GCFE prep
Intermediate
Windows Forensic Analysis
Examine Windows systems to reconstruct user and attacker activity, and prepare for the GIAC GCFE exam.
Fees on request
Details
← All courses
Intermediate
Incident Handling & Attacker Techniques
Detect, respond to and contain common attacks, and prepare for the GIAC Certified Incident Handler (GCIH) exam.
This course prepares you for the GIAC GCIH exam objectives. iSecRadar is not affiliated with, sponsored by or endorsed by GIAC or the SANS Institute. GCIH is a certification of GIAC, and exam registration is completed directly with GIAC.
About the Incident Handling & Attacker Techniques course
Incident Handling & Attacker Techniques teaches you how attacks unfold and how to respond to them in a structured way. You study the techniques attackers use at each stage, from reconnaissance to persistence, and learn to detect, contain and recover from them.
The course follows the GIAC Certified Incident Handler (GCIH) exam objectives, so it serves both as practical incident response training and as preparation for the certification.
Who this course is for
- SOC analysts and incident responders
- System and network administrators who handle security events
- Security engineers preparing for the GCIH exam
- Graduates of the SOC Analyst Bootcamp
Prerequisites
- Networking and operating system fundamentals
- Comfort with the Windows and Linux command line
- Cybersecurity Fundamentals or SOC Analyst Bootcamp recommended
What you'll learn
- Apply a structured incident handling process from preparation to lessons learned
- Recognize common attacker techniques and the evidence they leave
- Contain and eradicate threats on endpoints and networks
- Prepare for the GCIH exam objectives
Syllabus
- Incident handling process and team roles
- Reconnaissance, scanning and enumeration from the defender’s view
- Password, web and network attacks and their detection
- Exploitation, persistence and lateral movement
- Containment, eradication and recovery
- Exam objectives review and practice questions
Hands-on labs and exercises
- Investigate simulated attacks across their full lifecycle
- Identify attacker activity in logs and network traffic
- Practice containment decisions on compromised lab hosts
- Build an incident handling checklist and report
- Timed practice questions mapped to GCIH objectives
Where this course takes you
- Incident handler and incident response analyst roles
- Progression from SOC Tier 1 to Tier 2 and incident response
- Foundation for the forensic courses in the DFIR path
Included
- Live sessions with session recordings
- Guided lab environment
- Certificate of completion
- Community and instructor Q&A
Incident Handling & Attacker Techniques: frequently asked questions
What is the GCIH certification?
GCIH (GIAC Certified Incident Handler) is a GIAC certification that validates the ability to detect, respond to and resolve security incidents and understand common attack techniques.
Is this an official GIAC or SANS course?
No. iSecRadar is not affiliated with GIAC or SANS. The course is independent training aligned with the published GCIH exam objectives.
Should I take this course before the forensics courses?
Yes, for most learners. Incident handling gives you the context for Windows Forensic Analysis and Advanced Incident Response & Threat Hunting.
Keep learning
Recommended next courses
GCFA prep
Advanced
Advanced Incident Response & Threat Hunting
Investigate enterprise intrusions with memory forensics, timelines and threat hunting, and prepare for the GIAC GCFA exam.
Fees on request
Details