Module 10 · Foundations for the defenders

IR & Forensics

The discipline of what to do when the alarms go off, and how to figure out what actually happened. Most of Rolling Thunder Security's offerings are defense-oriented; this module gives you the foundations so when you take the dedicated DFIR classes later, the vocabulary is already familiar.

5

Reference pages

4

NIST IR phases

1

Hands-on lab

When prevention fails — and at some point it always does — incident response and digital forensics are what limit the damage and answer the inevitable question: what happened, who did it, what did they take, and how do we make sure it doesn't happen again?

Most of this course is defense: configure, harden, monitor. This module is the discipline you apply when those have already been bypassed. It's a smaller module deliberately — the goal is to give you the foundational vocabulary and process so when you take dedicated DFIR coursework later (Rolling Thunder Security 4xx series), nothing feels foreign.

10.A

Reference pages

The IR Lifecycle

NIST SP 800-61's four phases — Preparation, Detection & Analysis, Containment Eradication Recovery, Post-Incident Activity — with the artifacts and decisions that live in each.

Evidence Handling & Chain of Custody

Order of volatility, hashing for integrity, write-blockers for disk imaging, chain-of-custody documentation. What separates evidence a court will accept from evidence it won't.

Network Forensics

Packet captures vs NetFlow. Wireshark fundamentals. The "five Ws" of any network conversation: who talked to whom, when, how much, and over what protocol.

Volatile memory acquisition, disk imaging, registry hives, the Windows artifacts (Prefetch, Shimcache, Amcache, MFT) and Linux equivalents (auth.log, bash history, systemd journal) that tell the story of what ran when.

10.B

Hands-on lab

Log Analysis · Reconstruct an Intrusion

A real-shaped intrusion scenario. You have web access logs, auth logs, and host telemetry. Walk the timeline from initial access to data exfiltration, identify the IOCs, and write the incident report.