Cybersecurity, learned like a practitioner .

Reverse Engineering Windows Malware with Ghidra

Why this module exists. When static and dynamic analysis are not enough — the sample is too novel, the obfuscation is too thick, or you need to understand exactly what an algorithm does — disassembly is the answer. Ghidra is free, capable, and the industry default now that IDA Pro’s pricing has shifted to subscription-only. […]

May 14, 2026 40 min Open

Dynamic Malware Analysis & Sandboxing

Why this module exists. Sandboxes are not magic — sophisticated malware checks for them and either does nothing or does something different. Reading a sandbox report intelligently means knowing what the malware probably hid, not just what it did. The sandbox landscape Tool Type When to use ANY.RUN Interactive cloud First pass; you can click […]

May 14, 2026 30 min Open

Static Malware Analysis — Strings, Imports, YARA

Why this module exists. Running unknown malware on your laptop is how new IR responders become old IR responders. Static analysis is the lower-risk first cut: you learn whether the sample is interesting, what platform and architecture it targets, and what plausible behaviour it has — before you commit a sandbox to it. The five-minute […]

May 14, 2026 30 min Open

Forensic Timeline Reconstruction with Plaso

Why this module exists. An investigation has a hundred sources: event logs from five hosts, bash history, filesystem mtimes, audit logs, EDR alerts, NetFlow, cloud audit trail. Each has its own format and clock. The timeline is what merges them into one story. Without it, the investigation is fragments; with it, the investigation is a […]

May 13, 2026 35 min Open

Linux Forensics — Auditd, journalctl, Containers

Why this module exists. Linux IR responders often default to “tar up /var/log and call it done.” Modern Linux estates — especially in Indian cloud-native shops — have far richer artefacts available if you know to capture them. This module is the structured walkthrough. The first-response capture — what to grab in 5 minutes If […]

Windows Event Log Forensics — The IR Reference

Why this module exists. The defender’s biggest leverage in any Windows IR is the event log. The attacker’s biggest leverage in the same IR is knowing which events to clear. This module gives you the canonical event IDs, the queries that surface attacker activity, and the gaps that tell you something was cleaned. The seven […]

Memory Forensics with Volatility 3

Why this module exists. Half the modern malware ecosystem never writes a payload to disk — it lives in memory, injected into legitimate processes, and dies at reboot. Without memory forensics you are flying blind on that whole class. This module is the practitioner workflow. Acquisition — get the memory before you lose it Memory […]

May 13, 2026 35 min Open

Disk Imaging — Forensically Sound Acquisition

Why this module exists. “We made a copy of the disk” is not the same as “we forensically imaged the disk.” The difference matters for evidence admissibility, chain of custody, and for the analyst three weeks later trying to reproduce a finding. This module is the practitioner-level disk imaging guide. What forensically sound actually means […]

Security Policy Architecture — Policy, Standard, Procedure, Baseline

Why this module exists. Auditors ask for “the policy.” Engineers want “the rule.” Both are right; they are asking different questions of different layers. A coherent policy architecture answers both without contradiction. This module is the four-layer model and the operational guidance for building each layer. The four-layer model Layer What it states Approval level […]