This course covers static analysis (examining a file without running it) and dynamic analysis (reading behavior out of sandbox and monitoring reports), building the judgment for which technique fits which situation. It follows NIST SP 800-83 Rev. 1 and works in the tools analysts actually reach for — disassemblers, sandboxes, YARA, network capture, and CISA's Malware Next-Gen. Dynamic analysis is taught through explanation and example reports alone; no lab, sandbox, or live sample is required. A thread on sample sensitivity, data handling, and structured reporting runs the length of the course.
The course closes by tying it together: participants track a single sample from first triage through a written report modeled on the CISA Malware Analysis Report (MAR) format — the structure most analysts already have to produce — built to read cleanly for both a technical and a leadership audience.
Federal IR (NIST 800-61) + basic forensics (NIST 800-86); Windows/Linux command-line comfort. Intermediate.
From our hands-on training style to world-class instructors and custom-crafted curriculum, we deliver results our alumni are proud of.
Learn the concepts and skills covered in this course or your tuition is on us. See details and terms & conditions.
Work on projects proven to boost retention
Refined over many cohorts for an optimal learning experience
The teaching method at Noble Desktop is perfect and the classes provide you with infinite knowledge that makes you eager to take everything they offer. I love Noble!
—Ivonne Ackerman
Experienced educators who are driven to help you succeed
Refresh the materials for free within one year
Attend this course live online or as self-paced training. Engage with expert instructors, ask questions, and get feedback on your exercises and projects.
Unlike other providers, these are not mass open-enrollment classes. At Noble Desktop, you’ll learn in small groups (typically 8-15 students) and receive personalized attention.
Get the same interactivity and access to the instructor as in-person students. There are no extra fees and we’ll work with you to ensure your remote setup is perfect.
Learn at your own pace with pre-recorded video lessons and hands-on exercises. Work through the material on your schedule with access to course content and resources.
Upon completion of this course, you’ll receive an official certificate testifying to your mastery of the curriculum. We’ll send you a link where you can download your certificate, share it online with your friends, post it to your professional network on LinkedIn, and view all your earned certificates. Congratulations on your achievement!
Shareable on
We offer a single free retake of the class within a year.
SOC and CSIRC analysts, malware and reverse-engineering analysts, forensics examiners, and incident response staff who already hold foundational IR and forensics knowledge and are ready to go deeper.
Federal IR (NIST 800-61) + basic forensics (NIST 800-86); Windows/Linux command-line comfort. Intermediate.
This course does not qualify for payment plans or student financing. See our Payment Plan FAQ to find related programs that qualify.
Yes. This course is available online. See the course description and enrollment options for the training format and schedule.
For live-online sessions, you attend at the scheduled class times (New York, Eastern Time).
You have some options:
There are no extra fees or taxes for our courses. The price you see on this page is the maximum you’ll pay us.
We don’t currently offer discounts as we do our best to affordably prices our courses.
