TN-905: Cyber Threat Intelligence Analysis

 

Course Overview:

TechNow has worked worldwide enterprise infrastructures for over 30 years and has developed demos and labs to exemplify the techniques required to demonstrate technologies that effectively support CTI.  This course integrates well with our courses TN-575: Open Source Network Security Monitoring and TN-865: Wireshark Network Traffic and Security Analysis .

TechNow develops Cyber Ranges and makes them available for conferences in support of annual meetings for Cyber Threat Response Teams.  Developing scenarios and reacting to them appropriately is a big part of the value in understanding the contexts required to comprehend valuable CTI.   As with many advanced TechNow security courses, there is a large hands-on ratio.  This course helps Cyber Protection Teams (CPT), Defensive Cyber Operations (DCO), and Mission Defense Teams (MDT) to collect, analyze and apply targeted cyber intelligence to defensive operations in order to proactively act on and tune response to attacks by cyber adversaries.  CPT, DCO, and MDT can take preemptive action by utilizing CTI, understanding CTI tools, techniques and procedures (TTPs) needed to generate and consume timely and relevant intelligence to improve resilience and prevention.

This course focuses on the collection, classification, and exploitation of knowledge about adversaries and their TTPs. .  MDT puts us close the mission and helps define the internal context to be analyzed against the CTI.  TechNow pushes the student to truly understand how to think about and use CTI to make a difference.

Attendees to TN-905: Cyber Threat Intelligence Analysis will receive TechNow approved course materials and expert instruction.

Date/Locations:

No Events

Course Duration: 5 days

Course Objectives:

  • Learn to comprehend and develop complex scenarios
  • Identify and create intelligence requirements through practices such as threat modeling
  • Utilize threat modeling to drive intelligence handling and practices 
  • Breakdown tactical, operational, and strategic-level threat intelligence
  • Generate threat intelligence to detect, respond to, and defeat focused and targeted threats
  • How to collect adversary information creating better value CTI
  • How to filter and qualify external sources, mitigating low integrity intelligence
  • Create Indicators of Compromise (IOCs) in formats such as YARA, OpenIOC, and STIX
  • Move security maturity past IOCs into understanding and countering the behavioral tradecraft of threats
  • Breaking down threats mapped against their tradecraft to tweak IOCs
  • Establish structured analytical techniques to be successful in any security role
  • Learn and apply structured principles in support of CTI and how to communicate that to any security role.

Course Prerequisites:

Comments

Latest comments from students

 

Liked the class?  Then let everyone know!

TN-535: Certified Forensic Computer Examiner (CFCE)

CCFE Core Competencies

  • Procedures and Legal Issues
  • Computer Fundamentals
  • Partitioning Schemes
  • Data Recovery
  • Windows File Systems
  • Windows Artifacts
  • Report writing (Presentation of Finding)
  • Procedures and Legal issues
  1. Knowledge of search and subjection and rules for evidence as applicable to computer forensics.
  2. Ability to explain the on-scene action taken for evidence preservation.
  3. Ability to maintain and document an environment consolidating the computer forensics.
  • Computer Fundamentals
  1. Understand BIOS
  2. Computer hardware
  3. Understanding of numbering system (Binary, hexadecimal, bits, bytes).
  4. Knowledge of sectors, clusters, files.
  5. Understanding of logical and physical files.
  6. Understanding of logical and physical drives.
  • Partitioning schemes
  1. Identification of current partitioning schemes.
  2. Understanding of primary and extended partition.
  3. Knowledge of partitioning schemes and structures and system used by it.
  4. Knowledge of GUID and its application.
  • Windows file system
  1. Understanding of concepts of files.
  2. Understanding of FAT tables, root directory, subdirectory along with how they store data.
  3. Identification, examination, analyzation of NTFS master file table.
  4. Understanding of $MFT structure and how they store data.
  5. Understanding of Standard information, Filename, and data attributes.
  • Data Recovery
  1. Ability to validate forensic hardware, software, examination procedures.
  2. Email headers understanding.
  3. Ability to generate and validate forensically sterile media.
  4. Ability to generate and validate a forensic image of media.
  5. Understand hashing and hash sets.
  6. Understand file headers.
  7. Ability to extract file metadata from common file types.
  8. Understanding of file fragmentation.
  9. Ability to extract component files from compound files.
  10. Knowledge of encrypted files and strategies for recovery.
  11. Knowledge of Internet browser artifacts.
  12. Knowledge of search strategies for examining electronic
  • Windows Artifacts
  1. Understanding the purpose and structure of component files that create the windows registry.
  2. Identify and capability to extract the relevant data from the dead registry.
  3. Understand the importance of restore points and volume shadow copy services.
  4. Knowledge of the locations of common Windows artifacts.
  5. Ability to analyze recycle bin.
  6. Ability to analyze link files.
  7. Analyzing of logs
  8. Extract and view windows logs
  9. Ability to locate, mount and examine VHD files.
  10. Understand the Windows swap and hibernation files.
  • Report Writing (Presentation of findings)
  1. Ability to conclude things strongly based on examination observations.
  2. Able to report findings using industry standard technically accurate terminologies.
  3. Ability to explain the complex things in simple and easy terms so that non-technical people can understand clearly.
  4. Be able to consider legal boundaries when undertaking a forensic examination

Welcome to TechNow!

Welcome to TechNow! The Leader in Information Security Training & Computer Training.

The world of information security and computer training is ever changing.  The techniques and systems continue to evolve and we must stay current and diligent.  To do this, you can count on TechNow®…the leader in cybersecurity training and computer system training.

TechNow® has been training the leaders in the computer community for many years.  We provide training for students in a number of areas.  Our cybersecurity trainings include popular courses like D0D 8140, Security , CISM, CISSP, CEH,CCNA, and more.  With over 34 years of experience, we’re able to provide you with unmatched training and certification programs.

TechNow also provides a variety of other popular trainings for the computer professional including Cisco, EC-Council, CompTIA, Unix/Linux and more.

.

Search Our Site

Upcoming Events

  • CT-210: Project+
    • 02/17/2026 – 02/20/2026
    • San Antonio
  • PM-224: PMI Agile Certified Practitioner (PMI-ACP)® Prep Course
    • 02/17/2026 – 02/20/2026
    • San Antonio
  • TN-813: Certified in Governance, Risk and Compliance (CGRC)
    • 02/17/2026 – 02/20/2026
    • San Antonio
  • N-305: CCNA Bootcamp
    • 02/23/2026 – 02/27/2026
    • San Antonio
  • TN-555: Certified Ethical Hacker v13 (CEH)
    • 02/23/2026 – 02/27/2026
    • San Antonio
  • all events

    • in   

    N-595: VoIP Security Analysis and Design

    Course Overview:

    As VoIP (Voice-over IP) is integrated into the operations of many missions, it is imperative to understand its security ramifications.  In the N-595: VoIP Security Analysis and Design class the objectives are designed for those who are chartered with the responsibility of securing networks and application environments that incorporate VoIP.   Topics include how VoIP works, its interactions with the network, its vulnerabilities and mitigations.  Focus is on leading open source and proprietary technologies utilizing Asterisk and Cisco and the protocols SIP, H.323, RTP, MGCP, and Skinny.  Other protocols such as Nortel's UNIStim will be addressed.  As for Cisco, security pieces in the VoIP CallManager servers, Catalyst switches, IOS-based routers, and ASA firewalls, amounts to several different platforms, each with its own management interface and lockdown procedures.   Various open source tools including those in BackTrack are used for VoIP attacks.  A task list of actions for securing enterprise VoIP is carried out in hands-on labs, performed on Cisco phones, routers, switches, and ASA firewalls.

    Attendees to N-595: VoIP Security Analysis and Design will receive TechNow approved course materials and expert instruction.

    Dates/Locations:

    No Events

    Duration: 5 Days

    Course Objectives:

    • VoIP Architecture
    • VoIP Signaling and media protocols
    • Common VoIP authentication mechanisms
    • Common VoIP encryption techniques
    • VoIP protocol analysis with Wireshark
    • Maintaining QoS while mitigating DoS
    • VoXML, XML, and application integration security
    • Converged network security design and implementation
    • Impact of NAT and firewalls
    • SIP, H.323, and MGCP vulnerabilities
    • VPN, IPsec and SRTP to secure VoIP services
    • Penetration testing with open source tools
    • Attacks for Eavesdropping, call redirection, and DoS
    • Design of hacked firmware virtualization layer
    • Concise lockdown steps for network hardware and VoIP

    Prerequisites:

    • This is an advanced Information Security Course which requires basic Windows & UNIX competency
    • Certification or 2 years of experience in these operating systems is highly recommended
    • As well as an understanding of TCP/IP

    Comments

    Latest comments from students

    Liked the class?  Then let everyone know!

    TN-223: Advanced Shell Programming

     

    Course Overview:

    The course teaches students to use the sort, grep, sed, & awk utilities within Unix. Systems administrators, Unix users, & programmers benefit from the course showing them how to use the command line applications of sort, grep, sed, & awk commands as well as using sed & awk scripts that develop the users skills with the full power of these utilities.

    Attendees to TN-223: Advanced Shell Programming will receive TechNow approved course materials and expert instruction.

    Dates/Locations:

    No Events

    Duration: 3 Days

    Course Objectives:

    • Sorting files by line or field
    • Regular Expressions (meta character) with grep commands to locate specific lines in files
    • Performing non-interactive editing tasks with the sed command
    • Writing simple sed scripts to perform complex editing tasks
    • Using awk variables & arrays to sort data
    • Employing awk programs to manipulate numeric & textual data
    • Performing formatted printing in awk
    • Writing simple awk programs to write reports from data files
    • Using built-in awk functions & defining new functions
    • Write awk programs that make decisions based on numeric or string comparisons (branches & loops)
    • Grep, egrep extended metacharacters, combinations-lab advanced combinations- lab Sed
    • Basic commands- Lab, Advanced commands- Lab, Advanced scripting -Lab
    • Miscellaneous commands Tr, sort, cut, paste, pr -Lab

    Prerequisites:

    • TN-125: Introduction to UNIX & Linux
    • TN 215: Shell Programming.
    • Students should have a basic knowledge of UNIX commands including rm, cp, man, cat, & mkdir. Navigating directory structure using commands such as ls, cp, & pwd. Creating and editing files with the vi editor or text editor. Use of basic programming constructs, & commands such as variables & loops & how to write a simple program in a programming language.

    Comments

    Latest comments from students

     

    Liked the class?  Then let everyone know!