300‑215 CBRFIR – Full Syllabus

1.0 Fundamentals 

This domain covers foundational knowledge required for digital forensics and incident response:

• Components needed for a root cause analysis report

• Process of performing forensic analysis on infrastructure and network devices

• Antiforensic tactics, techniques, and procedures

• Recognize encoding and obfuscation techniques (base64, hex, polymorphic/metamorphic code)

• Basics of YARA rules for malware identification and classification

• Role and use of forensic tools such as:

  • Hex editors (e.g., HxD, Hiew, Hexfiend)

  • Disassemblers and debuggers (Ghidra, Radare, Evans Debugger)

  • Deobfuscation tools (XORBruteForces, xortool, unpackers)

  • Memory forensics tools

• Challenges gathering evidence from virtualized and cloud environments

2.0 Forensics Techniques 

Focuses on hands‑on techniques for identifying and analyzing malicious activity:

• Recognize MITRE ATT&CK methods used in fileless malware analysis

• Determine which files and their locations are relevant on a compromised host

• Evaluate outputs to identify Indicators of Compromise (IOC):

  • Process analysis

  • Log analysis (including cloud‑native logs)

  • Network traffic analysis for anomalies

• Identify the type of code from a snippet (static analysis)

• Construct scripts in Python, PowerShell, and Bash to parse and search logs or data sources (Cisco Umbrella, Sourcefire IPS, AMP for Endpoints/Network, PX‑Grid)

• Recognize purpose and use of forensic libraries and tools such as Volatility, Sysinternals, SIFT, and tcpdump

3.0 Incident Response Techniques (Approx ~30%)

Covers skills to respond to and mitigate security incidents:

• Interpret alert logs (IDS/IPS, syslogs) to identify security events

• Correlate data based on incident types (host and network‑based activities)

• Determine attack vectors or attack surface and recommend mitigation actions

• Recommend actions based on post‑incident analysis

• Recommend mitigation techniques for alerts from firewalls, IPS, Cisco Umbrella Investigate, Cisco Stealthwatch, SecureX, and other systems

• Respond to zero‑day exploit scenarios (vulnerability management)

• Leverage threat intelligence artifacts and Cisco security solution capabilities to determine IOCs and Indicators of Attack (IOA)

• Profile threat actors using evaluated artifacts

4.0 Forensic Processes 

This domain focuses on formal methods and tool usage in forensic investigations:

• Antiforensic techniques (debugging, geo‑location evasion, obfuscation)

• Analyze modern server and web application logs (Apache, NGINX)

• Analyze network traffic tied to malicious activities using tools like NetFlow and Wireshark

• Recommend next steps when evaluating files based on characteristics

• Interpret binaries using tools such as objdump and CLI tools (Linux, Python, Bash)

5.0 Incident Response Processes 

Focuses on structured incident handling:

• Goals of incident response

• Evaluate components required in an incident response playbook

• Interpret relevant parts of threat reports (e.g., Cisco ThreatGrid)

• Recommend next steps for file and endpoint evaluations and ad‑hoc scans based on scenario

Analyze threat intelligence in formats like STIX and TAXII