Free lesson 1 of 8 from Digital Forensics & Incident Response — After the breach: analyse the capture, the malware and the persistence — reconstruct the whole attack.. No account, no card.
SOC catches attacks live in the logs; DFIR comes after — you're handed artifacts (a disk, a memory dump, a packet capture, a suspicious file) and must reconstruct what happened, how, and what was taken, without contaminating the evidence.
Your lab ships a crime scene. Open the Live-Lab and read the case file:
cat ~/dfir/TICKET.txt ls -la ~/dfir/evidence/ # traffic.pcap · update.bin (+ host: /etc/cron.d)
A pcap (what went over the wire — creds, exfil), a binary (what malware did — strings, behaviour), and cron (how the attacker persists). Network + host + persistence: the three pillars of an intrusion.
⚖️ Handle only evidence you're authorized to. In real IR, preserve originals and work on copies.
8 lessons · knowledge checks · final exam · verifiable certificate · in-browser Live-Lab
Unlock all courses · CHF 9/month Buy only this course · CHF 19