SEC504: Hacker Tools, Techniques, and Incident Handling
SEC504Offensive Operations
Beneath the Mask: Can Contribution Data Unveil Malicious Personas in Open-Source Projects?
Beneath the Mask: Can Contribution Data Unveil Malicious Personas in Open-Source Projects? (PDF, 1.18MB)Published: 13 May, 2025
Created by
SANS Institute
In February 2024, after building trust over two years with project maintainers by making a significant volume of legitimate contributions, GitHub user "JiaT75" self-merged a version of the XZ Utils project containing a highly sophisticated well-disguised backdoor targeting sshd processes running on systems with the backdoored package installed.
Meet the expert
SANS Institute
Launched in 1989 as a cooperative for information security thought leadership, it is SANS’ ongoing mission to empower cyber security professionals with the practical skills and knowledge they need to make our world a safer place.
Read more about SANS InstituteAdditional resources
Related courses
- Slide 1 of 17
SEC402: Cybersecurity Writing: Hack the Reader
Essentials SEC402Digital Forensics and Incident Response
- 12 CPEs / 12 Hours (Self-Paced)
- Slide 2 of 17
FOR589: Cybercrime Investigations
Major UpdatesIntermediate FOR589Digital Forensics and Incident Response
- 5 Days (Instructor-Led)
- 30 CPEs / 30 Hours (Self-Paced)
- Labs: 20 Hours of hands-on instruction
- Slide 3 of 17
FOR585: Smartphone Forensic Analysis In-Depth
Major UpdatesEssentials FOR585Digital Forensics and Incident Response
- GIAC Advanced Smartphone Forensics (GASF)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 22 Hours of hands-on instruction
- Slide 4 of 17
FOR608: Enterprise-Class Incident Response & Threat Hunting
Intermediate FOR608Digital Forensics and Incident Response
- GIAC Enterprise Incident Responder (GEIR)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 20 Hours of hands-on instruction
- Slide 5 of 17
FOR518: Mac and iOS Forensic Analysis and Incident Response
Intermediate FOR518Digital Forensics and Incident Response
- GIAC iOS and macOS Examiner (GIME)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 23 Hours of hands-on instruction
- Slide 6 of 17
FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
Intermediate FOR508Digital Forensics and Incident Response
- GIAC Certified Forensic Analyst (GCFA)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 35 Hours of hands-on instruction
- Slide 7 of 17
FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques
Advanced FOR610Digital Forensics and Incident Response
- GIAC Reverse Engineering Malware (GREM)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 48 Hours of hands-on instruction
- Slide 8 of 17
FOR578: Cyber Threat Intelligence
Intermediate FOR578Digital Forensics and Incident Response
- GIAC Cyber Threat Intelligence (GCTI)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 20 Hours of hands-on instruction
- Slide 9 of 17
SEC495: Leveraging LLMs: Building & Securing RAG, Contextual RAG, and Agentic RAG™
Beginner SEC495Artificial Intelligence
- GIAC Advanced Smartphone Forensics (GASF)
- 2 Days (Instructor-Led)
- 7 CPEs / 7 Hours (Self-Paced)
- Slide 10 of 17
FOR509: Enterprise Cloud Forensics and Incident Response
Intermediate FOR509Digital Forensics and Incident Response
- GIAC Cloud Forensics Responder (GCFR)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 20 Hours of hands-on instruction
- Slide 11 of 17
FOR528: Ransomware and Cyber Extortion
Intermediate FOR528Digital Forensics and Incident Response- 4 Days (Instructor-Led)
- 24 CPEs / 24 Hours (Self-Paced)
- Labs: 13 Hours of hands-on instruction
- Slide 12 of 17
FOR577: LINUX Incident Response and Threat Hunting
newIntermediate FOR577Digital Forensics and Incident Response
- GIAC Linux Incident Responder (GLIR)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 23 Hours of hands-on instruction
- Slide 13 of 17
FOR710: Reverse-Engineering Malware: Advanced Code Analysis
Advanced FOR710Digital Forensics and Incident Response
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 12 Hours of hands-on instruction
- Slide 14 of 17
FOR498: Digital Acquisition and Rapid Triage
Essentials FOR498Digital Forensics and Incident Response
- GIAC Battlefield Forensics and Acquisition (GBFA)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 20 Hours of hands-on instruction
- Slide 15 of 17
SEC403: Secrets to Successful Cybersecurity Presentation
Essentials SEC403Digital Forensics and Incident Response
- 6 CPEs / 6 Hours (Self-Paced)
- Slide 16 of 17
FOR500: Windows Forensic Analysis
Essentials FOR500Digital Forensics and Incident Response- GIAC Certified Forensic Examiner (GCFE)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 22 Hours of hands-on instruction
- Slide 17 of 17
FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response
Advanced FOR572Digital Forensics and Incident Response
- GIAC Network Forensic Analyst (GNFA)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 20 Hours of hands-on instruction