| Course Capability Requirements | |
| 23 | 802.11 Wireless operations and security concepts? | Y/N |
| 24 | Access Control? | Y/N |
| 25 | Addressing IPv4 & IPv6? | Y/N |
| 26 | Auditing? | Y/N |
| 27 | Biometrics? | Y/N |
| 28 | BIOS? | Y/N |
| 29 | Bitlocker? | Y/N |
| 30 | Bluetooth? | Y/N |
| 31 | Boolean concepts (OR and XOR)? | Y/N |
| 32 | BOOTP and DHCP? | Y/N |
| 33 | Buffer Overflow Defenses? | Y/N |
| 34 | Command line tools? | Y/N |
| 35 | Common and recent Malware (virus, worm, botnet, Trojan, ransomware, etc.)? | Y/N |
| 36 | Common ports and protocols? | Y/N |
| 37 | Confidentiality Integrity and Authenticity (CIA) Prioritization? | Y/N |
| 38 | Cross-site scripting defenses? | Y/N |
| 39 | Cryptography? | Y/N |
| 40 | Cyber Forensics and Evidence Integrity? | Y/N |
| 41 | Cyber Law -- US and International -- familiarization? | Y/N |
| 42 | Defense in Depth? | Y/N |
| 43 | Denial of Service Attacks? | Y/N |
| 44 | Discrete Mathematics (Binary, Decimal, Hexadecimal)? | Y/N |
| 45 | Discretionary Access Control Lists? | Y/N |
| 46 | Domain Name Services? | Y/N |
| 47 | Email Security? | Y/N |
| 48 | Federal Desktop Core Configuration? | Y/N |
| 49 | File Systems NTFS, FAT, NFS? | Y/N |
| 50 | Firewalls? | Y/N |
| 51 | Group Policy Objects? | Y/N |
| 52 | Honeypots? | Y/N |
| 53 | Host and network-based intrusion detection? | Y/N |
| 54 | Host and network-based intrusion prevention? | Y/N |
| 55 | IIS security? | Y/N |
| 56 | Information Warfare? | Y/N |
| 57 | IP concepts and behavior? | Y/N |
| 58 | Kerberos Protocol? | Y/N |
| 59 | Kernal Basics? | Y/N |
| 60 | Microsoft Windows Registry? | Y/N |
| 61 | Network Address Translation / Port Address Translation? | Y/N |
| 62 | Network fundamentals? | Y/N |
| 63 | Network Scanning Tools? | Y/N |
| 64 | Network Switching Concepts? | Y/N |
| 65 | Non-Repudiation? | Y/N |
| 66 | Operations Security? | Y/N |
| 67 | OSI vs. TCP/IP Model? | Y/N |
| 68 | Password security and cracking tools? | Y/N |
| 69 | Penetration Testing Techniques? | Y/N |
| 70 | Perimeter protection? | Y/N |
| 71 | PGP? | Y/N |
| 72 | Physical Security? | Y/N |
| 73 | PowerShell 3.0? | Y/N |
| 74 | Primary threats to perimeter protection? | Y/N |
| 75 | Remote Desktop Protocol? | Y/N |
| 76 | Risk assessment? | Y/N |
| 77 | Routing Concepts? | Y/N |
| 78 | Security policy? | Y/N |
| 79 | Social Engineering? | Y/N |
| 80 | Steganography? | Y/N |
| 81 | UNIX security fundamentals? | Y/N |
| 82 | Virtual Private Networks? | Y/N |
| 83 | VoIP Signaling? | Y/N |
| 84 | Vulnerability Scanners? | Y/N |
| 85 | Web Security? | Y/N |
| 86 | Windows security administration and auditing? | Y/N |
| 87 | Does the Security Essentials Course offer at least 40% of the course as Hands-on Lab based training? | Y/N |
| 88 | 802.11 (a/b/g/n/i/ac)? | Y/N |
| 89 | A hacker tools workshop? | Y/N |
| 90 | Access Tools? | Y/N |
| 91 | Account Harvesting? | Y/N |
| 92 | Account Management? | Y/N |
| 93 | Active OS Fingerprinting? | Y/N |
| 94 | Active Traffic Shaping? | Y/N |
| 95 | Attack Phases (Reconnaissance, Scanning, Exploiting Systems, Maintaining Access, Covering Tracks)? | Y/N |
| 96 | Attack Trends? | Y/N |
| 97 | Attacks on Hosts? | Y/N |
| 98 | Attacks on Humans (Social Engineering, Phishing …)? | Y/N |
| 99 | Attacks on Infrastructure? | Y/N |
| 100 | Attacks on Servers? | Y/N |
| 101 | Buffer Overflows? | Y/N |
| 102 | Certificates? | Y/N |
| 103 | Command Line tools? | Y/N |
| 104 | Common Gateway Interface Vulnerabilities? | Y/N |
| 105 | Complete introduction to the incident handling process, using the six steps: preparation, identification, containment, eradiation, recovery, and lessons learned? | Y/N |
| 106 | Computer and network hacker exploits? | Y/N |
| 107 | Computer crime investigation? | Y/N |
| 108 | Containing Intrusions? | Y/N |
| 109 | Continuity of Operations Plan? | Y/N |
| 110 | Cookie vulnerabilities? | Y/N |
| 111 | Covering Tracks or Housekeeping Tools? | Y/N |
| 112 | Cross-Site Scripting? | Y/N |
| 113 | Cyber Crime Law, US and International? | Y/N |
| 114 | Denial of Service? | Y/N |
| 115 | Directory Insertion? | Y/N |
| 116 | DNS Cache Poisoning? | Y/N |
| 117 | DNS Vulnerabilities (Zone Transfer, Lookups, Record Types, Abuse)? | Y/N |
| 118 | Emergency Communication Plans? | Y/N |
| 119 | Enabling / Disabling Ports? | Y/N |
| 120 | Enabling / Disabling LINUX/UNIX/Windows Services? | Y/N |
| 121 | Exploitation Tools? | Y/N |
| 122 | Firewalls and Proxies? | Y/N |
| 123 | Firmware Malware? | Y/N |
| 124 | Hacker Techniques? | Y/N |
| 125 | Hacktivism? | Y/N |
| 126 | Hiding Files? | Y/N |
| 127 | Incident handling? | Y/N |
| 128 | Insider Threats? | Y/N |
| 129 | Intellectual Property? | Y/N |
| 130 | Intrusion Detection Systems Signature Matching? | Y/N |
| 131 | IPv4 and IPv6 tools? | Y/N |
| 132 | LANMAN vs. NTLM Password? | Y/N |
| 133 | Malware (virus, work, Trojan, bot, rootkit)? | Y/N |
| 134 | Man in the Middle Attacks? | Y/N |
| 135 | Metasploit Framework? | Y/N |
| 136 | Network Monitoring Tools? | Y/N |
| 137 | Network Security Scanners? | Y/N |
| 138 | OS Fingerprinting? | Y/N |
| 139 | Password Cracking / Guessing? | Y/N |
| 140 | Payment Card Industry (PCI) Requirements? | Y/N |
| 141 | Polymorphic code? | Y/N |
| 142 | Port and Protocol Abuse? | Y/N |
| 143 | Port Mapping/ Active Ports? | Y/N |
| 144 | Profit Hacking? | Y/N |
| 145 | Reconnaissance Tools? | Y/N |
| 146 | Recovery Operations? | Y/N |
| 147 | Scanning tools? | Y/N |
| 148 | Scripting Languages? | Y/N |
| 149 | Search Engine? | Y/N |
| 150 | Session Hijacking? | Y/N |
| 151 | Shadow and Password files? | Y/N |
| 152 | ShellCode? | Y/N |
| 153 | Sniffers? | Y/N |
| 154 | Software Distribution Attacks / Defenses? | Y/N |
| 155 | Spoofing? | Y/N |
| 156 | SQL Injection Attacks / Defenses? | Y/N |
| 157 | Step-by-step approach used by many computer attackers? | Y/N |
| 158 | System Patching and Vulnerability Mitigation? | Y/N |
| 159 | TCP/UDP Protocols? | Y/N |
| 160 | Telephony War Dialers? | Y/N |
| 161 | Threats? | Y/N |
| 162 | Virtual Machines? | Y/N |
| 163 | Virtual Private Networks? | Y/N |
| 164 | Vulnerability Analysis? | Y/N |
| 165 | Vulnerability Scanners? | Y/N |
| 166 | Web Security and Vulnerability? | Y/N |
| 167 | Wireless Attack Tools? | Y/N |
| 168 | Does the Hacker Techniques Exploits and Incident Handling course offer at least 40% of the course as Hands-on Lab based training? | Y/N |
| 169 | Is your company willing to provide a custom mix of Hands-on Lab based training to create a custom course? | Y/N |
| 170 | $FILE_NAME (long filename & short filename)? | Y/N |
| 171 | Active Directory Group Policy use? | Y/N |
| 172 | Advanced NTFS Journal Parser (ANJP)? | Y/N |
| 173 | Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)? | Y/N |
| 174 | Alternate Data Streams (ADS)? | Y/N |
| 175 | Analyzing Process Objects Plugins (dllist, cmdline, getsids, handles, mutantscan)? | Y/N |
| 176 | Analyzing Process Objects? | Y/N |
| 177 | Application Deployment Software? | Y/N |
| 178 | Applications and Service Logs? | Y/N |
| 179 | Artifact Review: Focus on Program Execution? | Y/N |
| 180 | Autorunsc.exe Detection: Malware Persistence Mechanisms? | Y/N |
| 181 | Autostart Persistence Locations? | Y/N |
| 182 | Building IR Hunting Capability? | Y/N |
| 183 | Categories covered ATT&CK (i.e. privilege escalation, defense aviation, credential access, discovery, lateral movement, execution, collection, exfiltration, C2)? | Y/N |
| 184 | Change Journal $UsnJrnl? | Y/N |
| 185 | Code Injection & Rootkit Behavior? | Y/N |
| 186 | Code Injection? | Y/N |
| 187 | Common $Logfile Operation Codes? | Y/N |
| 188 | Common $UsnJrnl Reason Codes? | Y/N |
| 189 | Common Defense Evasion Techniques? | Y/N |
| 190 | Common Types Of Anti-Forensics Utilized (Timestomping, File Delete/Wiping, Data Encryption, Lifeless Malware, Registry Key/Value Deletion/Wiping, Hiding Data in the Registry, Event Log Deletion/Tampering)? | Y/N |
| 191 | Compromising Credentials: Cached Credentials (Extraction)? | Y/N |
| 192 | Compromising Credentials: Hashes? | Y/N |
| 193 | Compromising Credentials: LSA Secrets (Nishang)? | Y/N |
| 194 | Compromising Credentials: NTDS.DIT? | Y/N |
| 195 | Compromising Credentials: Token Stealing (Mimikatz)? | Y/N |
| 196 | Compromisingf Credentials: Tickets (Pass the Ticket (Mimikatz))? | Y/N |
| 197 | Create Triage Timeline Bodyfile Step 1: fls-m? | Y/N |
| 198 | Create Triage Timeline Bodyfile Step 2: mactime? | Y/N |
| 199 | Critical Remediation Event Steps? | Y/N |
| 200 | CSV Columns Needed; Traditional Timeline? | Y/N |
| 201 | Data Storage Organization (Data Layer, Cluster Allocation, Contiguous Disk Space, Slack Space, Metadata Layer, Filesystem Metadata, Metadata: Allocated Or Unallocated, Sequential MFT Entries,)? | Y/N |
| 202 | Deep-Dive forensics? | Y/N |
| 203 | Defending Credentials/Tickets? | Y/N |
| 204 | Defending Credentials: LSA Secrets? | Y/N |
| 205 | Defending Credentials: Tokens? | Y/N |
| 206 | Detecting Anti-Forensic: MFT Outlier Analysis? | Y/N |
| 207 | Detecting Anti-Forensics Timestamp Anomalies? | Y/N |
| 208 | Detecting Code Injection (ex. Zeuz/Zbot Artifacts)? | Y/N |
| 209 | Detecting Compromising Endpoints W/O Active Malware? | Y/N |
| 210 | Directory Listing ($130 Header, Index Entry? | Y/N |
| 211 | DLL Persistence Attacks? | Y/N |
| 212 | Does the Advanced Digital Forensics, Incident Response, and Threat Hunting course offer at least 40% of the course as Hands-on Lab based training? | Y/N |
| 213 | Enterprise Investigation? | Y/N |
| 214 | Enterprise scanning? | Y/N |
| 215 | Entropy/Packing Analysis? | Y/N |
| 216 | EPROCESS Blocks in Memory? | Y/N |
| 217 | Event Log Analysis for Resonders and Hunters? | Y/N |
| 218 | Event Log Analysis Resources? | Y/N |
| 219 | Event Log Explorer? | Y/N |
| 220 | Evolution of Credential Attack Mitigation? | Y/N |
| 221 | Evolution of IR Scripting? | Y/N |
| 222 | Extracting Event Logs (Get-WinEvent and Powershell) | Y/N |
| 223 | Extracting Processes, Drivers, and Objects in Volatility (dlldump, moddump, procdump, memdump, cmdscan, consoles, dumpfiles, filescan)? | Y/N |
| 224 | Fast Forensics/Triage extraction? | Y/N |
| 225 | File System Journaling Overview? | Y/N |
| 226 | Filesystem Timeline Reading? | Y/N |
| 227 | Filter_window.txt? | Y/N |
| 228 | Filtering the Super Timeline? | Y/N |
| 229 | Focus on context of artifacts in timeline? | Y/N |
| 230 | Future of IR: Powershell? | Y/N |
| 231 | Hash Dumping (Gsecdump, Mimikatz)? | Y/N |
| 232 | Hibernation File Analysis: hiberfil.sys? | Y/N |
| 233 | Hooking and Rootkit Detection? | Y/N |
| 234 | How is a File Written to Disk? | Y/N |
| 235 | Hunting vs. Reactive Response? | Y/N |
| 236 | ID Rogue Processes: Plugins (pslist, psscan, pstree, pstotal,malprocfind, processbl)? | Y/N |
| 237 | ID Rogue Processes? | Y/N |
| 238 | Impact? | Y/N |
| 239 | Importane of Knowing Key Windows processes? | Y/N |
| 240 | Incident Response & Hunting Across the Enterprise? | Y/N |
| 241 | Incident Response Using WMIC? | Y/N |
| 242 | Indicators of Compromise? | Y/N |
| 243 | Indicators sharing language (i.e STIX, CRITS info, Yara-Project, OpenIOC)? | Y/N |
| 244 | INDXParse.py Windows INDX Slack Parser? | Y/N |
| 245 | Intel Driven IR? | Y/N |
| 246 | IR Containment & Intel Dev? | Y/N |
| 247 | IR Follow Up? | Y/N |
| 248 | IR Hunt Team Roles? | Y/N |
| 249 | IR Identification? | Y/N |
| 250 | IR Preparation? | Y/N |
| 251 | IR Recovery? | Y/N |
| 252 | IR Remediation? | Y/N |
| 253 | istat: $FILE_NAME Attributes? | Y/N |
| 254 | istat: $STANDARD_INFORMATION Attributes? | Y/N |
| 255 | Journal Parsing jp? | Y/N |
| 256 | Journal Parsing Tools? | Y/N |
| 257 | Kansa + Third-Party Tools? | Y/N |
| 258 | Kansa Analysis Scripts? | Y/N |
| 259 | Kansa Modules.conf? | Y/N |
| 260 | Kansa: Powershell IR Framework? | Y/N |
| 261 | Kerboros Attacks ( Pass the ticket, Overpass the Hash, Kerberoasting, Golden Tike, Silver Ticket, Skeleton Key)? | Y/N |
| 262 | Kerboros Attacks Mitigations? | Y/N |
| 263 | Legimated Credentials? | Y/N |
| 264 | List Content Of Metadata:istat? | Y/N |
| 265 | Log2timeline.py Filter File? | Y/N |
| 266 | Log2timeline.py Parser Lists? | Y/N |
| 267 | LogFile Parser? | Y/N |
| 268 | MACB Meaning by Filesystem? | Y/N |
| 269 | Malware Hiding in Plain Sight? | Y/N |
| 270 | Malware ID: Anomalistic Behavior Detection? | Y/N |
| 271 | Malware Paradox? | Y/N |
| 272 | Master File Table (MFT)? | Y/N |
| 273 | Memory Analysis? | Y/N |
| 274 | Memory Analysis? | Y/N |
| 275 | Memory Forensics? | Y/N |
| 276 | Memory Forensics? | Y/N |
| 277 | Memory Process Objects? | Y/N |
| 278 | Memory Timeliner (timerliner, output)? | Y/N |
| 279 | MFT File Record Header? | Y/N |
| 280 | Microsoft Application Compatability Cashe/ShimCache? | Y/N |
| 281 | Network Artifacts (suspicious ports, connections, processes)? | Y/N |
| 282 | Network Artifacts plugins (connections, connscan, sockets, sockscan, netscan)? | Y/N |
| 283 | NTFS Attributes? | Y/N |
| 284 | NTFS Filesystem Analysis? | Y/N |
| 285 | NTFS LogFile Parser? | Y/N |
| 286 | NTFS Overview & Features? | Y/N |
| 287 | NTFS System Files? | Y/N |
| 288 | NTFS Timestamps (Modified, Accessed, MFT Modified, Created (MACB))? | Y/N |
| 289 | NTFS: What Data Still Exists Upon File Deletion? | Y/N |
| 290 | NTFS-linker? | Y/N |
| 291 | Opening, Sorting and Filtering in Timeline Explorer? | Y/N |
| 292 | OpenIOC editor? | Y/N |
| 293 | Plaso Dumpfile Information (pinfo.py)? | Y/N |
| 294 | Plaso Linux/Android/Mac? | Y/N |
| 295 | Plaso Registry (winreg) Parsers? | Y/N |
| 296 | Plaso Webhistory (webhist) Parsers? | Y/N |
| 297 | Plaso Windows Parsers (win_gen, winxp, win7)? | Y/N |
| 298 | PowerShell Basics: (Remoting, Authentication)? | Y/N |
| 299 | PsExec--Simple remote execution took? | Y/N |
| 300 | Registry and Password Analysis Plugins (printkey, svcscan, servicebe, autoruns, hashdumps, mimikatz)? | Y/N |
| 301 | Regular Expression Filtering? | Y/N |
| 302 | Remediation Event? | Y/N |
| 303 | Remote Desktop Services (RDP, VNC, TeamViewer)? | Y/N |
| 304 | RemoteShell Removing/WMIC? | Y/N |
| 305 | Rogue Processes? | Y/N |
| 306 | Rootkit Hooking (System Service Descriptor Table, Interrupt Descriptor Table, Import Address Table, I/O Request Packets)? | Y/N |
| 307 | Sample WMI Script wmic_lr_remote.com? | Y/N |
| 308 | Scheduled Tasks? | Y/N |
| 309 | Sec Intel Attack Progression Kill Chain? | Y/N |
| 310 | Security Log (Account Logon, Account Mgmt, Directory, Logon Events, Object Access, Policy Change, Privilege Ue, Process Tracking, System ? | Y/N |
| 311 | Shadow Copy Volumes? | Y/N |
| 312 | Six-Step Incident Response (IR) Process? | Y/N |
| 313 | Standard Windows Time Rules and Exceptions? | Y/N |
| 314 | Super Timeline Analysis (Understanding and Parsing the supertimeline.csv file)? | Y/N |
| 315 | Super Timeline w/Plaso and Log2timeline.py? | Y/N |
| 316 | The "Pivot" Point; How to determine the Pivot Point? | Y/N |
| 317 | The Zone.Identifier ADS: Evidence of Download? | Y/N |
| 318 | Threat (i.e Intent, Opportunity, Capability)? | Y/N |
| 319 | Threat Environment? | Y/N |
| 320 | Three Possible Detection Situations? | Y/N |
| 321 | Time Analysis? | Y/N |
| 322 | Timeline Analysis Process? | Y/N |
| 323 | Timeline Analysis Process (Determine Scope, Narrow Pivot Points, Determine the Best Process for Timeline Creation, Filter Timeline, Analyze Timeline)? | Y/N |
| 324 | Timeline Analysis? | Y/N |
| 325 | Timeline Analysis? | Y/N |
| 326 | Timeline Benefits (Utopia vs Reality, Useful Knowledge)? | Y/N |
| 327 | Timeline Context Clues? | Y/N |
| 328 | Timeline Data Filtering: psort.py? | Y/N |
| 329 | Timeline Evidence? | Y/N |
| 330 | Timeline Output (CSV)? | Y/N |
| 331 | Timestamp Anomalies analyzeMFT.py? | Y/N |
| 332 | Timestomp Detection? | Y/N |
| 333 | Transaction Logging $LogFile? | Y/N |
| 334 | Triage Filesystem Timelining? | Y/N |
| 335 | Trust Code Signing? | Y/N |
| 336 | Types of Event Logs (Security, System, Application, Custom)? | Y/N |
| 337 | Typical FILE Record? | Y/N |
| 338 | Understanding Risk? | Y/N |
| 339 | Understanding Timestamps: Lateral Movement Analysis? | Y/N |
| 340 | Unknown services? | Y/N |
| 341 | Unusual OS artifacts? | Y/N |
| 342 | USN-Journal-Parser usn.py? | Y/N |
| 343 | VM Memory Acquistion? | Y/N |
| 344 | Volatility Code Injection Plugins (malfind, ldrmodules, hollowfind)? | Y/N |
| 345 | Volatility Registery Analysis (shimcachemem, RecentFileCache.bcf, Amcache.hve)? | Y/N |
| 346 | Volatility Rootkit Detection Plugins (ssdt, psxview, modscan, apihooks, driverirp. Idt)? | Y/N |
| 347 | Volatility? | Y/N |
| 348 | Volatily--Timeliner? | Y/N |
| 349 | VSS Drive Image Examination (Vssadmin list shadows (Win, vshadowinfo (Linux), vshadowmount)? | Y/N |
| 350 | VSS Examination with log2timeline.py? | Y/N |
| 351 | Vulnerability Exploitation? | Y/N |
| 352 | Vulnerability? | Y/N |
| 353 | What about Rootkits? | Y/N |
| 354 | Where to Find Event Logs? | Y/N |
| 355 | Windows 10 Memory Forensics? | Y/N |
| 356 | Windows Admin Shares (C$, ADMIN$, IPC$)? | Y/N |
| 357 | Windows Filesystem Evolution (Fat 12/16, FAT 32, ExFat, Win NT File System (NTFS), ReFS)? | Y/N |
| 358 | Windows Memory Acquistion? | Y/N |
| 359 | Windows Prefetch? | Y/N |
| 360 | Windows Remote Management Tools (sc.exe, schtasks.exe., reg.exe, winrs.exe)? | Y/N |
| 361 | Windows Remote Management Tools --Task Scheduler v1.2? | Y/N |
| 362 | Windows Services? | Y/N |
| 363 | Windows Time Rules for $FILE_NAME? | Y/N |
| 364 | Windows Time Rules for $STANDARD_INFORMATION? | Y/N |
| 365 | WISP Windows INDX Slack Parser? | Y/N |
| 366 | WMI Event Consumers/Backdoors? | Y/N |
