GIAC Certified Forensic Analyst (GCFA)

About Course

The GIAC Certified Forensic Analyst (GCFA®) certification validates a practitioner’s command of core forensic skills to collect and analyze data in computer systems. GCFA® certification holders have the knowledge and ability to conduct formal incident investigations and handle advanced incident handling scenarios, including internal and external data breach intrusions, advanced persistent threats (APTs), anti-forensic techniques used by attackers, and complex digital forensic cases.

Course Content

Exam Simulator

GCFA Exam Simulator

GIAC GCFA Training

Getting Started with the SIFT Workstation Webcast with Rob Lee

01:10:46
Threat Hunting on the Cheap: Threat Hunting Summit 2016

39:05
Investigating WMI Attacks

01:00:42
FOR508 – Advanced Incident Response and Threat Hunting Course Updates: Hunting Guide

01:01:08
What is new in FOR500: Windows Forensics Course? Windows 10 and beyond –

01:02:03
Windows Credentials Attacks, Mitigations & Defense

01:06:15
SANS FOR508 OnDemand (with Japanese Subtitles) Demo Video

00:38
Introduction to Arsenal Image Mounter

17:06
Exploring Registry Explorer

01:01:51
DIY DNS DFIR: You’re Doing it WRONG: Threat Hunting Summit 2016

29:32
Detecting & Responding to Pandas and Bears:

37:13
Red Team Ops with Cobalt Strike (1 of 9): Operations

50:26
Windows Memory Forensics

56:51
Infosec Rock Star 2020: How to Accelerate Your Career | Ted Demopoulos

01:01:17
SANS Live Online Interactive Local Lab Demo – FOR508: Advanced Incident Response

02:56
SANS How To’s: SRUM-DUMP (System Resource Utilization Monitor) Tool

11:46
SANS DFIR Webcast – Memory Forensics for Incident Response

01:08:09
What’s New in REMnux v7

01:00:53
Advanced Zeek Usage Scripting and Framework

58:21
Linux Command Line Dojo II – Return of the Sensei

01:06:12
SANS Webcast: Breaking Red – Understanding Threats through Red Teaming

47:17
Principal Instrutora da Sans Technology Institute fala sobre Endpoints Forenses – CSSB2018

47:54
Investigating Malware Using Memory Forensics – A Practical Approach

01:03:21
Practical Malware Analysis Essentials for Incident Responders

50:48
SANS DFIR WEBCAST – Protecting Privileged Domain Accounts during Live Response –

01:23:08
SANS DFIR Webcast – APT Investigations — How To The Forensic Side

01:03:50
Introducing the New SANS DFIR “Hunt Evil“ Poster

01:01:26
Building an Incident Response Program Lesley Carhart

03:06:00
Forensic Acquisition in Windows – FTK Imager

29:02
SANS GIAC Certification Exam Guidelines and Recommendations

16:40
SANS DFIR Webcast – Incident Response Event Log Analysis

48:49
Behind The Scenes Of Law Enforcement And Private Industry Cooperation | STAR Webcawst

01:00:17
What Event Logs? Part 1: Attacker Tricks to Remove Event Logs

01:06:21
Fast, Scalable Results with EZ Tools and the New Command line poster

01:01:22
Real-Time Threat Hunting – SANS Threat Hunting & Incident Response Summit 2017

28:09
Threat Hunting: Memory Analysis with Volatility

01:17:54
Threat Hunting w/ Elasticsearch, Logstash, Kibana and Beats part #1

01:05:09
FOR572: Always Updating, Never at Rest

58:19
Prefetch Deep Dive

36:14
Cloud Storage Forensics Endpoint Evidence

01:06:44
Atomic Friday: Invoke-AtomicRedTeam (September 2019)

48:41
Threat Hunting via Sysmon – SANS Blue Team Summit

51:00
Virtuous Cycles: Rethinking the SOC for Long-Term Success | SANS Security Operations Summit 2019

31:56
Credential Guard on Windows 10 Enterprise

04:55
Episode 23: “Quick Win” files #5 – Prefetch-Part 1

03:01
There’s Something About WMI – DFIR Summit 2015

01:06:53
Abusing Windows Management Instrumentation (WMI)

50:00
Introduction to Kansa – PowerShell-based Incident Response

22:09
Finding Evil with YARA

17:56
Memory Forensics Baselines

14:45
Introduction to KAPE

18:41
RDP Event Log Forensics

15:33
Understanding the Forensic Science in Digital Forensics

56:55
MAC Times, Mac Times, and More – SANS Digital Forensics & Incident Response Summit 2017

26:24
Forgotten But Not Gone: Gathering NTFS Artifacts of Deletion – SANS Tactical Detection Summit 2018

31:45
The ABCs of WMI – Finding Evil in Plain Sight

15:55
RVAs3c: David Bianco: Pyramid of Pain: Intel-Driven Detection/Response to Increase Adversary’s Cost

49:43
MITRE ATT&CK Framework For Threat Hunting – Seth Brunt and Abby Warnes

29:57

Student Ratings & Reviews

No Review Yet

About Course

Course Content

Exam Simulator

GCFA Exam Simulator

GIAC GCFA Training

Getting Started with the SIFT Workstation Webcast with Rob Lee

Threat Hunting on the Cheap: Threat Hunting Summit 2016

Investigating WMI Attacks

FOR508 – Advanced Incident Response and Threat Hunting Course Updates: Hunting Guide

What is new in FOR500: Windows Forensics Course? Windows 10 and beyond –

Windows Credentials Attacks, Mitigations & Defense

SANS FOR508 OnDemand (with Japanese Subtitles) Demo Video

Introduction to Arsenal Image Mounter

Exploring Registry Explorer

DIY DNS DFIR: You’re Doing it WRONG: Threat Hunting Summit 2016

Detecting & Responding to Pandas and Bears:

Red Team Ops with Cobalt Strike (1 of 9): Operations

Windows Memory Forensics

Infosec Rock Star 2020: How to Accelerate Your Career | Ted Demopoulos

SANS Live Online Interactive Local Lab Demo – FOR508: Advanced Incident Response

SANS How To’s: SRUM-DUMP (System Resource Utilization Monitor) Tool

SANS DFIR Webcast – Memory Forensics for Incident Response

What’s New in REMnux v7

Advanced Zeek Usage Scripting and Framework

Linux Command Line Dojo II – Return of the Sensei

SANS Webcast: Breaking Red – Understanding Threats through Red Teaming

Principal Instrutora da Sans Technology Institute fala sobre Endpoints Forenses – CSSB2018

Investigating Malware Using Memory Forensics – A Practical Approach

Practical Malware Analysis Essentials for Incident Responders

SANS DFIR WEBCAST – Protecting Privileged Domain Accounts during Live Response –

SANS DFIR Webcast – APT Investigations — How To The Forensic Side

Introducing the New SANS DFIR “Hunt Evil“ Poster

Building an Incident Response Program Lesley Carhart

Forensic Acquisition in Windows – FTK Imager

SANS GIAC Certification Exam Guidelines and Recommendations

SANS DFIR Webcast – Incident Response Event Log Analysis

Behind The Scenes Of Law Enforcement And Private Industry Cooperation | STAR Webcawst

What Event Logs? Part 1: Attacker Tricks to Remove Event Logs

Fast, Scalable Results with EZ Tools and the New Command line poster

Real-Time Threat Hunting – SANS Threat Hunting & Incident Response Summit 2017

Threat Hunting: Memory Analysis with Volatility

Threat Hunting w/ Elasticsearch, Logstash, Kibana and Beats part #1

FOR572: Always Updating, Never at Rest

Prefetch Deep Dive

Cloud Storage Forensics Endpoint Evidence

Atomic Friday: Invoke-AtomicRedTeam (September 2019)

Threat Hunting via Sysmon – SANS Blue Team Summit

Virtuous Cycles: Rethinking the SOC for Long-Term Success | SANS Security Operations Summit 2019

Credential Guard on Windows 10 Enterprise

Episode 23: “Quick Win” files #5 – Prefetch-Part 1

There’s Something About WMI – DFIR Summit 2015

Abusing Windows Management Instrumentation (WMI)

Introduction to Kansa – PowerShell-based Incident Response

Finding Evil with YARA

Memory Forensics Baselines

Introduction to KAPE

RDP Event Log Forensics

Understanding the Forensic Science in Digital Forensics

MAC Times, Mac Times, and More – SANS Digital Forensics & Incident Response Summit 2017

Forgotten But Not Gone: Gathering NTFS Artifacts of Deletion – SANS Tactical Detection Summit 2018

The ABCs of WMI – Finding Evil in Plain Sight

RVAs3c: David Bianco: Pyramid of Pain: Intel-Driven Detection/Response to Increase Adversary’s Cost

MITRE ATT&CK Framework For Threat Hunting – Seth Brunt and Abby Warnes

Student Ratings & Reviews