Incident Response & Malware Analysis
Malware analysis, memory forensics and threat investigation
When an office server shows a ransom note on Monday morning, people need answers fast. How did the attacker get in? What did they take? Is the network clean now? This track trains you to answer those questions from memory dumps, malware samples and system logs, and to do it in a way that stands up later.
The three courses cover the core skills of an incident responder. Memory Forensics shows you what was running on a machine at the moment it was captured. Malware Reverse Engineering teaches you to take a suspicious file apart safely. Ransomware & Threat Response brings it together in a full incident, from first call to recovery and lessons learnt. Practical work happens in the DFRTI Malware and Incident Response Lab, a secure and isolated setup for static and dynamic analysis.
Courses in Incident Response & Malware Analysis
Open a course to see the full syllabus, labs, tools and who it suits.
- 01
Memory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections. - 02
Malware Reverse EngineeringTake malware apart safely with static and dynamic analysis, Ghidra, x64dbg and YARA. - 03
Ransomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.
Need help picking a course in Incident Response & Malware Analysis?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.