Name & Affiliate Link*: Malware Analyst Professional – Level 2

Platform: TrainSec

Course Instructor: Uriel Kosayev

Cost: $350

Proof of Completion: Certification of Completion

Community/Forum: There is a Discord community

Topics Include:

• Intro to Reverse Engineering
• Bitwise Operations
• Understanding Windows API Functions
• Introduction to Code Injections
• Process Injection Classifications
• Process Hollowing
• Introduction to Anti-Analysis
• Anti-Debugging
• Anti-VM
• Anti-AV
• Introduction to Packers and the Unpacking Process
• Manual Unpacking
• Introduction to Shellcode Analysis
• Shellcode Reverse Engineering
• Ransomware Reverse Engineering
• Reverse Engineering .NET Malware

*DFIR Diva is an affiliate of TrainSec and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Affiliate Link*: MAoS – Malware Analysis on Steroids Bundle

Platform: TrainSec

Course Instructor: Uriel Kosayev

Cost: $700

Proof of Completion: Certification of Completion

Community/Forum: There is a Discord community

Topics Include:

• Malware Analyst Professional – Level 1
  • Lab Setup
  • Deploying Flare-VM
  • Connecting to INetSim
  • Introduction to Code Reverse Engineering
  • Installing Visual Studio
  • Basic C Code
  • Basic Reverse Engineering
  • The PE Structure
  • Static Malware Analysis
  • Identifying File Types
  • Strings Extraction
  • Identifying Malicious Functionality
  • Packing Analysis
  • Dynamic Malware Analysis
  • Working with Process Explorer
  • Extracting IoC’s using Process Hacker
  • Working with Procmon
  • Monitoring WinAPI Functions using API Logger
  • Inspecting Process Command Line Line Parameters using CMD Watcher
  • Debugging DLL Files with IDA Disassembler
  • Malicious Documents Analysis
  • Analyzing Malicious PDF Files
  • Analyzing VBA Macros
  • YARA Rule Examples
• Malware Analyst Professional – Level 2
  • Intro to Reverse Engineering
  • Bitwise Operations
  • Understanding Windows API Functions
  • Introduction to Code Injections
  • Process Injection Classifications
  • Process Hollowing
  • Introduction to Anti-Analysis
  • Anti-Debugging
  • Anti-VM
  • Anti-AV
  • Introduction to Packers and the Unpacking Process
  • Manual Unpacking
  • Introduction to Shellcode Analysis
  • Shellcode Reverse Engineering
  • Ransomware Reverse Engineering
  • Reverse Engineering .NET Malware

*DFIR Diva is an affiliate of TrainSec and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Affiliate Link*: Analyst I: Practical Windows Forensic Analyst (PWFA)

Platform: Blue Cape Security

Cost: $697

Payment Plan: Available at checkout via PayPal financing

Exam Type: Hands-On (2 attempts)

Certification Information: Includes Digital Certificate, Digital Badge, and a challenge coin for those scoring 85% or higher. The certification does not expire.

Training & Practice Included:

• 201 Practical Windows Forensics Course with Online Labs
  • Forensic Process & Forensic Reporting
  • Data Collection & Data Examination
  • Windows Registry & User Behavior Analysis
  • Event Log Analysis, Memory Analysis, & Super Timeline Creation
  • File System Analysis & Master File Table (MFT)
  • Timestomping, Deleted Files, Program Execution, & Persistence Mechanism
• FOR200: Investigation Scenarios
  • 4 lab-based forensic scenarios
  • Disk + memory images, case briefs, and investigation objectives
  • Preloaded lab VMs with forensic evidence
  • Scenario Solution Video Walkthroughs
  • Case Summaries and Timeline Analysis Reports
  • Certificates of Completion (Up to 12 CPE hours)
  • Incident Timeline (.xlsx)
  • PWF Report (.docx)
  • Analysis Notes (.docx)

*DFIR Diva is an affiliate of Blue Cape Security and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Affiliate Link*: Practical OSINT Research Professional (PORP)

Platform: TCM Security

Price: $249 (includes training and exam voucher that doesn’t expire)

Student Discount: Students, Veterans, Teachers and First Responders can get a 20% discount.

Exam Type: Practical Hands-On

Topics:

• Effective Notekeeping
• Creating Sock Puppet Accounts
• Basic and Advanced Search Engine OSINT
• Image OSINT
• Email Address, Phone Number, and Breached Data OSINT
• People OSINT
• Username and Social Media OSINT
• Wireless Network OSINT
• OSINT with Tools
• Automating OSINT
• Report Writing

*DFIR Diva is an affiliate of TCM Security and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Affiliate Link*: Malware Analyst Professional – Level 1

Platform: TrainSec

Course Instructor: Uriel Kosayev

Cost: $350

Proof of Completion: Certification of Completion

Community/Forum: There is a Discord community

Topics Include:

• Lab Setup
• Deploying Flare-VM
• Connecting to INetSim
• Introduction to Code Reverse Engineering
• Installing Visual Studio
• Basic C Code
• Basic Reverse Engineering
• The PE Structure
• Static Malware Analysis
• Identifying File Types
• Strings Extraction
• Identifying Malicious Functionality
• Packing Analysis
• Dynamic Malware Analysis
• Working with Process Explorer
• Extracting IoC’s using Process Hacker
• Working with Procmon
• Monitoring WinAPI Functions using API Logger
• Inspecting Process Command Line Line Parameters using CMD Watcher
• Debugging DLL Files with IDA Disassembler
• Malicious Documents Analysis
• Analyzing Malicious PDF Files
• Analyzing VBA Macros
• YARA Rule Examples

*DFIR Diva is an affiliate of TrainSec and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Affiliate Link*: Incident Response Path

Platform: Pluralsight

Cost: $29/Month, $299/Year or $499/Year

Proof of Completion: Yes – Badge and Certificate

Hands-On: Yes

Courses and Labs Included:

• Detection and Analysis
• Lab – Detection and Analysis
• Network Analysis
• Lab – Network Analysis
• Host Analysis
• Containment, Eradication and Recovery
• Windows Registry Forensics
• Windows File System and Browser Forensics

*DFIR Diva is an affiliate of Pluralsight and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Affiliate Link*: HTB Certified Defensive Security Analyst

Platform: Hack The Box

Cost: $490 (Includes 1 year access to the SOC Analyst Job Role Training Path and an Exam Voucher)

Students can access the SOC Analyst Job Role Training Path for $8/month and purchase an Exam Voucher for $210.

Exam Type: Practical/Hands-On

Community: There is a Hack The Box Discord Server

Topics:

• Incident Handling Process
• Security Monitoring & SIEM Fundamentals
• Windows Event Logs & Finding Evil
• Introduction to Threat Hunting & Hunting With Elastic
• Understanding Log Sources & Investigating with Splunk
• Windows Attacks & Defense
• Intro to Network Traffic Analysis
• Intermediate Network Traffic Analysis
• Working with IDS/IPS
• Introduction to Malware Analysis
• JavaScript Deobfuscation
• YARA & Sigma for SOC Analysts
• Introduction to Digital Forensics
• Detecting Windows Attacks with Splunk
• Security Incident Reporting

There is also an optional SOC Analyst Prerequisites Path that includes:

• Linux Fundamentals
• Introduction to Bash Scripting
• Windows Fundamentals
• Introduction to Windows Command Line
• Introduction to Networking
• Introduction to Active Directory
• Web Requests
• Penetration Testing Process
• Network Enumeration with NMAP
• Intro to Assembly Language

*DFIR Diva is an affiliate of Hack the Box and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Affiliate Link*: Detection Engineering for Beginners

Platform: TCM Security

Cost: This course is included in TCM Security’s All Access Pass for $29.99/month

Hands-On: Yes

Proof of Completion: Certificate of Completion

Topics: Security Operations, Role Variety, Security Incident and Event Management, The Detection Engineering Workflow, Technology Stack for Detection Engineering, MITRE ATT&CK Framework, Lab Setup, Zeek, Elastic, Sysmon, Testing Sysmon Logging with EICAR File and PowerShell, Custom Detections, Attack Scenarios, Atomic Red Team, TOML, Elastic API, GitHub, Metrics.

*DFIR Diva is an affiliate of TCM Security Academy and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Affiliate Link*: Windows Malware Analysis for Hedgehogs – Beginner Training

Platform: Udemy

Course Author: Karsten Hahn

Cost: $139.99

Hands-On: Yes

Proof of Completion: Certificate of Completion

Topics: Malware Lab Setup, Triage and File Type Basics, Wrapped Files and Installers, Malware Persistence and Disinfection Basics, Portable Executable Format and .NET, File Analysis Verdicts, Malware Classification and Analysis Reports, Ghidra Basics, Debugging Basics with x64dbg

*DFIR Diva is an affiliate of Udemy and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Direct Link: CSI Linux OSINT Certifications

Platform: Echothis Labs

Community/Forum: There is a CSI Linux Discord Server

Exam Type: Multiple Choice

Certifications and Topics:

Name: CSI Linux Certified OSINT Analyst (CSIL-COA)

Cost: $385

Topics: What is OSINT, Base Process of Investigations, Preserving Online Evidence, Phone Numbers, IP Addresses, Proxies, VPNs, DNS, Domains, Subdomains, Anonymity, Online Investigation Samples, Misinformation, Disinformation, Deception, Setting up an Online Web Persona – Sock Puppet, Using Your Persona to Investigate, Translation Options, Website Collection, 3rd Party Commercial Apps, OSINT Frameworks (Tools), Tracking Changes and Getting Alerts, Public Records Searches, Geolocation, Tracking Transportation, Using Images in Investigations, Social Media Sites, Video Evidence Collection, Cryptocurrency, AI Challenges, Writing the Report, Case Studies, Practicing OSINT and Resources.

Name: CSI Linux Certified Social Media Investigator (CSIL-CSMI)

Cost: $385

Topics: Anonymity, Base Process of Investigations, Preserving Online Evidence, Terms of Service Challenges, SOCMINT Investigations, Username Search, Setting up an Online Web Persona – Sock Puppet, Using your Persona to Investigate, 3rd Party Commercial Apps, Online Investigations with Images, Video Evidence Collection, YouTube, TikTok, Google, Facebook, Telegram, Twitter, Instagram, Other Social Media Sites, LinkedIn, Dating Sites, Craigslist Scams, 4Chan and Image Boards, Reddit, Writing the Report

Name: CSI Linux Certified Dark Web Investigator (CSIL-CDWI)

Cost: $385

Topics: What is the Darknet/Dark Web, Anonymity, Preserving Online Evidence, Darknet / Dark Web Evidence, Writing the Report, Connecting to Tor, Navigating the Dark Web (Tor), Setting up a Dark Web Persona, AI – Machine Learning, Dark Web Investigation Subjects, Crypto Currency, Video Evidence, Dark Markets, Hunch.ly, De-Anonymizing Tor, Other Onion Routing Dark Nets, Case Studies