GIAC Certified Forensic Analyst (GCFA)

About Course

The GIAC Certified Forensic Analyst (GCFA®) certification validates a practitioner’s command of core forensic skills to collect and analyze data in computer systems. GCFA® certification holders have the knowledge and ability to conduct formal incident investigations and handle advanced incident handling scenarios, including internal and external data breach intrusions, advanced persistent threats (APTs), anti-forensic techniques used by attackers, and complex digital forensic cases.

Course Content

Exam Simulator

GCFA Exam Simulator

GIAC GCFA Training

Getting Started with the SIFT Workstation Webcast with Rob Lee
01:10:46
Threat Hunting on the Cheap: Threat Hunting Summit 2016
39:05
Investigating WMI Attacks
01:00:42
FOR508 – Advanced Incident Response and Threat Hunting Course Updates: Hunting Guide
01:01:08
What is new in FOR500: Windows Forensics Course? Windows 10 and beyond –
01:02:03
Windows Credentials Attacks, Mitigations & Defense
01:06:15
SANS FOR508 OnDemand (with Japanese Subtitles) Demo Video
00:38
Introduction to Arsenal Image Mounter
17:06
Exploring Registry Explorer
01:01:51
DIY DNS DFIR: You’re Doing it WRONG: Threat Hunting Summit 2016
29:32
Detecting & Responding to Pandas and Bears:
37:13
Red Team Ops with Cobalt Strike (1 of 9): Operations
50:26
Windows Memory Forensics
56:51
Infosec Rock Star 2020: How to Accelerate Your Career | Ted Demopoulos
01:01:17
SANS Live Online Interactive Local Lab Demo – FOR508: Advanced Incident Response
02:56
SANS How To’s: SRUM-DUMP (System Resource Utilization Monitor) Tool
11:46
SANS DFIR Webcast – Memory Forensics for Incident Response
01:08:09
What’s New in REMnux v7
01:00:53
Advanced Zeek Usage Scripting and Framework
58:21
Linux Command Line Dojo II – Return of the Sensei
01:06:12
SANS Webcast: Breaking Red – Understanding Threats through Red Teaming
47:17
Principal Instrutora da Sans Technology Institute fala sobre Endpoints Forenses – CSSB2018
47:54
Investigating Malware Using Memory Forensics – A Practical Approach
01:03:21
Practical Malware Analysis Essentials for Incident Responders
50:48
SANS DFIR WEBCAST – Protecting Privileged Domain Accounts during Live Response –
01:23:08
SANS DFIR Webcast – APT Investigations — How To The Forensic Side
01:03:50
Introducing the New SANS DFIR “Hunt Evil“ Poster
01:01:26
Building an Incident Response Program Lesley Carhart
03:06:00
Forensic Acquisition in Windows – FTK Imager
29:02
SANS GIAC Certification Exam Guidelines and Recommendations
16:40
SANS DFIR Webcast – Incident Response Event Log Analysis
48:49
Behind The Scenes Of Law Enforcement And Private Industry Cooperation | STAR Webcawst
01:00:17
What Event Logs? Part 1: Attacker Tricks to Remove Event Logs
01:06:21
Fast, Scalable Results with EZ Tools and the New Command line poster
01:01:22
Real-Time Threat Hunting – SANS Threat Hunting & Incident Response Summit 2017
28:09
Threat Hunting: Memory Analysis with Volatility
01:17:54
Threat Hunting w/ Elasticsearch, Logstash, Kibana and Beats part #1
01:05:09
FOR572: Always Updating, Never at Rest
58:19
Prefetch Deep Dive
36:14
Cloud Storage Forensics Endpoint Evidence
01:06:44
Atomic Friday: Invoke-AtomicRedTeam (September 2019)
48:41
Threat Hunting via Sysmon – SANS Blue Team Summit
51:00
Virtuous Cycles: Rethinking the SOC for Long-Term Success | SANS Security Operations Summit 2019
31:56
Credential Guard on Windows 10 Enterprise
04:55
Episode 23: “Quick Win” files #5 – Prefetch-Part 1
03:01
There’s Something About WMI – DFIR Summit 2015
01:06:53
Abusing Windows Management Instrumentation (WMI)
50:00
Introduction to Kansa – PowerShell-based Incident Response
22:09
Finding Evil with YARA
17:56
Memory Forensics Baselines
14:45
Introduction to KAPE
18:41
RDP Event Log Forensics
15:33
Understanding the Forensic Science in Digital Forensics
56:55
MAC Times, Mac Times, and More – SANS Digital Forensics & Incident Response Summit 2017
26:24
Forgotten But Not Gone: Gathering NTFS Artifacts of Deletion – SANS Tactical Detection Summit 2018
31:45
The ABCs of WMI – Finding Evil in Plain Sight
15:55
RVAs3c: David Bianco: Pyramid of Pain: Intel-Driven Detection/Response to Increase Adversary’s Cost
49:43
MITRE ATT&CK Framework For Threat Hunting – Seth Brunt and Abby Warnes
29:57

Student Ratings & Reviews

No Review Yet

About Course

Course Content

Exam Simulator

GCFA Exam Simulator

GIAC GCFA Training

Getting Started with the SIFT Workstation Webcast with Rob Lee

Threat Hunting on the Cheap: Threat Hunting Summit 2016

Investigating WMI Attacks

FOR508 – Advanced Incident Response and Threat Hunting Course Updates: Hunting Guide

What is new in FOR500: Windows Forensics Course? Windows 10 and beyond –

Windows Credentials Attacks, Mitigations & Defense

SANS FOR508 OnDemand (with Japanese Subtitles) Demo Video

Introduction to Arsenal Image Mounter

Exploring Registry Explorer

DIY DNS DFIR: You’re Doing it WRONG: Threat Hunting Summit 2016

Detecting & Responding to Pandas and Bears:

Red Team Ops with Cobalt Strike (1 of 9): Operations

Windows Memory Forensics

Infosec Rock Star 2020: How to Accelerate Your Career | Ted Demopoulos

SANS Live Online Interactive Local Lab Demo – FOR508: Advanced Incident Response

SANS How To’s: SRUM-DUMP (System Resource Utilization Monitor) Tool

SANS DFIR Webcast – Memory Forensics for Incident Response

What’s New in REMnux v7

Advanced Zeek Usage Scripting and Framework

Linux Command Line Dojo II – Return of the Sensei

SANS Webcast: Breaking Red – Understanding Threats through Red Teaming

Principal Instrutora da Sans Technology Institute fala sobre Endpoints Forenses – CSSB2018

Investigating Malware Using Memory Forensics – A Practical Approach

Practical Malware Analysis Essentials for Incident Responders

SANS DFIR WEBCAST – Protecting Privileged Domain Accounts during Live Response –

SANS DFIR Webcast – APT Investigations — How To The Forensic Side

Introducing the New SANS DFIR “Hunt Evil“ Poster

Building an Incident Response Program Lesley Carhart

Forensic Acquisition in Windows – FTK Imager

SANS GIAC Certification Exam Guidelines and Recommendations

SANS DFIR Webcast – Incident Response Event Log Analysis

Behind The Scenes Of Law Enforcement And Private Industry Cooperation | STAR Webcawst

What Event Logs? Part 1: Attacker Tricks to Remove Event Logs

Fast, Scalable Results with EZ Tools and the New Command line poster

Real-Time Threat Hunting – SANS Threat Hunting & Incident Response Summit 2017

Threat Hunting: Memory Analysis with Volatility

Threat Hunting w/ Elasticsearch, Logstash, Kibana and Beats part #1

FOR572: Always Updating, Never at Rest

Prefetch Deep Dive

Cloud Storage Forensics Endpoint Evidence

Atomic Friday: Invoke-AtomicRedTeam (September 2019)

Threat Hunting via Sysmon – SANS Blue Team Summit

Virtuous Cycles: Rethinking the SOC for Long-Term Success | SANS Security Operations Summit 2019

Credential Guard on Windows 10 Enterprise

Episode 23: “Quick Win” files #5 – Prefetch-Part 1

There’s Something About WMI – DFIR Summit 2015

Abusing Windows Management Instrumentation (WMI)

Introduction to Kansa – PowerShell-based Incident Response

Finding Evil with YARA

Memory Forensics Baselines

Introduction to KAPE

RDP Event Log Forensics

Understanding the Forensic Science in Digital Forensics

MAC Times, Mac Times, and More – SANS Digital Forensics & Incident Response Summit 2017

Forgotten But Not Gone: Gathering NTFS Artifacts of Deletion – SANS Tactical Detection Summit 2018

The ABCs of WMI – Finding Evil in Plain Sight

RVAs3c: David Bianco: Pyramid of Pain: Intel-Driven Detection/Response to Increase Adversary’s Cost

MITRE ATT&CK Framework For Threat Hunting – Seth Brunt and Abby Warnes

Student Ratings & Reviews