Memory Forensics Courses and Certifications

DFIRScience

Introduction to Memory Forensics with Volatility 3

1 rating

Learn to use Volatility 3 to extract investigative evidence from Windows RAM images, including processes, files, network connections, password hashes, and Registry activity.

• YouTube
• 32 minutes
• Self-Paced
• Free Video

DEFCONConference

Defeating EDR Evading Malware with Memory Forensics

Discover advanced memory forensics techniques to detect and analyze EDR-evading malware, including system call manipulation, module overwriting, and debug register abuse.

• YouTube
• 44 minutes
• Self-Paced
• Free Video

Linode

Memory Forensics with Volatility - HackerSploit Blue Team Series

Analyze Windows memory dumps with Volatility to uncover hidden processes, executed commands, extracted files, and other evidence of system compromise.

• YouTube
• 35 minutes
• Self-Paced
• Free Video

Learn memory analysis for incident handling using FTK, Redline, and virtual machine and malware labs to investigate attacks.

• Cybrary
• 1-2 hours
• Self-Paced
• Paid Course

DEFCONConference

StackMoonwalk: Advanced Memory Evasion Techniques Through Call Stack Tampering

Delve into advanced memory evasion techniques for cybersecurity, exploring novel "Full Moon" and "Half Moon" approaches to call stack tampering, plus learn detection methods using the Eclipse algorithm.

• YouTube
• 40 minutes
• Self-Paced
• Free Video

BSidesCharm

Detecting and Triaging Modern Windows Rootkits

Discover modern Windows rootkit detection techniques, memory forensics, and event log analysis methods to combat evolving kernel-level malware threats in Windows 10 and beyond.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

Recon Conference

WinPmem - Volatility's Driver That Lets Malware Volatilize

Uncover critical vulnerabilities in WinPmem driver used by Volatility and Velociraptor, including CVEs that allow malware to erase itself from memory and cause system crashes.

• YouTube
• 57 minutes
• Self-Paced
• Free Video

Black Hat

Investigating Malware Using Memory Forensics - A Practical Approach

Learn to use memory forensics to detect and investigate malware, uncover process injection and rootkits, and analyze stealth techniques.

• YouTube
• 1 hour 3 minutes
• Self-Paced
• Conference Talk

Black Hat

New Memory Forensics Techniques to Defeat Device Monitoring Malware

Explores algorithms and Volatility plugins for detecting userland malware that monitors hardware devices across major operating systems.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

Black Hat

Fixing a Memory Forensics Blind Spot - Linux Kernel Tracing

Examines how Linux kernel tracing infrastructure can close a blind spot that leaves attackers undetected in memory-forensics research.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

nullcon

GPG Memory Forensics

Demonstrates extracting GnuPG passphrases, encryption keys, and plaintext from gpg-agent or full-system memory dumps with Volatility3.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

Infosec

Cyber Threat Hunting

139 ratings at Coursera

Build threat hunting skills: form hypotheses, work with indicators of compromise and the Pyramid of Pain, hunt SIEM, EDR and XDR data, and investigate network- and host-based threats.

• Coursera
• 9 weeks, 1 hour a week
• Self-Paced
• Paid Course

Infosec

Technical Deep Dive with Incident Response Tools

97 ratings at Coursera

Work through the incident response phases hands-on: analyze memory and network artifacts, investigate breach and live-hacking scenarios, and hunt SolarWinds indicators of compromise.

• Coursera
• 5 weeks, 1 hour a week
• Self-Paced
• Paid Course

Cyber Security: Digital Forensics

31 ratings at Coursera

Recover hidden and deleted files from Windows, Linux and macOS file systems, capture volatile RAM and network traffic, and extract evidence from mobile and IoT devices.

• Coursera
• 6 weeks, 2 hours a week
• Self-Paced
• Paid Course

Learn Windows-specific digital forensics, including disk imaging, memory analysis, registry and artifact examination, USB history, steganography, and email evidence.

• Cybrary
• 4-5 hours
• Self-Paced
• Paid Course