Name & Affiliate Link*: Analyst I: Practical Windows Forensic Analyst (PWFA)

Platform: Blue Cape Security

Cost: $697

Payment Plan: Available at checkout via PayPal financing

Exam Type: Hands-On (2 attempts)

Certification Information: Includes Digital Certificate, Digital Badge, and a challenge coin for those scoring 85% or higher. The certification does not expire.

Training & Practice Included:

• 201 Practical Windows Forensics Course with Online Labs
  • Forensic Process & Forensic Reporting
  • Data Collection & Data Examination
  • Windows Registry & User Behavior Analysis
  • Event Log Analysis, Memory Analysis, & Super Timeline Creation
  • File System Analysis & Master File Table (MFT)
  • Timestomping, Deleted Files, Program Execution, & Persistence Mechanism
• FOR200: Investigation Scenarios
  • 4 lab-based forensic scenarios
  • Disk + memory images, case briefs, and investigation objectives
  • Preloaded lab VMs with forensic evidence
  • Scenario Solution Video Walkthroughs
  • Case Summaries and Timeline Analysis Reports
  • Certificates of Completion (Up to 12 CPE hours)
  • Incident Timeline (.xlsx)
  • PWF Report (.docx)
  • Analysis Notes (.docx)

*DFIR Diva is an affiliate of Blue Cape Security and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Direct Link: C5W Investigating Linux Systems

Platform: Cyber 5W

Training & Exam Pricing: $650

Exam Type: Practical Hands-On

Student Discount: Students get 25% off when registering with their college or university email account and contacting Cyber 5W

Topics: Introduction to Linux, Essential Tools and Techniques, System Analysis, File Systems and Log Analysis, GUI & USB Forensics, Writing Forensic Reports

Name & Direct Link: Security Analyst Level 1 (SAL1)

Platform: TryHackMe

Training & Exam Pricing: $349 (includes training and exam)

Exam Type: Multiple Choice and Hands-On

Topics: Computing Foundations, Cyber Defense Frameworks, Common Malicious Behavior (phishing, network attacks, exploitation, authentication attacks, malware, LOLBAS attacks), Tools of the Trade (EDR, WAF, NDR, SIEM, SOAR, TIP), Incident Response (IR) Plan, Playbooks, Network Architecture Diagrams, Alert Triage and Ticketing, SOC Metrics and KPIs.

Community: There is a TryHackMe Discord Server

Name & Affiliate Link*: Practical SOC Analyst Associate (PSAA)

Platform: TCM Security

Price: $249 (includes training and exam voucher that doesn’t expire)

Student Discount: Students, Veterans, Teachers and First Responders can get a 20% discount.

Exam Type: Practical Hands-On

Topics:

• Security Operations Fundamentals
• Phishing Analysis
• Network Security Monitoring
• Network Traffic Analysis
• Endpoint Security Monitoring
• Endpoint Detection and Response
• Log Analysis and Management
• Security Information and Event Management (SIEM)
• Threat Intelligence
• Digital Forensics
• Incident Response

*DFIR Diva is an affiliate of TCM Security and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Direct Link: MASA – Certified All Source Analyst

Platform: Mossé Cyber Security Institute

Community: They have a Discord Server

Training & Certification Pricing: $995

Exam Type: Practical Hands-On

Topics:

• Lab Setup
• Fundamentals of Open Source Intelligence (OSINT)
• Search Engines
• Social Media
• Personal Identifiable Information (PII)
• Documents
• Data Breaches
• Multimedia
• Deep Web
• Geolocation
• Documentation for OSINT
• Fundamentals of Cyber Threat Intelligence (CTI)
• Situational Awareness
• Open-Source Intelligence for CTI
• Monitoring for New Threats
• Harnessing Threat Feeds
• Cyber Threat Intelligence Operations
• Internal Logs Sources
• Hypothesis Creation
• Supporting Red Teams and Threat Hunting Teams
• Reporting for CTI
• Policies, Procedures and Methodologies

Name & Direct Link: MCDFA – Certified Cyber Defense Forensics Analyst

Platform: Mossé Cyber Security Institute

Community: They have a Discord Server

Training & Certification Pricing: $995

Topics:

• Lab Setup
• File Analysis
• Disk and Filesystem Forensics
• Executable Analysis
• Windows Forensics
• Windows 10 Forensics
• Behavioral Analysis
• Memory Forensics
• Malware Analysis
• Memory Forensics Challenges
• Network Forensics Challenges
• Documentation
• Business Email Compromise Investigation Scenario
• Ransomware Investigation Scenario
• Android Mobile Forensics Investigation Scenario

Additional Information: This isn’t a typical approach to a certification. You complete practical scenarios to earn the certification.

Name & Direct Link: Investigating Linux Devices

Certification Information: Certifications and Digital Badges

Platform: 13Cubed

Cost: $895

Exam Type: Hands-On/Multiple Choice

Topics Covered:

• Introduction to Linux
• Linux Logs
• Linux File Systems
• Persistence Mechanisms
• Evidence Collection
• Timelining
• Linux Memory Forensics
• Live Response
• Analyzing a Compromised System

Name & Direct Link: MTIA – Certified Threat Intelligence Analyst

Platform: Mossé Cyber Security Institute

Community: They have a Discord Server

Training & Exam Pricing: $450 includes practical exercises and the certification.

Topics:

• Lab Setup
• Fundamentals
• Open-Source Intelligence
• Internal Logs Sources
• Binary Classification
• File and Executable Forensics
• Memory Forensics
• Network Forensics
• Windows Forensics
• Threat Hunting with YARA
• Threat Hunting with Pandas
• Threat Hunting with Velociraptor
• Threat Hunting with GRR Rapid Response
• Situational Awareness
• Pivot Analysis
• Harnessing Threat Feeds
• Monitor New Threats and Vulnerabilities
• Security Automation
• Cyber Threat Mapping
• Hypothesis Creation
• Supporting Red Teams and Threat Hunting Teams
• Reporting
• Policies, Procedures, and Methodologies
• Cyber Counterintelligence

Additional Information: This isn’t a typical approach to a certification. You complete 100% practical exercises that you research how to do on your own as you go, so part of it is research methods and critical-thinking skills. As you go through the exercises, you go from Novice DFIR Practitioner up to Certified Expert DFIR Practitioner. There is no time limit to complete it.

Exam Type: Practical Hands-On

Name & Direct Link: ATT&CK Cyber Threat Intelligence Certification

Platform: MAD20

Cost: $47.99/month – $499/year

Proof of Completion: Badge for each topic and certification after completing all of the topics.

Community/Forum: There is a MAD20 Learners Group for subscribers

Topics:

• ATT&CK Fundamentals
• ATT&CK Cyber Threat Intelligence from Raw Data
• ATT&CK Cyber Threat Intelligence from Narrative Reporting
• ATT&CK Cyber Threat Intelligence Storage and Analysis
• ATT&CK Cyber Threat Intelligence Defense Recommendations

Name & Direct Link: C5W Certified Malware Analyst (CCMA) – On Demand

Platform: Cyber 5W

Cost: $650

Topics:

• Introduction to Malware Analysis
• Static Malware Analysis 101
• Dynamic Malware Analysis 101
• Static Malware Analysis 102 – IDA Pro
• Static Malware Analysis 102 – Ghidra
• Dynamic Malware Analysis 102
• Analyzing Managed Code (readable/uncompiled)
• Extracting IOCs and Writing YARA Rules
• Hands-On Labs