This course covers static analysis (examining a file without running it) and dynamic analysis (reading behavior out of sandbox and monitoring reports), building the judgment for which technique fits which situation. It follows NIST SP 800-83 Rev. 1 and works in the tools and government resources analysts actually reach for — disassemblers, sandboxes, YARA, network capture, and CISA's Malware Next-Gen. Dynamic analysis is taught through explanation and example reports alone; no lab, sandbox, or live sample is required. A federal thread on sample sensitivity, data handling, and reporting runs the length of the course.
This course completes the Digital Forensics & Incident Response certificate, alongside Federal Incident Response and Digital Forensics & Incident Investigation — part of the Cyber Operations Professional credential.
Target Audience
- Federal SOC and CSIRC analysts, malware and reverse-engineering analysts, forensics examiners, and IR staff who already hold foundational IR and forensics knowledge and are ready to go deeper.
This course has a prerequisite
- Federal IR (NIST 800-61) + basic forensics (NIST 800-86); Windows/Linux command-line comfort. Intermediate.
What You'll Learn at a Glance
- Static analysis: triage, string and metadata extraction, YARA, basic disassembly
- Read dynamic analysis output (sandboxing, monitoring, network simulation) and recognize evasive behavior from example reports
- Capture network IOCs and correlate them with threat intel and MITRE ATT&CK
- Reach for FLARE-VM, REMnux, and CISA Malware Next-Gen where each is appropriate, as against public multi-scanners
- Write a CISA-MAR-style report that serves both technical and leadership readers
- Track a single sample from first triage through to final report in a worked example
Course Syllabus
- Module 1
- Foundations & Isolated Analysis Environments
- Module 2
- Static Analysis Fundamentals
- Module 3
- Static Analysis: Disassembly & Code-Level Review
- Module 4
- Dynamic Analysis Fundamentals — via example reports, no lab
- Module 5
- Network & Behavioral Analysis
- Module 6
- Toolkits & Federal Analysis Platforms
- Module 7
- Reporting, MARs & Best Practices
- Module 8
- Capstone Analysis Exercise & Program Development
This course is available for "remote" learning and will be available to anyone with access to an internet device with a microphone (this includes most models of computers, tablets). Classes will take place with a "Live" instructor at the date/times listed below.
Upon registration, the instructor will send along additional information about how to log-on and participate in the class.
