FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

In-Person, Virtual or Self-Paced Attend a live, instructor-led class at a location near you or remotely, or train on your time over 4 months

Attend a live, instructor-led class at a location near you or remotely, or train on your time over 4 months

Intermediate Skill Level Course material is geared for cyber security professionals with hands-on experience

Course material is geared for cyber security professionals with hands-on experience

35 Hands-On Lab(s) Apply what you learn with hands-on exercises and labs

Apply what you learn with hands-on exercises and labs

Learn the advanced incident response and threat hunting skills you need to identify, counter, and recover from a wide range of threats within enterprise networks.

Apply forensic tools and techniques to investigate intrusions across enterprise systems

Perform root cause analysis using host, log, and memory artifacts

Analyze attacker activity, including persistence, lateral movement, and C2 techniques

Build and analyze timelines to reconstruct attack sequences

Use memory and host-based analysis to identify malicious activity

Counter anti-forensics techniques and recover deleted or hidden data

Use AI-assisted analysis to support data review while maintaining forensically sound practices

Learn from curriculum that keeps pace with modern attacker tradecraft

Build skills that map directly to day-to-day analyst work

Understand attacker TTPs to perform proactive threat hunting and compromise assessments

Leverage threat intelligence to track targeted adversaries in active investigations and prepare for future intrusion events

Implement tools and strategies to harness AI for scalable response

Leads to the GCFA GIAC certification that validates analyst skills

How FOR508 Prepares You for GCFA

FOR508 is built around the exam objectives that make up the GCFA certification:

Section 1, Advanced Incident Response and Threat Hunting builds skills tested under Enterprise Environment Incident Response and Identification of Malicious and Normal System and User Activity.

Section 2, Intrusion Analysis aligns with Windows Artifact Analysis and Identification of Malicious and Normal System and User Activity.

Section 3, Memory Forensics in Incident Response and Threat Hunting builds skills tested under Introduction to Memory Forensics, Analyzing Volatile Malicious Event Artifacts, and Analyzing Volatile Windows Event Artifacts.

Section 4, Timeline Analysis aligns with Introduction to File System Timeline Forensics and File System Timeline Artifact Analysis.

Section 5, Incident Response and Hunting Across the Enterprise / Advanced Adversary and Anti-Forensics Detection builds skills tested under NTFS Artifact Analysis and further work in Identification of Malicious System and User Activity.

Section 6, The APT Threat Group Incident Response Challenge pulls all ten GCFA objectives together in one enterprise intrusion investigation across more than thirty systems.

Across all six sections, 35 hands-on labs and a capstone APT Threat Group Incident Response Challenge give you the chance to apply each skill in a live Windows enterprise environment before you sit the exam.

Read the full GCFA certification overview.

Explore the course syllabus below to view the full range of topics covered in FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics.

Section 1 Advanced Incident Response and Threat Hunting

We start by examining the six-step incident response methodology as it applies to incident response for advanced threat groups. We the importance of developing cyber threat intelligence to impact the adversaries' objectives and demonstrate forensic live response techniques that can be applied both to single systems and across the entire enterprise.

Real Incident Response Tactics

Incident Response and Hunting Across the Enterprise

Artificial Intelligence for Incident Response

Malware and Persistence Identification

Prevention and Mitigation of Credential Theft

APT Incident Response Scenario Introduction

Malware Persistence Detection and Analysis

Creating Triage Evidentiary Images

Scaling Remote Endpoint Incident Response

Section 2 Intrusion Analysis

In Section two, we cover common attacker tradecraft and the various data sources and forensic tools you can use to identify malicious activity in the enterprise. Get ready to hunt!

Advanced Evidence of Execution Detection

Lateral Movement Adversary Tactics and Techniques

Log Analysis for Incident Responders and Hunters

Investigating WMI and PowerShell-Based Attacks

Hunting and Detecting Evidence of Execution at Scale

Discovering Credential Abuse

Tracking Lateral Movement

WMI, PowerShell, and Microsoft Defender Log Analysis

Section 3 Memory Forensics in Incident Response and Threat Hunting

Section three will cover many of the most powerful memory analysis capabilities available and give analysts a solid foundation of advanced memory forensic skills to super-charge investigations, regardless of the toolset employed.

Endpoint Detection and Response

Memory Acquisition and Forensics Analysis

Memory Forensics Examinations

Memory Analysis Tools

Detect Custom Malware in Memory

Examine Windows Process Trees

Analyze Process Objects

Identify Code Injection and Rootkit Hiding Techniques

Perform Targeted Data Extraction from Memory

Section 4 Timeline Analysis

This section will step students through two primary methods of building and analyzing timelines used for DFIR analysis. We demonstrate how to create the timelines and how to use them effectively to find answers quickly. The section concludes with a discussion on agentic AI for further enhancing and accelerating DFIR investigations.

Timeline Analysis Overview

Filesystem Timeline Creation and Analysis

Super Timeline Creation and Analysis

Agentic AI for DFIR Investigations

Filesystem Timeline Creation and Analysis

Super Timeline Creation

Tracking Adversary Activity with Super Timeline Analysis

Scaling Analysis with Agentic AI

Scaling Analysis with Elasticsearch

Section 5 Incident Response and Hunting Across the Enterprise | Advanced Adversary and Anti-Forensics Detection

In section five, we focus on recovering files, file fragments, and file metadata for the investigation. These trace artifacts can help the analyst uncover deleted logs, attacker tools, malware configuration information, exfiltrated data, and more. While very germane to intrusion cases, these techniques are applicable in nearly every forensic investigation.

Volume Shadow Copy Analysis

Advanced NTFS Filesystem Tactics

Advanced Evidence Recovery

Volume Shadow Snapshot Analysis

Anti-Forensics Analysis using NTFS

Advanced Data Recovery

Section 6 The APT Threat Group Incident Response Challenge

This incredibly rich and realistic enterprise intrusion exercise brings it all together using a real intrusion into a complete Windows enterprise environment. You will be asked to uncover how the systems were compromised initially, find other compromised systems via adversary lateral movement, and identify intellectual property stolen via data exfiltration.

Things You Need To Know

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

Mandatory System Hardware Requirements

CPU: 64-bit Intel i5/i7/i9 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.

CRITICAL: Apple Silicon devices cannot perform the necessary virtualization and therefore cannot in any way be used for this course.

BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.

16GB of RAM or is required. 32GB of RAM is recommended.

350GB of free storage space or more is required.

Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

Mandatory Host Configuration And Software Requirements

Your host operating system must be the latest version of Windows 10, Windows 11, or macOS (for Intel-based Macs only).

Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.

Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.

Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.

You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.

Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls, proxies, and VPNs should be disabled, or you must have the administrative privileges to disable it.

Download and install the latest version of VMware Workstation Pro for Windows hosts, or VMWare Fusion Pro for Intel-based macOS hosts, prior to class beginning of class. Note that Workstation Pro and Fusion Pro are now available for free for both personal and commercial use from Broadcom.

On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.

Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The initial media files for class can be large, with some files in the 30-40GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions the laptop specifications, please customer service .

FOR508 training is recommended for a diverse range of individuals, including:

Incident Response Team Members who regularly respond to complex security incidents/intrusions from APT groups/advanced adversaries and need to know how to detect, investigate, remediate, and recover from compromised systems across endpoints in the enterprise.

Threat Hunters who are seeking to understand threats more fully and how to learn from them in order to more effectively hunt threats and counter their tradecraft.

SOC Analysts looking to better understand alerts, build the skills necessary to triage events, and fully leverage advanced endpoint detection and response (EDR) capabilities.

Experienced Digital Forensic Analysts who want to consolidate and expand their understanding of memory and timeline forensics, investigation of technically advanced individuals, incident response tactics, and advanced intrusion investigations.

Detection Engineers requiring a better understanding of attacker tradecraft to build more effective intrusion detection mechanisms.

Information Security Professionals who directly support and aid in responding to data breach incidents and intrusions.

Federal Agents and Law Enforcement Professionals who want to master advanced intrusion investigations and incident response, and expand their investigative skills beyond traditional host-based digital forensics.

Red Teamers, Penetration Testers, and Exploit Developers who want to learn how their opponents can identify their actions, how common mistakes can compromise operations on remote systems, and how to avoid those mistakes.

SANS FOR500 and SEC504 Graduates looking to take their skills to the level.

The GIAC Certified Forensic Analyst (GCFA) certification focuses on core skills required to collect and analyze data computer systems. Candidates have the knowledge, skills, and ability to conduct formal incident investigations and handle advanced incident handling scenarios, including internal and external data breach intrusions, advanced persistent threats, anti-forensic techniques used by attackers, and complex digital forensic cases.

Advanced Incident Response and Digital Forensics

Memory Forensics, Timeline Analysis, and Anti-Forensics Detection

Threat Hunting and APT Intrusion Incident Response

More Certification Details

Forensic Analysis Virtual Machines

This course extensively uses two virtual machines to teach incident responders and forensic analysts how to respond to and investigate sophisticated attacks.

The Linux SIFT VM contains hundreds of free and open-source tools, easily matching any modern forensic and incident response commercial tool suite.

Likewise, the Windows VM contains many free and open-source tools for performing highly-effective forensic analysis against one or many hosts.

Electronic Download Package Containing:

Disk images, triage images, memory captures, logs, and timelines from an enterprise-wide intrusion

Two SIFT Workstation virtual machines loaded with tools and documentation

A lab workbook comprised of over 500 pages of detailed step-by-step instructions and examples to help you master incident response and threat hunting

Video reviews of each lab in the workbook

PDFs of the course books

SANS DFIR Cheat Sheets to help use the tools in the field

A multitude of bonus labs and practice data ensure students can continue working and learning long after the course is completed

FOR508 training is an advanced incident response and threat hunting course that focuses on detecting and responding to advanced persistent threats and organized crime threat groups.The course does not cover the basics of incident response policies or digital forensics.

We recommend that you should have a background in FOR500: Windows Forensics prior to attending this course.

The FOR508 course is a part of the “Incident Response and Threat Hunting” Learning Path, with the goal of teaching skills every forensics and incident response professional should know.

Depending on your current or desired future role, one of these courses is a great step in your cybersecurity journey:

FOR500: Windows Forensic Analysis

FOR608: Enterprise-Class Incident Response & Threat Hunting

FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

Today’s cyber attackers use sophisticated techniques to evade detection, infiltrate networks, and persist undetected. Advanced Incident Response (IR), Threat Hunting, and Digital Forensics are essential for organizations to proactively detect, respond to, and recover from cyber incidents before they cause serious damage.

Why These Disciplines Are Crucial:

Threat hunting proactively identifies hidden threats that evade traditional security tools, such as fileless malware and living-off-the-land attacks.

Advanced IR minimizes business disruption by quickly detecting and neutralizing security breaches before they escalate.

Digital forensics uncovers how an attack occurred, tracing attacker movements, persistence mechanisms, and data exfiltration paths.

Organizations that actively hunt threats and improve response strategies can better withstand and recover from attacks.

Forensic investigations provide critical evidence for regulatory compliance, legal cases, and internal security audits.

When enterprises integrate these disciplines, they strengthen their cybersecurity posture, mitigate risks, and ensure rapid recovery from cyber threats, ultimately protecting sensitive data and maintaining business continuity.

Cyber threats are becoming more sophisticated, and organizations need skilled professionals who can detect, investigate, and respond to attacks effectively. FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics equips you with cutting-edge skills to stay ahead of adversaries, making you a highly valuable asset in cybersecurity.

Let’s look at how FOR508 can benefit your career:

Gain hands-on experience with tools like PowerShell, Velociraptor, and SIFT Workstation to hunt threats and analyze incidents.

Master advanced cybersecurity skills, making you a strong candidate for roles like Incident Responder, Threat Hunter, Digital Forensics Analyst, and SOC Analyst.

Learn how to detect hidden malware, analyze attack patterns, and track adversary movements across enterprise networks.

Professionals with specialized skills in IR, threat hunting, and forensics are in high demand, often commanding higher salaries.

Help proactively defend your organization against cyberattacks, minimizing risk and downtime.

Threat Hunter Training, Salary, and Career Path

This expert applies new threat intelligence against existing evidence to identify attackers that have slipped through real-time detection mechanisms. The practice of threat hunting requires several skill sets, including threat intelligence, system and network forensics, and investigative development processes. This role transitions incident response from a purely reactive investigative process to a proactive one, uncovering adversaries or their footprints based on developing intelligence.

All-Source Collection Manager (DCWF 311)

Identifies collection priorities, develops plans using available assets, and monitors execution to meet operational intelligence requirements.

Cyber Intelligence Analyst Training, Salary, and Career Path

Cyber Intelligence Analysts analyze evolving cyber threats, profile adversaries, and leverage intelligence platforms to proactively inform security decisions and mitigation strategies, bridging technical insights with strategic awareness.

Digital Forensics (DGFS)

Retrieval and interpretation of data from devices and networks to support incident response, compliance investigations, and legal cases. Work focuses on evidence integrity, validated methods, and attacker attribution.

All-Source Collection Requirements Manager (DCWF 312)

Evaluates collection strategies, develops and validates requirements, and assesses performance to optimize collection asset effectiveness.

Forensics Analyst (DCWF 211)

Investigates cybercrimes, analyzing digital media and logs to establish documentary or physical evidence in support of cyber intrusion cases.

Cyber Incident Responder Training, Salary, and Career Path

Monitor the organisation’s cybersecurity state, handle incidents during cyber-attacks and assure the continued operations of ICT systems.

Insider Threat Analysis

Responsible for identifying and assessing the capabilities and activities of cybersecurity insider threats; produces findings to help initialize and support law enforcement and counterintelligence activities and investigations.

Course Schedule and Pricing

Location & instructor Virtual (OnDemand) Instructed by Steve Anson Date & Time Course price $8,780 USD *Prices exclude applicable local taxes Registration Options Self-Paced

Location & instructor SANS Riyadh October 2026 Riyadh, SA & Virtual (live) Instructed by Kevin Ripa Date & Time Course price $8,900 USD *Prices exclude applicable local taxes Registration Options In-Person Virtual

SANS Riyadh October 2026

Riyadh, SA & Virtual (live)

Location & instructor SANS DFIR Summit & Training 2026 Arlington, VA, US & Virtual (live) Instructed by Carlos Cajigas Date & Time Course price $8,780 USD *Prices exclude applicable local taxes Registration Options In-Person Virtual

SANS DFIR Summit & Training 2026

Arlington, VA, US & Virtual (live)

Location & instructor SANS Melbourne October 2026 Melbourne, VIC, AU & Virtual (live) Instructed by Joshua Lemon Date & Time Course price A$13,350 AUD *Prices exclude applicable local taxes Registration Options In-Person Virtual

SANS Melbourne October 2026

Melbourne, VIC, AU & Virtual (live)

Location & instructor SANS Amsterdam October 2026 Amsterdam, NL Instructed by Jason Jordaan Date & Time Course price €8,230 EUR *Prices exclude applicable local taxes Registration Options In-Person

SANS Amsterdam October 2026

Location & instructor SANS Munich October 2026 Munich, DE Instructed by Mathias Fuchs Date & Time Course price €8,230 EUR *Prices exclude applicable local taxes Registration Options Join In-Person Waitlist

SANS Munich October 2026

Location & instructor SANS Cyber Safari 2026 Riyadh, SA & Virtual (live) Instructed by Adam Harrison Date & Time Course price $8,900 USD *Prices exclude applicable local taxes Registration Options Join In-Person Waitlist Virtual

SANS Cyber Safari 2026

Riyadh, SA & Virtual (live)

Location & instructor SANS Miami 2026 Coral Gables, FL, US & Virtual (live) Instructed by Carlos Cajigas Date & Time Course price $8,780 USD *Prices exclude applicable local taxes Registration Options In-Person Virtual

Coral Gables, FL, US & Virtual (live)

Location & instructor SANS Raleigh 2026 Raleigh, NC, US & Virtual (live) Instructed by Eric Zimmerman Date & Time Course price $8,780 USD *Prices exclude applicable local taxes Registration Options In-Person Virtual

Raleigh, NC, US & Virtual (live)

Location & instructor SANS San Francisco 2026 Virtual (live) Instructed by Carlos Cajigas Date & Time Course price $8,780 USD *Prices exclude applicable local taxes Registration Options Virtual

SANS San Francisco 2026

Benefits of Learning with SANS

Get feedback from the world’s best cybersecurity experts and instructors

Choose how you want to learn - online, on demand, or at our live in-person training events

Get access to our range of industry-leading courses and resources