SANS FOR572: Advanced Network Forensics and Analysis [2017 PDF]

SANS FOR572: Advanced Network Forensics and Analysis [2017 PDF]
English | Size: 475.96 MB
Category: Networking | Security

FOR572: ADVANCED NETWORK FORENSICS: THREAT HUNTING, ANALYSIS AND INCIDENT RESPONSE was built from the ground up to cover the most critical skills needed to mount efficient and effective post-incident response investigations. We focus on the knowledge necessary to expand the forensic mindset from residual data on the storage media from a system or device to the transient communications that occurred in the past or continue to occur. Even if the most skilled remote attacker compromised a system with an undetectable exploit, the system still has to communicate over the network. Without command-and-control and data extraction channels, the value of a compromised computer system drops to almost zero. Put another way: Bad guys are talking – we’ll teach you to listen.

This course covers the tools, technology, and processes required to integrate network evidence sources into your investigations, with a focus on efficiency and effectiveness. You will leave this week with a well-stocked toolbox and the knowledge to use it on your first day back on the job. We will cover the full spectrum of network evidence, including high-level NetFlow analysis, low-level pcap exploration, ancillary network log examination, and more. We cover how to leverage existing infrastructure devices that may contain months or years of valuable evidence as well as how to place new collection platforms while an incident is already under way.

Whether you are a consultant responding to a client’s site, a law enforcement professional assisting victims of cybercrime and seeking prosecution of those responsible, an on-staff forensic practitioner, or a member of the growing ranks of "threat hunters", this course offers hands-on experience with real-world scenarios that will help take your work to the next level. Previous SANS SEC curriculum students and other network defenders will benefit from the FOR572 perspective on security operations as they take on more incident response and investigative responsibilities. SANS Forensic alumni from 408 and 508 can take their existing knowledge and apply it directly to the network-based attacks that occur daily. In FOR572, we solve the same caliber of real-world problems without the use of disk or memory images.

The hands-on labs in this class cover a wide range of tools and platforms, including the venerable tcpdump and Wireshark for packet capture and analysis; NetworkMiner for artifact extraction; and open-source tools including nfdump, tcpxtract, tcpflow, and more. Newly added tools in the course include the SOF-ELK platform – a VMware appliance pre-configured with the ELK stack. This "big data" platform includes the Elasticsearch storage and search database, the Logstash ingest and parse utility, and the Kibana graphical dashboard interface. Together with the custom SOF-ELK configuration files, the platform gives forensicators a ready-to-use platform for log and NetFlow analysis. For full-packet analysis and hunting at scale, the Moloch platform is also used. Through all of the in-class labs, your shell scripting abilities will also be used to make easy work of ripping through hundreds and thousands of data records.

FOR572 is truly an advanced course – we hit the ground running on day one. Bring your entire bag of skills: forensic techniques and methodologies, networking (from the wire all the way up to user-facing services), Linux shell utilities, and everything in between. They will all benefit you throughout the course material as you FIGHT CRIME. UNRAVEL INCIDENTS…ONE BYTE (OR PACKET) AT A TIME.

Advanced Network Forensics: Threat Hunting, Analysis and Incident Response Course Topics:

Foundational network forensics tools: tcpdump and Wireshark refresher
Packet capture applications and data
Unique considerations for network-focused forensic processes
Network evidence types and sources
Network architectural challenges and opportunities for investigators
Investigation OPSEC and footprint considerations
Network protocol analysis
Domain Name Service
Hypertext Transfer Protocol
File Transfer Protocol
Microsoft protocols
Simple Mail Transfer Protocol
Commercial network forensic tools
Automated tools and libraries
Collection approaches
Open-source NetFlow tools
Wireless networking
Capturing wireless traffic
Modes of wireless operation
Useful forensic artifacts from wireless traffic
Common attack methods and detection
Log data to supplement network examinations
Microsoft Windows Eventing
HTTP server logs
Firewalls, Intrusion Detection Systems (IDSes), and Network Security Monitoring (NSM) Platforms
Log collection, aggregation, and analysis
Web proxy server examination
Secure HTTP/Secure Sockets Layer
Deep packet work
Network protocol reverse engineering
Payload reconstruction



For multi-course live training events, there will be a set up time from 8:00-9:00am on the first day only to make sure that computers are configured correctly to make the most of class time. All students are strongly encouraged to attend.

Course Syllabus
FOR572.1: Off the Disk and Onto the Wire
FOR572.2: Core Protocols & Log Aggregation/Analysis
FOR572.3: NetFlow and File Access Protocols
FOR572.4: Commercial Tools, Wireless, and Full-Packet Hunting
FOR572.5: Encryption, Protocol Reversing, OPSEC, and Intel
FOR572.6: Network Forensics Capstone Challenge
Additional Information
Laptop Required
Who Should Attend
What You Will Receive
You Will Be Able To
Press & Reviews
Course Authors’ Statements

When I first became interested in computer and network security in the mid-1990s, the idea of "attacking" another computer network was still science fiction. Today, commercial, governmental, military, and intelligence entities have robust, integrated information security processes. Within the forensic community, we have seen developments that show the agility we must have to remain effective in the face of dynamic adversaries. Endpoint forensic practices will remain the keystone of digital forensics for the foreseeable future – this is where the events ultimately occur, after all.

We created FOR572: Advanced Network Forensics: Threat Hunting, Analysis & Incident Response to address the most transient domain of digital forensics. Many enterprises have grown to the scale that identifying which handful of endpoints to examine among thousands is a significant challenge. Additionally, the network has become its own medium for incident response and investigation. Our ability to use evidence from all kinds of network devices as well as from captured network data itself will be critical to our success in addressing threats today and tomorrow. From low-grade "script kiddie" attacks to long-term, strategic state-sponsored espionage activity, the network is one of the few common elements found throughout the life cycle of an incident. FOR572 will provide you with the tools and methods to conduct network investigations within environments of all sizes, using scenarios developed from real-world cases. You will finish the course with valuable knowledge that you will use the first day back on the job, and with the methodologies that will help address the next generations of adversaries’ capabilities.

– Phil Hagen

When I first started my career in computer security, the term "advanced persistent threat" was unknown, yet I had personally recovered terabytes of data obtained from both commercial and government networks. The biggest cybersecurity threat in the news was the latest worm that would propagate through unsuspecting systems and cause more of a nuisance than actual destruction. What was known as the Russian Business Network wasn’t even around yet. Network security monitoring was still in its infancy, with very little formal documentation or best practices, most of which were geared towards system administrators. While the Internet has continued to expand, we have all become more interconnected and the threat against our networks continues to grow. We wrote FOR572 as the class we wish we had when we were entering the field of network forensics and investigations – a class that not only provides background when needed, but is primarily tailored toward finding evil using multiple data sources and performing a full scope investigation. I am confident this course provides the most up-to-date training covering topics both old and new, based on real-life experiences and investigations.

– Mat Oldham

Additional Resources

Take your learning beyond the classroom. Explore our site network for additional resources related to this course’s subject matter.


*CPE/CMU credits not offered for the SelfStudy delivery method
Free Course Demo

Course List


Course Brochure



About WoW Team

I'm WoW Team , I love to share all the video tutorials. If you have a video tutorial, please send me, I'll post on my website. Because knowledge is not limited to, irrespective of qualifications, people join hands to help me.

Skip to toolbar