FOR508 Advanced Incident Response, Threat Hunting, and Digital Forensics


hide_responciveBundle AddonPriceAdd to Cart
Sans October Exam BundleSGD$1,272.23
Sans October Netwars BundleSGD$2,247.00
Sans October OnDemand BundleSGD$1,272.23

GIAC Certified Forensic Analyst (GCFA)

GIAC Certified Forensic Analyst (GCFA)

What You Will Learn


FOR508: Advanced Incident Response and Threat Hunting Course will help you to:

  • Detect how and when a breach occurred
  • Identify compromised and affected systems
  • Perform damage assessments and determine what was stolen or changed
  • Contain and remediate incidents
  • Develop key sources of threat intelligence
  • Hunt down additional breaches using knowledge of the adversary

DAY 0: A 3-letter government agency contacts you to say an advanced threat group is targeting organizations like yours, and that your organization is likely a target. They won’t tell how they know, but they suspect that there are already several breached systems within your enterprise. An advanced persistent threat, aka an APT, is likely involved. This is the most sophisticated threat that you are likely to face in your efforts to defend your systems and data, and these adversaries may have been actively rummaging through your network undetected for months or even years.

This is a hypothetical situation, but the chances are very high that hidden threats already exist inside your organization’s networks. Organizations can’t afford to believe that their security measures are perfect and impenetrable, no matter how thorough their security precautions might be. Prevention systems alone are insufficient to counter focused human adversaries who know how to get around most security and monitoring tools.

The key is to constantly look for attacks that get past security systems, and to catch intrusions in progress, rather than after attackers have completed their objectives and done significant damage to the organization. For the incident responder, this process is known as “threat hunting”. Threat hunting uses known adversary behaviors to proactively examine the network and endpoints in order to identify new data breaches.

Threat hunting and Incident response tactics and procedures have evolved rapidly over the past several years. Your team can no longer afford to use antiquated incident response and threat hunting techniques that fail to properly identify compromised systems, provide ineffective containment of the breach, and ultimately fail to rapidly remediate the incident. Incident response and threat hunting teams are the keys to identifying and observing malware indicators and patterns of activity in order to generate accurate threat intelligence that can be used to detect current and future intrusions.

This in-depth incident response and threat hunting course provides responders and threat hunting teams with advanced skills to hunt down, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hacktivists. Constantly updated, FOR508: Advanced Incident Response and Threat Hunting addresses today’s incidents by providing hands-on incident response and threat hunting tactics and techniques that elite responders and hunters are successfully using to detect, counter, and respond to real-world breach cases.

The course uses a hands-on enterprise intrusion lab — modeled after a real-world targeted APT attack on an enterprise network and based on APT group tactics to target a network — to lead you to challenges and solutions via extensive use of the SIFT Workstation and best-of-breed investigative tools.

During the intrusion and threat hunting lab exercises, you will identify where the initial targeted attack occurred and how the adversary is moving laterally through multiple compromised systems. You will also extract and create crucial cyber threat intelligence that can help you properly scope the compromise and detect future breaches.

During a targeted attack, an organization needs the best incident response team in the field. FOR508: Advanced Incident Response and Threat Hunting will train you and your team to respond, detect, scope, and stop intrusions and data breaches.


FOR508 Course Topics

  • Advanced use of a wide range of best-of-breed open-source tools and the SIFT Workstation to perform incident response and digital forensics.
  • Hunting and responding to advanced adversaries such as nation-state actors, organized crime, and hacktivists.
  • Threat hunting techniques that will aid in quicker identification of breaches.
  • Rapid incident response analysis and breach assessment.
  • Incident response and intrusion forensics methodology.
  • Remote and enterprise incident response system analysis.
  • Windows live incident response and scaling collection of triage data.
  • Investigating and countering living of the land attacks, including PowerShell and WMI.
  • Memory analysis during incident response and threat hunting.
  • Transitioning memory analysis skills to enterprise detection and response (EDR) platforms
  • Detailed instruction on compromise and protection of Windows enterprise credentials.
  • Internal lateral movement analysis and detection.
  • Rapid and deep-dive timeline creation and analysis.
  • Volume shadow copy exploitation for hunting threats and incident response.
  • Detection of anti-forensics and adversary hiding techniques.
  • Discovery of unknown malware on a system.
  • Adversary threat intelligence development, indicators of compromise, and usage.
  • Cyber-kill chain strategies.
  • Step-by-step tactics and procedures to respond to and investigate intrusion cases

Hands-On Training

One of the biggest complaints you hear in the threat hunting and incident response community is the lack of realistic intrusion data. Most real-world intrusion data are simply too sensitive to be shared.

The FOR508 course authors created a realistic scenario based on experiences surveyed from a panel of responders who regularly combat targeted APT attacks. They helped review and guide the targeted attack “script” used to create the scenario. The result is an incredibly rich and realistic attack scenario across multiple enterprise systems. This APT attack lab forms the basis for training during the week. The network was set up to mimic a standard “protected” enterprise network using standard compliance checklists:

  • Full auditing turned on per recommended Federal Information Security Management Act guidelines
  • Windows domain controller (DC) set up and configured; DC hardened similarly to what is seen in real enterprise networks
  • Systems installed with the real software on them that is used (Office, Adobe, Skype, Tweetdeck, Email, Dropbox, Firefox, Chrome)
  • Fully patched systems (patches are automatically installed)
  • Endpoint Detection and Response (EDR) agents
  • Enterprise A/V and on-scan capability based on the Department of Defense’s Host-based Security System
    • Endpoint Protection Software – Anti-virus, Anti-spyware, Safe surfing, Anti-spam, Device Control, Onsite Management, Host Intrusion Prevention (HIPS)
  • Firewall only allows inbound port 25 and outbound ports 25, 80, 443

This exercise and challenge are used to show real adversary traces across host systems, system memory, hibernation/pagefiles, and more:

  • Phase 1 – Patient zero compromise and malware C2 beacon installation
  • Phase 2 – Privilege escalation, lateral movement to other systems, malware utilities download, installation of additional beacons, and obtaining domain admin credentials
  • Phase 3 – Search for intellectual property, profile network, dump email, dump enterprise hashes
  • Phase 4 – Collect data to exfiltrate and copy to staging system. Archive data using .rar and a complex passphrase
  • Phase 5 – Exfiltrate .rar files from staging server, perform cleanup on staging server

You Will Be Able To

  • Learn and master the tools, techniques, and procedures necessary to effectively hunt, detect, and contain a variety of adversaries and to remediate incidents.
  • Detect and hunt unknown live, dormant, and custom malware in memory across multiple Windows systems in an enterprise environment.
  • Hunt through and perform incident response across hundreds of unique systems simultaneously using PowerShell or F-Response Enterprise and the SIFT Workstation.
  • Identify and track malware beaconing outbound to its command and control (C2) channel via memory forensics, registry analysis, and network connection residue.
  • Determine how the breach occurred by identifying the beachhead and initial attack mechanisms.
  • Identify living of the land techniques, inluduing malicious use of PowerShell and WMI.
  • Target advanced adversary anti-forensics techniques like hidden and time-stomped malware, along with utility-ware used to move in the network and maintain an attacker’s presence.
  • Use memory analysis, incident response, and threat hunting tools in the SIFT Workstation to detect hidden processes, malware, attacker command lines, rootkits, network connections, and more.
  • Track user and attacker activity second-by-second on the system you are analyzing through in-depth timeline and super-timeline analysis.
  • Recover data cleared using anti-forensics techniques via Volume Shadow Copy and Restore Point analysis.
  • Identify lateral movement and pivots within your enterprise across your endpoints, showing how attackers transition from system to system without detection.
  • Understand how the attacker can acquire legitimate credentials – including domain administrator rights – even in a locked-down environment.
  • Track data movement as the attackers collect critical data and shift them to exfiltration collection points.
  • Recover and analyze archives and .rar files used by APT-like attackers to exfiltrate sensitive data from the enterprise network.
  • Use collected data to perform effective remediation across the entire enterprise.

What You Will Receive

  • SIFT Workstation
    • This course extensively uses the SIFT Workstation to teach incident responders and forensic analysts how to respond to and investigate sophisticated attacks.
    • The SIFT Workstation contains hundreds of free and open-source tools, easily matching any modern forensic and incident response commercial response tool suite.
    • A virtual machine is used with many of the hands-on class exercises.
    • Ubuntu Linux LTS Base.
    • 64-bit base system.
    • Better memory utilization.
    • Auto-DFIR package update and customizations.
    • Latest forensics tools and techniques.
    • VMware Appliance ready to tackle forensics.
    • Cross-compatibility between Linux and Windows.
    • Expanded file system support (NTFS, HFS, EXFAT, and more).

  • F-Response Enterprise (Endpoint Collection Capability)
    • Enables incident responders to access remote systems and physical memory of a remote computer via the network.
    • Gives any incident response or forensics tool the capability to be used across the enterprise.
    • Perfect for intrusion investigations and data breach incident response situations.
    • Deployable agent to remote systems.
    • SIFT Workstation compatible.
    • Vendor neutral – works with just about any tool.
    • Number of simultaneous examiners = unlimited.
    • Number of simultaneous agents deployed = unlimited.
    • The six-month license allows F-Response Enterprise to continue to be used and benchmarked in your environment at work/home.

  • Electronic Download Package containing:
    • APT case images, memory captures, SIFT Workstation 3, tools, and documentation.
    • SANS DFIR APT Case Electroninc Exercise Workbook
    • Electronic Exercise book is over 250 pages long with detailed step-by-step instructions and examples to help you become a master incident responder.

  • SANS DFIR Cheatsheets to Help Use the Tools in the Field

GIAC Certified Forensic Analyst

“…The enemy is getting better and bolder, and their success rate is impressive. “We can stop them, but to do so, we need to field more sophisticated incident responders and digital forensics investigators. We need lethal digital forensics experts who can detect and eradicate advanced threats immediately. A properly trained incident responder could be the only defense your organization has left during a compromise. Forensics 508: Advanced Digital Forensics, Incident Response, and Threat Hunting is crucial training for you to become the lethal forensicator who can step up to these advanced threats. The enemy is good. We are better. This course will help you become one of the best.” – Rob Lee, Course Author

The GCFA certifies that candidates have the knowledge, skills, and ability to conduct formal incident investigations and handle advanced incident handling scenarios, including internal and external data breach intrusions, advanced persistent threats, anti-forensic techniques used by attackers, and complex digital forensic cases. The GCFA certification focuses on core skills required to collect and analyze data from Windows and Linux computer systems.

  • Advanced Incident Response and Digital Forensics
  • Memory Forensics, Timeline Analysis, and Anti-Forensics Detection
  • Threat Hunting and APT Intrusion Incident Response



FOR508 is an advanced incident response and threat hunting course that focuses on detecting and responding to advanced persistent threats and organized crime threat groups. We do not cover the introduction or basics of incident response, Windows digital forensics, or hacker techniques in this course.

We recommend that you should have a background in FOR500: Windows Forensics prior to attending this course.

Laptop Requirements

Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

This is common sense, but we will say it anyway. Back up your system before class. Better yet, do not have any sensitive data stored on the system. SANS can’t responsible for your system or data.


  • CPU: 64-bit Intel i5/i7 (4th generation+) – x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class (Important – Please Read: a 64-bit system processor is mandatory)
  • It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.
  • BIOS settings must be set to enable virtualization technology, such as “Intel-VT”.

    Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary. Test it!

  • 16 GB (Gigabytes) of RAM or higher is mandatory for this class (Important – Please Read: 16 GB of RAM or higher of RAM is mandatory and minimum.
  • USB 3.0 Type-A port is required. At least one open and working USB 3.0 Type-A port is required. (A Type-C to Type-A adapter may be necessary for newer laptops.) (Note: Some endpoint protection software prevents the use of USB devices – test your system with a USB drive before class to ensure you can load the course data.)
  • 350 Gigabytes of Free Space – Note that about 150 GB is required for downloaded evidence files. This data can be stored on an external drive
  • Local Administrator Access is required. This is absolutely required. Don’t let your IT team tell you otherwise. If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • Wireless 802.11 Capability


  • Host Operating System: Latest version of Windows 10 or macOS 10.15.x
  • Please note: It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.
  • Note: Apple systems using the M1 processor cannot perform the necessary virtualization at this time and cannot be used for this course.


  1. Download and install VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+ on your system prior to class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website.
  2. Download and install 7Zip (for Windows Hosts) or Keka (macOS).

Your course media will now be delivered via download. The media files for class can be large, some in the 40 – 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

Author Statement

“In describing the advanced persistent threat (APT) and advanced adversaries, many experts have said, ‘There are people smarter than you, who have more resources than you, and who are coming for you. Good luck with that.’ They were not joking. The results over the past several years clearly indicate that hackers employed by nation-states and organized crime are racking up success after success. The APT has compromised hundreds of organizations. Organized crime organizations using botnets are exploiting Automated Clearing House (ACH) fraud daily. Similar groups are penetrating banks and merchants, stealing credit card data. Fortune 500 companies are beginning to detail data breaches and hacks in their annual stockholder reports.

“In other words, the enemy is getting better and bolder, and their success rate is impressive.

“We can stop them, but to do so, we need to field more sophisticated incident responders and digital forensics investigators. We need lethal digital forensics experts who can detect and eradicate advanced threats immediately. A properly trained incident responder could be the only defense your organization has left during a compromise. Forensics 508: Advanced Digital Forensics, Incident Response, and Threat Hunting is crucial training for you to become the lethal forensicator who can step up to these advanced threats. The enemy is good. We are better. This course will help you become one of the best.”

– Rob Lee

“We live in a world of unimaginable amounts of data stored on immensely large and complicated networks. Our adversaries use this complexity against us to slice through our defenses and take virtually anything they want, anytime they want it. While this is our current state, it will not be our future. Incident response is at an inflection point. Old models are being upgraded to make defenders more effective and nimble in response to more sophisticated and aggressive attackers. The most successful incident response teams are evolving rapidly due to near-daily interaction with adversaries. New tools and techniques are being developed, providing better visibility and making the network more defensible. There are an increasing number of success stories, with organizations quickly identifying intrusions and rapidly remediating them.

We created this course to build upon those successes. Like the field itself, the course is continuously updated, bringing the latest advances into the classroom. Whether you are just moving into the incident response field or are already leading hunt teams, FOR508 facilitates learning from others’ experiences and develops the necessary skills to take you to the next level.”

– Chad Tilbury