Forensic Methodology for Security Engineers, IR Practitioners, and Incident Responders in Windows and M365 Environments
Incident Response: Windows and Microsoft 365
Investigate incidents across Windows and Microsoft 365 — from alert to containment report.
Trace an attacker through sign-in logs, endpoint telemetry, email evidence, and cloud audit trails using a consistent five-step methodology. Investigate AiTM phishing, BEC, ransomware, insider threat, and multi-vector attacks end-to-end. Write the KQL queries that find the evidence, make the containment decisions that stop the damage, and produce the investigation report that your CISO and legal counsel can act on.
What you'll be able to do
Who this course is for
“I triage alerts but I’ve never investigated an incident end-to-end.” You classify and escalate. The senior analyst does the investigation. You want to be the one who traces the attacker from the phishing email through the token replay, across the endpoint, into lateral movement, and produces the report that says exactly what happened. This course builds that capability.
“We had a ransomware incident and the investigation was chaos.” Nobody knew which evidence to collect first. Volatile data was lost when endpoints were rebooted. The investigation took three weeks instead of three days because there was no methodology. This course gives you the five-step reasoning chain and the tool pipeline that makes investigations systematic.
“I can run KAPE and Volatility but I don’t know what to do with the output.” Tool proficiency isn’t investigation proficiency. You collect a KAPE triage package and get 200 files. This course teaches you which artifacts answer which questions, how to correlate Prefetch with Event Logs with MFT timestamps, and how to build the timeline that tells the story.
“The attack crossed from M365 into on-prem and I lost the trail.” The attacker phished a credential in Exchange Online, replayed the token to access SharePoint, downloaded a payload to an endpoint, and moved laterally to the domain controller. You need to follow that trail across cloud audit logs, sign-in telemetry, and endpoint forensics. This course teaches that cross-domain correlation.
“My investigation report said ‘malware was found and removed’ and legal sent it back.” Legal counsel needs scope, impact, evidence chain, and remediation verification. Your CISO needs a timeline they can present to the board. This course builds the IR report that answers every question — what happened, how far it spread, what was taken, and how you know the attacker is out.
“I know IR from another platform and need the M365 investigation stack.” The forensic methodology transfers. The data sources don’t. SigninLogs, AuditLogs, DeviceProcessEvents, IdentityLogonEvents, CloudAppEvents — different tables, different schemas, different correlation points. This course gets you productive investigating in the Microsoft stack.
Whatever your background — if the subject interests you and you’re willing to put in the work, this course is for you.
Before and after this course
A BEC alert fires. You check the sign-in logs, see the suspicious IP, and reset the password. Investigation complete — except you didn’t check for inbox rules forwarding financial emails, OAuth app persistence, or whether the attacker accessed SharePoint. The real damage happens after your “containment.”
You run KAPE and get a directory of collected files. You know Prefetch exists, Event Logs exist, registry hives exist — but you don’t know which artifact answers “what executed at 2:14 AM” and which answers “how did they persist across reboot.”
The attacker moved from cloud to endpoint. Your cloud investigation found the phishing email and the token replay. Your endpoint investigation found the malware. Nobody connected the two into a single timeline showing how they got from email to domain controller.
Your investigation report is a bullet list of findings. Legal counsel asks for the evidence chain. Your CISO asks for the timeline. The board asks for the business impact. You have none of these.
BEC alert fires. You trace the full chain: phishing email, token replay, inbox forwarding rule, SharePoint access, OAuth app consent. You contain all five persistence and access vectors before the attacker can use any of them. The investigation scope is complete because the methodology is complete.
KAPE collects. EZ Tools parses. You know Prefetch tells you what ran, AmCache tells you first execution, ShimCache tells you what the system knew about, and Event Log 7045 tells you what installed as a service. Each artifact answers a specific question and you pick the right one.
The unified timeline connects cloud and endpoint: phishing email at T+0, token replay at T+4 minutes, payload download at T+38 minutes, PsExec to the DC at T+2 hours 15 minutes. One timeline, one investigation, one report. The cross-domain correlation is the investigation.
Your IR report has the timeline, the evidence chain with hash verification, the scope assessment, the containment verification, the remediation recommendations, and the detection improvements. Legal, the CISO, and the board each get the document that answers their questions.
How the course works
Five phases build from methodology and tooling through forensic analysis to full investigation scenarios:
NIST SP 800-61 Rev 3 framework, five-step reasoning chain, toolkit setup (KAPE, Velociraptor, Volatility 3, EZ Tools), evidence acquisition procedures.
Execution artifacts, persistence mechanisms, filesystem and registry analysis, event log forensics, memory forensics with Volatility 3, lateral movement evidence.
M365 identity compromise, Exchange Online forensics, SharePoint and OneDrive evidence, Entra ID investigation, Defender XDR platform analysis.
Ransomware, BEC & financial fraud, insider threat with cloud sync exfil, APT with edge-appliance persistence. Full end-to-end investigations.
IR reporting for legal and leadership, building organizational readiness, tabletop exercises, and the multi-vector capstone investigation.
What the content looks like
This is a real investigation timeline from the BEC scenario. After tracing the attacker from phishing email through token replay to financial fraud, you reconstruct the cross-domain timeline that shows exactly what happened:
51 minutes from phishing email to fraudulent wire instruction. Every timestamp sourced from a specific log table. Every attacker action mapped to the evidence that proves it happened. The timeline is the investigation deliverable that legal, leadership, and law enforcement all need. Every module teaches at this level — the evidence, the query, the interpretation, and the documentation.
Lab Pack — Hands-On Investigation Practice
Production-grade lab pack that generates 41 realistic attack artifacts on your own VM — compiled PE binaries, macro-enabled Office documents, obfuscated PowerShell stagers, persistence mechanisms, credential access artifacts, staged exfiltration data, and suspicious processes for memory capture.
What’s included: Attack artifact generator (41 files, 10 persistence mechanisms, 4 suspicious processes), 6 HTML walkthrough guides covering the full DFIR workflow, 40 structured labs with graduated difficulty (37 core + 3 bonus for FLARE-VM/REMnux), self-grading verification scripts, and a cleanup script for resetting.
Lab environment (free): VMware Workstation Pro + Windows 11 Eval VM (or FLARE-VM for 140+ pre-installed forensic tools). Optional: Windows Server 2022 (AD), M365 developer tenant, REMnux for Office document analysis with oletools.
Attack scenario: CHAIN-HARVEST — phishing email → macro-enabled Excel → VBScript dropper → compiled C# implant → 10 persistence mechanisms → credential harvesting → data staging → encrypted exfiltration archive.
Usage rights and disclaimer
Course materials: Licensed for individual professional development. You may use scripts, queries, detection rules, templates, and frameworks from this course in your professional work. You may not redistribute course content, share account credentials, or republish course materials.
Fictional environment: All scenarios use the fictional Northgate Engineering environment. Any resemblance to real organizations, incidents, or individuals is coincidental.
No legal advice: Compliance and regulatory content in this course is educational, not legal advice. Consult qualified legal counsel for obligations in your jurisdiction.
Version and changelog
Current version: 6.0 | Last updated: May 2026
May 2026 — v6.0: Complete methodology rebuild. Course realigned to NIST SP 800-61 Rev 3 and CSF 2.0. Threat-landscape framing updated against M-Trends 2026. Five-step reasoning chain replaces Six-Step Investigation Method across all modules.
April 2026 — v5.0: Lab pack rebuilt. 41 production-grade artifacts, 40 labs with HTML walkthroughs, FLARE-VM and REMnux as first-class lab options.
2026 — v1.0: Course launch. 20 modules (IR0–IR19) across 5 phases. Investigation scenarios: AiTM, ransomware, BEC, insider, APT, multi-vector capstone.
This course is actively maintained. Content is updated as the security landscape evolves.
End of Course Exam
Complete the course, then prove your skills under time pressure. Pass mark: 70. Earn your certificate with CPE credits.
Requires 80% course completion. One random scenario per attempt. Certificate issued on pass.