Name & Direct Link: Threat Hunting Labs

Cost: $0 – $281/year

Community: There is a Discord community

Description: A training platform built for threat hunters, SOC analysts, incident responders, and detection engineers who want to train the way they actually work. Every investigation runs against real intrusion telemetry from sanitized breach cases, inside a platform-native search console where you write real queries, form hypotheses, and validate findings with evidence. No synthetic noise or contrived puzzles. Just investigations that force you to think, adapt, and prove your conclusions.

Topics:

Threat Hunting Labs covers four core disciplines, all built on the same rich, real-world datasets:

• Threat Hunting: Proactively search through telemetry to find evil, form hypotheses, and follow the trail wherever it leads.
• Incident Response: Respond to a critical alert, triage the damage, and make time-pressured decisions with real consequences.
• Detection Engineering: Move beyond finding evil to codifying it. Write and tune detection rules against real attack patterns.
• Malware Analysis: Go hands-on with malware from the intrusion in a secure, dedicated REMnux environment tied to the case telemetry.

Name & Direct Link: ADF Weekly Computer Training Sessions

Platform: ADF Solutions

Cost: Free

Description: Weekly training sessions to get ADF users started with what they need to know to get the best out of ADF computer forensic software.

Name & Direct Link: ADF Weekly Mobile Training Sessions

Platform: ADF Solutions

Cost: Free

Description: Weekly training sessions to get ADF users started with what they need to know to get the best out of ADF mobile forensic software.

Name & Direct Link: BelkaGPT: Effective Artificial Intelligence in DFIR

Platform: Belkasoft

Cost: $999

Hands-On: Yes

Proof of Completion: Certificate of Completion. There is an optional certification exam for $99.

Topics:

• Key concepts behind artificial intelligence in general and BelkaGPT in particular
• Understand BelkaGPT’s hardware requirements, scope, limitations, and capabilities
• Install and configure BelkaGPT, and become acquainted with its user interface and basic workflow
• Gain hands-on experience mastering efficient BelkaGPT prompts to save hours of your time when solving a case
• Learn how to use BelkaGPT Hub and accelerate AI processing for the entire team

Name & Direct Link: Malware Analysis – Intermediate Level

Platform: Malware Analysis for Hedgehogs

Cost: $489

Course Instructor: Karsten Hahn

Community: There is a Discord server

Proof of Completion: Certificate

Topics Include:

• Calling conventions for x86/x64
• C++ string deobfuscation and Ghidra scripting
• Compression, encoding and cryptographic algorithms
• Theoretical foundations of signatures and patterns
• Writing signatures with YARA
• Code based signatures for x86
• Unpacking
• Hooks, syscalls and x64dbg scripting
• Shellcode analysis, PEB walking, import hashing
• Writing and automatic hash resolver

Name & Direct Link: Cloud Labs

Platform: Invictus Incident Response

Good for Beginners: There are easy labs available

Cost: Free – $58.56/month

Proof of Completion: The “All-In” subscription offers digital badges

Description: Hands-on practice with cloud incident response. Microsoft  365, Azure, Sentinal, AWS and more.

Name & Direct Link: Malops – Advanced Malware Analysis Training Platform

Cost: Free

Community: They have a Discord server

Description: Explore real-world malware scenarios, learn new techniques, and build confidence through practical experience.

Name & Affiliate Link*: Malware Analyst Professional – Level 2

Platform: TrainSec

Course Instructor: Uriel Kosayev

Cost: $350

Proof of Completion: Certification of Completion

Community/Forum: There is a Discord community

Topics Include:

• Intro to Reverse Engineering
• Bitwise Operations
• Understanding Windows API Functions
• Introduction to Code Injections
• Process Injection Classifications
• Process Hollowing
• Introduction to Anti-Analysis
• Anti-Debugging
• Anti-VM
• Anti-AV
• Introduction to Packers and the Unpacking Process
• Manual Unpacking
• Introduction to Shellcode Analysis
• Shellcode Reverse Engineering
• Ransomware Reverse Engineering
• Reverse Engineering .NET Malware

*DFIR Diva is an affiliate of TrainSec and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Affiliate Link*: MAoS – Malware Analysis on Steroids Bundle

Platform: TrainSec

Course Instructor: Uriel Kosayev

Cost: $700

Proof of Completion: Certification of Completion

Community/Forum: There is a Discord community

Topics Include:

• Malware Analyst Professional – Level 1
  • Lab Setup
  • Deploying Flare-VM
  • Connecting to INetSim
  • Introduction to Code Reverse Engineering
  • Installing Visual Studio
  • Basic C Code
  • Basic Reverse Engineering
  • The PE Structure
  • Static Malware Analysis
  • Identifying File Types
  • Strings Extraction
  • Identifying Malicious Functionality
  • Packing Analysis
  • Dynamic Malware Analysis
  • Working with Process Explorer
  • Extracting IoC’s using Process Hacker
  • Working with Procmon
  • Monitoring WinAPI Functions using API Logger
  • Inspecting Process Command Line Line Parameters using CMD Watcher
  • Debugging DLL Files with IDA Disassembler
  • Malicious Documents Analysis
  • Analyzing Malicious PDF Files
  • Analyzing VBA Macros
  • YARA Rule Examples
• Malware Analyst Professional – Level 2
  • Intro to Reverse Engineering
  • Bitwise Operations
  • Understanding Windows API Functions
  • Introduction to Code Injections
  • Process Injection Classifications
  • Process Hollowing
  • Introduction to Anti-Analysis
  • Anti-Debugging
  • Anti-VM
  • Anti-AV
  • Introduction to Packers and the Unpacking Process
  • Manual Unpacking
  • Introduction to Shellcode Analysis
  • Shellcode Reverse Engineering
  • Ransomware Reverse Engineering
  • Reverse Engineering .NET Malware

*DFIR Diva is an affiliate of TrainSec and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Affiliate Link*: Analyst I: Practical Windows Forensic Analyst (PWFA)

Platform: Blue Cape Security

Cost: $697

Payment Plan: Available at checkout via PayPal financing

Exam Type: Hands-On (2 attempts)

Certification Information: Includes Digital Certificate, Digital Badge, and a challenge coin for those scoring 85% or higher. The certification does not expire.

Training & Practice Included:

• 201 Practical Windows Forensics Course with Online Labs
  • Forensic Process & Forensic Reporting
  • Data Collection & Data Examination
  • Windows Registry & User Behavior Analysis
  • Event Log Analysis, Memory Analysis, & Super Timeline Creation
  • File System Analysis & Master File Table (MFT)
  • Timestomping, Deleted Files, Program Execution, & Persistence Mechanism
• FOR200: Investigation Scenarios
  • 4 lab-based forensic scenarios
  • Disk + memory images, case briefs, and investigation objectives
  • Preloaded lab VMs with forensic evidence
  • Scenario Solution Video Walkthroughs
  • Case Summaries and Timeline Analysis Reports
  • Certificates of Completion (Up to 12 CPE hours)
  • Incident Timeline (.xlsx)
  • PWF Report (.docx)
  • Analysis Notes (.docx)

*DFIR Diva is an affiliate of Blue Cape Security and receives a small percentage of sales made through affiliate links that go toward keeping the site running.