13 modules
Incident Response and Threat Hunting
One fictional company, Ashgrove Mutual, a regional insurer with about 40 Windows hosts, and one enterprise intrusion followed from the first alert to the board briefing. The attacker lands on a claims-adjuster workstation, steals credentials, moves to the file server and a jump host, stages data, clears logs, and comes back after a reboot. Every module is one decision point in that investigation. The order is the order a responder meets the evidence, not any vendor's section order.
- Who it is for
- incident responders, threat hunters, SOC analysts moving from alerts to investigations, and examiners who finished the Windows Forensic Examiner path or have equivalent experience.
- Prerequisites
- Windows artifacts and timeline basics at the level of Appendix A modules 02 through 04 and 09.
- Time
- 13 modules, 3 to 5 hours each, planning estimate; the memory modules run long.
- Status
- First modules: launch date to be announced. Module 00 is free on release.
Thirteen modules. Evidence you can defend.
Each module opens on a case question and ends in a deliverable. On smaller screens, scroll the tables horizontally to read every column.
| # | Module | Opens on | You build | Lab on SIFT | Hours | Status |
|---|---|---|---|---|---|---|
| 00 | The alert at 06:10 | The MSSP reports a claims workstation beaconed to a known-bad host overnight; the desktop team wants to reimage it by noon | A first-hour plan: what to preserve in what order, who to notify, the five questions the investigation must answer | Yes: Ashgrove Mutual synthetic set. Confirm the beacon in the proxy and DNS logs; open the case log; hold the reimage | 3 to 5, planning estimate | Free (on release) |
| 01 | Baseline the host before you judge it | The junior analyst flags 14 suspicious processes; 13 are normal Windows | A normal-Windows reference: expected parents, paths, accounts, instance counts, and the tests that separate odd from malicious | Yes: Ashgrove Mutual synthetic set. Compare live-response output from a clean Ashgrove workstation against the alerting one; mark the one real outlier | 3 to 5, planning estimate | Planned |
| 02 | Capture memory before it is gone | The host is still running; every hour of delay loses volatile evidence | An acquisition record: memory first, then triage disk, hashes, tool versions, and what was lost by waiting | Yes: Ashgrove Mutual synthetic set. Acquire memory from a lab VM, verify it, run a targeted disk collection, document the chain | 3 to 5, planning estimate | Planned |
| 03 | Read the memory image: what is running | The first memory image is in | A process tree and connection map with the beaconing process identified and its parent explained | Yes: Ashgrove Mutual synthetic set. Processes, parents, command lines, handles, loaded DLLs and network connections from the claims workstation image | 3 to 5, planning estimate | Planned |
| 04 | Read the memory image: what is hiding | The beaconing process has no matching file on disk | A malicious-code report: injection technique, affected process, dumped payload with hash, extracted indicators | Yes: Ashgrove Mutual synthetic set. Detect injected and hollowed regions, dump them, pull strings and indicators, scan with YARA, build the indicator list | 3 to 5, planning estimate | Planned |
| 05 | Scope the enterprise fast | Forty hosts; management wants the affected count by end of day | A scoping plan and a results table: which hosts carry the indicators, which accounts were used, where the attacker went next | Yes: Ashgrove Mutual synthetic set. Sweep the 40-host telemetry set; trace lateral movement through logon events, remote-execution artifacts and admin-share use | 3 to 5, planning estimate | Planned |
| 06 | Build the first timeline | Three hosts confirmed; counsel asks when it started | A file-system timeline of the claims workstation with the initial-access window bracketed | Yes: Ashgrove Mutual synthetic set. Create and filter a file-system timeline from the MFT and related metadata; find the dropped files around the beacon time | 3 to 5, planning estimate | Planned |
| 07 | The super timeline, and how to read it | The file-system timeline shows what appeared, not why | A combined timeline (file system, registry, event logs, browser, prefetch) and a filtering method that gets a million rows down to a hundred | Yes: Ashgrove Mutual synthetic set. Build a super timeline with plaso; pivot on the initial-access window; narrate the first hour of the intrusion | 3 to 5, planning estimate | Planned |
| 08 | NTFS under the hood | A file in the timeline carries timestamps older than the OS install | An NTFS findings memo: MFT attributes, the two timestamp sets, USN journal, $LogFile, alternate data streams, and what the anomaly proves | Yes: Ashgrove Mutual synthetic set. Parse the file server MFT and journals; prove timestomping; recover the deleted stager and its metadata | 3 to 5, planning estimate | Planned |
| 09 | Execution, persistence and the account behind it | The attacker came back after the day-3 reboot | A persistence and execution report: scheduled tasks, services, run keys, WMI subscriptions, each with the account and time that created it | Yes: Ashgrove Mutual synthetic set. Registry, event logs, prefetch, Amcache, Shimcache and scheduled-task artifacts across the three disk images | 3 to 5, planning estimate | Planned |
| 10 | Anti-forensics and what survives | The security log was cleared and the tools folder deleted on the file server | A recovery report: what was deleted, when, and the artifact that proves each item | Yes: Ashgrove Mutual synthetic set. Recover evidence from the USN journal, $LogFile, shadow copies, prefetch and SRUM after log clearing and deletion | 3 to 5, planning estimate | Planned |
| 11 | Hunt the next host | Everything so far was reactive; which host did the attacker touch that never alerted | A hunt plan with hypotheses drawn from the intrusion's known behavior, and a results sheet | Yes: Ashgrove Mutual synthetic set. Baseline-versus-outlier hunting across the 40-host telemetry and the remaining memory images; find the fourth host | 3 to 5, planning estimate | Planned |
| 12 | Tell the intrusion story | The board meets Thursday, the regulator wants a notification decision, and the insurer's own lawyers want facts | The full intrusion report (summary, timeline, techniques, systems and data affected, containment, lessons) and a ten-minute briefing | Yes: Ashgrove Mutual synthetic set. Assemble from earlier labs; peer review against a checklist; deliver the briefing to a second learner playing the general counsel | 3 to 5, planning estimate | Planned |
Labs on SIFT.
The curriculum specifies the Ashgrove Mutual synthetic set (four memory images: claims workstation, file server, jump host, domain controller; three disk images; host telemetry and Windows event logs for all 40 hosts; proxy and DNS logs), generated for DFIR.com and versioned. Evidence downloads will accompany released modules.
Install SIFTPlanned access: module 00 free; subscription $149 per month or $1,290 per year. No payment is being collected here.
Last reviewed . Curriculum source: Appendix B supplied by DFIR.com. Contribute a module.
Hear when the first modules open.
One email when there is something to learn from. No payment, nothing to buy.
Last reviewed