Browser Forensics for Security Analysts

Browser Forensics for Security Analysts teaches you how to examine and correlate artifacts to reconstruct browsing activity and answer critical investigative questions. With a focus on Google Chrome, this course gives you a practical foundation rooted in real-world analysis skills.

Rather than memorizing artifact locations and database schemas, you’ll learn browser artifacts in the context of realistic investigative questions. You’ll reconstruct browsing activity, examine how websites store data, investigate suspicious downloads and phishing activity, and use browser evidence to understand user behavior.

You’ll also go beyond individual artifacts by correlating evidence across multiple sources. That’s where browser forensics becomes especially powerful: a URL tells you one thing, but navigation history, cached resources, downloads, permissions, and stored website data can tell you the story of what actually happened.

You’ll Learn How to Answer…

User Actions

• What pages were visited in a browser?
• How did the user get to this particular page?
• What did the user type into a form field?
• What permissions did the user grant websites?

Identity and Devices

• What account is associated with a browser profile?
• What accounts were used in a browser?
• What device did the activity occur on?
• What person was using a browser at a particular time?

Website Actions

• What cookies were used by a website?
• What files were cached by a website?
• What temporary and persistent key/value pairs did a website save?
• What notifications did a website display?

Browser Extensions

• What extensions are installed?
• What can this extension do?
• What did the extension do?
• What data is the extension saving?

Browser-Based Attacks

• Was the user phished?
• What scripts loaded on a page visit?
• Did the user exfiltrate any data?
• I keep seeing these pop-ups; is my computer infected?
• Did the user download and run malware?

Pattern of Life Behaviors

• What sites does the user visit most frequently?
• What browsing activity happened outside of “typical” hours?
• How can we describe browsing "sessions" and highlight unusual ones?

If you want to learn how to use browser evidence to reconstruct what users, attackers, and malware actually did… Browser Forensics for Security Analysts is the course you’re looking for.

You can view a detailed course syllabus here and a sample video here.

Browser Forensics for Security Analysts Includes:

Over 15 hours of demonstration videos. These videos will break down the concepts and skills you need to investigate browser-based behavior.

Hands-on labs to help you develop and test your skills. You’ll complete lab exercises by following along with class demonstrations and analyzing real security data in course exercises. I’ll be with you along the way to provide guidance and feedback on your work.

Participation in our student charitable profit-sharing program. A few times a year, we designate a portion of our proceeds for charitable causes. AND students can nominate charities that matter to them to receive these donations.

Frequently Asked Questions

Is this course live?

This is NOT a live course. It’s an online video course you can take at your own pace. You’ll interact with the instructor asynchronously through the course exercises.

How long do I have access to the course material?

You have access to the course for six months following your purchase date. If you need more time, you can extend your access for a small monthly fee.

Are there any prerequisites or lab requirements for this course?

This course is designed for all security practitioner skill levels and assumes no prior command line experience. We will demonstrate command line techniques using Ubuntu Linux, Windows Command Prompt, and Windows PowerShell. You should have access to the command line interface on each relevant platform you want to follow along with.

How much time does it take to do this course?

Given the number of lab exercises, completing the course takes people varying amounts of time. You can plan for around 15 hours of lecture and demonstration lessons and 5-8 hours for lab exercises on your own. We recommend spreading your time in the course out over at least a few weeks to benefit from the effects of spaced learning.

How many CPEs/CMUs is this course worth?

Organizations calculate continuing education credits in different ways, but they are often based on the length of the training. This course averages 20 hours of video+lab work.

Do you offer discounts for groups from the same organization?

Yes. To inquire about discounts or group invoices, please contact us at info@appliednetworkdefense.com.

Meet the Course Author – Ryan Benson

Ryan Benson is...