Module 1: Soft Skills and Incident Handling
• The candidate will understand the Engagement Lifecycle, Incident Chronology, Record Keeping, Interim Reporting and Results and Threat
Assessment.

Module 2: Core Technical Skills
• The candidate will demonstrate an understanding of IP protocols, Network Architectures, Commons Classes of Tools, OS Fingerprinting, Application Fingerprinting, Network Access Control Analysis, Cryptography, Applications of Cryptography, File System Permissions, Host Analysis Techniques and Understanding Common Data Formats.

Module 3: Background Information Gathering and Open Source
• The candidate will demonstrate an understanding of Registration Records, DNS, Open-Source Investigation and Web Enumeration, Extraction of Document Meta Date and Community Knowledge.

Module 4: Network Intrusion Analysis
• The candidate will understand the Network Traffic Capture, Data Sources and Network Log Sources, Network Configuration Security Issues, Unusual Protocol Behavior, Beaconing, Encryption, Command and Control Channels, Exfiltration of Data, Incoming Attacks, Reconnaissance, Internal Spread and Privilege Escalation, Web Based Attacks and False
Positive Acknowledgement.

Module 5: Analyzing Host Intrusions
• The candidate will demonstrate an understanding of Host-based Data Acquisition, Windows File System Essentials, Windows File Structures, Application File Structures, Windows Registry Essentials, Identifying
Suspect Files, Storage Media, Memory Analysis, Infection Vectors, Malware Behaviors and Anti-Forensics, Rootkit Identification, Live Malware Analysis and Linux OS File Structures.

Module 6: Malware Analysis/Reverse Engineering
• The candidate will have a high-level understanding of Functionality Identification, Cryptographic Techniques, Windows Executable File Formats, Hiding Techniques and Behavioral Analysis.