Registration: All students who register for a 4-6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.

About Core NetWars: The most comprehensive of the NetWars ranges, this ultimate multi-disciplinary cyber range powers up the most diverse cyber skills. This range is ideal for advancing your cybersecurity prowess in today’s dynamic threat landscape. The winning team and the top five solo players from every Core NetWars tournament throughout the year are offered a chance to compete in the annual SANS Core NetWars Tournament of Champions.

Computer Requirements: Browser-based

• Chrome, Firefox, Safari, or Edge browsers
• 8GB of RAM

Recommended For: All infosec practitioners of any level. It is recommended, but not required, that students have a basic or foundational knowledge of information technology and technical topics.

Disciplines: Cybersecurity 101, Cyber Defense, Penetration Testing, Digital Forensics, Incident Response, Cloud Computing.

Example Topics:

• Hardware hacking
• Mobile app analysis
• Nerd trivia
• Threat hunting with ELK Stack
• Web application pentesting, including GraphQL
• Linux and Windows command line skills, including PowerShell, cURL, and jq
• Windows, web server, and network forensics
• Cyber threat intelligence
• Cryptography
• Cloud penetration testing

Interactive Scenario: Some SANS students are relaxing at a local arcade after a long day learning elite new cyber skills. All of a sudden, they’re pulled into a digital world ruled by an AI! Is it benevolent? Will they escape? Will they make it back in time for class tomorrow?

Tournament: DFIR NetWars

Attendance Options: In-Person and Live Online

Registration: All students who register for a 4-6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.

About DFIR NetWars: Focused on digital forensics, incident response, threat hunting, and malware analysis, this tool-agnostic approach covers everything from low-level artifacts to high-level behavioral observations.

Computer Requirements: Laptop/desktop-based

• Processor: 64-bit, x86, 2.0 GHz+
• Memory: 16GB (8GB is possible with reduced performance)
• HD: 200GB+ Free, and approximately 50GB download of evidence files and virtual machines
• Interface: USB 3.0 | Type-A or dongle with Type-A
• Operating System: Windows 10 or later, Mac OS 10.15 or later, Linux
• Virtualization Software: VMware – Students are expected to either provide their own forensics tools or use the local VMware VM tools that we provide.
• Extra Requirements: Files downloads are required to participate.

Recommended For: Experienced Digital Forensic Analysts, Forensic Examiners, Media Exploitation Examiners, Malware Analysts, Incident Responders, Threat Hunters, Security Operations Center (SOC) Analysts, Law Enforcement Officers, Federal Agents, Detectives, and Cyber Crime Investigators.

Disciplines: Digital Forensics, Incident Response.

Example Topics:

• Threat Hunting
• Malware Analysis
• SIFT Workstation
• Media Exploitation
• Artifact Analysis
• Rapid Triage
• Malicious attacks
• Network traffic analysis
• Reverse engineering and debugging
• Intrusion detection

Interactive Scenario: As a DFIR specialist, you are provided with evidence files from a series of mysterious compromised systems and conventional computing environments. Your mission? Use your DFIR skills to shed light on attack vectors, indicators of compromise, and other evidence needed to resolve the incident.