • Identifying digital evidence; HDD, memory and network
• Introducing memory forensics traffic with an introduction on their forensics analysis
• Log file analysis with regular expressions and ELK • Writing YARA and SNORT IOCs for the detected attack
• Introducing cyber threat intelligence • Log file analysis
• Creating IoCs (Indicators of Compromise), with YARA and SNORT • Understanding the process involved in building an IR team
• Introducing malware analysis and sandboxing
• Introducing network traffic forensics
• Discussing incident analysis reporting and recommendations on building CSIRT
• Testing the newly gained skills with a practical challenge in another simulated scenario

Efficient Threat Detection with Yara

• Brief intro into Yara syntax 2 days • Create effective Yara rules
• Tips & tricks to create fast and effective rules • Test Yara rules
• Yara-generators • Improve them to the point where they find threats
• Testing Yara rules for false positives that nobody else does
• Hunting new undetected samples on VT
• Using external modules within Yara for effective hunting
• Anomaly search
• Lots (!) of real-life examples
• A set of exercises for improving your Yara skills

2
Cyber Threats News: www.securelist.com
IT Security News: business.kaspersky.com
IT Security for SMB: kaspersky.com/business We are proven. We are independent. We are
IT Security for Enterprise: kaspersky.com/enterprise transparent. We are committed to building a safer
world, where technology improves our lives. Which
is why we secure it, so everyone everywhere has the
www.kaspersky.com endless opportunities it brings. Bring on cybersecurity
for a safer tomorrow.
2019 AO Kaspersky Lab. All rights reserved.
Registered trademarks and service marks are the property Know more at kaspersky.com/transparency
of their respective owners.