Windows Security Researcher

Overview

Windows is the most used OS in the world, and thus is a favored target of malicious actors. Researching and finding OS vulnerabilities, dissecting viruses, worms, and other malicious entities is critically important in today’s security landscape. This path provides the necessary knowledge and understanding to allow research and reverse engineering of the OS and malicious payloads.

Syllabus

Windows Internals: Day 1
- This course provides the fundamental knowledge of Windows concepts and architecture, including processes, threads, virtual memory, system calls, DLLs, handles and objects. This will serve as a good foundation for the following courses which focus on programming.
Windows Internals: Day 2
- This course continues where Day 1 left off, digging deeper into processes – process creation and destruction, types of processes and more. Job objects are also described, including their extension called Silos that is the basis of Windows container implementation. Finally, threads are discussed, including scheduling and management.
Windows Internals: Day 5
- The last “day” in the Windows Internals series deals with two topics. The I/O system is described, including the use of device drivers, and their integration into the system as whole. Then many security mechanisms are discussed, from access tokens, security descriptors, to access checks and integrity levels, among others.
x64 Architecture and Programming (Part 1)
- This course teaches the basics of the x86/x64 assembly language from the ground up. It focuses on integrating it into C/C++ applications, but also shows how to write stand alone applications with assembly only.
Mastering WinDbg
- This course dives into the WinDbg debugger, and how to effectively use it in user mode and kernel mode debugging, as well as the analysis of kernel mode dump files.
Malware Analyst Professional – Level 1
- In this malware analysis and reverse engineering course, you will delve into the inner core of dissecting different malware types and variants, understand the adversarial mindset behind them and the used TTPs. At the end of the course, you will gain the power and knowledge to win against any malware coming your way.
Malware Analyst Professional – Level 2
- In this level 2 course, we will continue to dive into the profound and inner levels of the art of malware dissection and reverse engineering. You will learn about advanced malware evasion, privilege escalation, lateral movement, process injection and hooking techniques, shellcode analysis, advanced static and dynamic analysis techniques while analyzing sophisticated ransomware, info stealers and spyware families.