Phase 1: Introduction to Incident Response

• Common pitfalls
  • Common pain points that organisation make with regards to incidents
• Prevalent threats/attacks
  • Who are the threat actors
  • What are the most common attack that are currently used
• What is an incident and how to prepare for it
  • Incident life cycle
  • Regulatory bodies and Law
• Evidence handling best practices
  • Chain of custody discussion
  • Forensics go kit
• War stories and scenarios
  • Sharing of war stories and their root cause
  • What could have been done better to prevent the incident

Phase 2: How Hackers Do It

• Introduction to malwares
  • Type of malwares
  • Common protection against malwares
• Common attack techniques and lifecycle
  • Common attacker behavoiur
  • Typical attack lifecycle

Phase 3: Data Collection (demo / hands on)

• Disk image gathering
  • Introduction to tools used for disk image creation
  • Demo and hands on workshop on creating disk images
• Memory image gathering
  • Introduction to tools used for memory dump collection
  • Demo and hands on workshop on memory dump collection

Phase 4: Introduction to Forensic Analysis

• Autopsy 101
  • Introduction to forensic analysis tools
  • Demo and hands on workshop on using the tool called Autopsy
• Basics of memory forensics
  • Introduction to memory forensics analysis tools
  • Demo and hands on workshop on using memory analysis tools

Phase 5: Cloud IR

• Triaging incidents in the cloud
  • Conducting M365 incident response

Phase 6: Google-Fu (optional, if time permits)

• Using Open Source Intelligence (OSINT) in incident investigation
  • How can public data be used during an incident investigation