AI-Powered Malware Analysis, Memory Forensics & Threat Hunting: From Manual Techniques to Autonomous AI Agents - Monnappa K A and Sajan Shetty - DCTSG2027

Name of Training: AI-Powered Malware Analysis, Memory Forensics & Threat Hunting: From Manual Techniques to Autonomous AI Agents
Trainer(s): Monnappa K A and Sajan Shetty
Skill Level: Intermediate, Advanced
Dates: March 5 – March 7, 2027
Time: 9 am to 5 pm
Venue: TBD
Early Bird Cost: S$3,300 (incl. GST, until Dec 31, 2026)
Regular Cost: S$3600 (incl. GST)

Short Summary

This hands-on three-day training teaches participants to analyze, investigate, and hunt malware using a manual-first, AI-next approach. The course covers static and dynamic analysis, reverse engineering, memory forensics, and endpoint telemetry-based threat hunting. In each discipline, participants first perform the investigation manually, then repeat the workflow with AI agents to accelerate analysis and support investigation.

Through real-world labs, participants will examine malware samples and memory images involving crimeware, APT malware, rootkits, and fileless threats, while analyzing Sysmon telemetry to uncover persistence, process injection, lateral movement, LOLBins abuse, and adversary techniques.

Using MCP-enabled AI agents, reusable Skills, custom tools, and the Garuda Threat Hunting Framework, participants will apply AI across malware analysis, reverse engineering, memory forensics, and threat hunting. The training concludes with autonomous malware analysis and threat hunting that correlates activity, maps behaviors to MITRE ATT&CK, and uncovers unknown threats without relying solely on predefined IOCs, signatures, or detection patterns.

By the end of the training, attendees will be equipped to detect, analyze, investigate, hunt, and respond to sophisticated cyber threats using both classic hands-on tradecraft and the AI-agent tooling that is rapidly becoming part of every serious SOC's toolkit.

Course Description

As adversaries become more sophisticated and increasingly target enterprises, critical infrastructure, and government organizations, the ability to analyze malware, investigate compromised systems, and hunt for stealthy activity has become essential for cybersecurity professionals.

This hands-on training combines malware analysis, reverse engineering, memory forensics, endpoint-telemetry-based threat hunting, and AI-agent-driven analysis and hunting in a single practical program. Participants first learn the manual techniques required to understand and verify malicious activity, and then apply MCP-connected AI agents to accelerate analysis, correlation, hunting, and reporting.

The course begins with the foundations of malware analysis, Windows internals, reverse engineering, memory forensics, and endpoint telemetry. A dedicated introduction to AI agents explains how they reason, use tools, maintain context, and execute analyst-directed workflows. This prepares participants for the AI-augmented modules that follow each major manual discipline:

• Static analysis: Attendees manually fingerprint malware, inspect file structure and metadata, extract strings and IOCs, identify packing and obfuscation, and assess malware capabilities. In the dedicated AI-powered static analysis module, they direct an AI agent to perform triage, extract artifacts, assess capabilities, and compare its findings with the manual analysis.
• Dynamic and behavioral analysis: Participants build and operate a safe malware-analysis environment and monitor process, filesystem, registry, and network activity. They then connect the custom sandbox to an AI agent through the Model Context Protocol (MCP), enabling it to invoke analysis tools, correlate behavior, extract indicators, and generate a structured behavioral report.
• Code analysis and reverse engineering: Attendees use IDA Pro, and x64dbg to analyze downloaders, droppers, keyloggers, process injection, and HTTP-based backdoors. In the dedicated AI-assisted code analysis module, they connect an MCP-enabled agent to Ghidra and IDA Pro through Ghidra integrations and IDAPython-based tooling. The agent examines functions, identifies important APIs, explains and annotates code behavior, and supports capability analysis, while the analyst validates its conclusions.
• Memory forensics: Participants use Volatility 3.0 plugins to investigate processes, handles, mutexes, registry persistence, network artifacts, injected code, fileless malware, and rootkits. They then direct an MCP-connected AI agent through the same investigation using natural-language instructions, enabling it to select relevant plugins, correlate results, identify suspicious artifacts, and summarize the findings.
• Threat hunting: Attendees use Sysmon telemetry and the Garuda Threat Hunting Framework to investigate PowerShell abuse, suspicious parent-child relationships, Living-off-the-Land binary execution, persistence, credential access, process injection, defense evasion, command-and-control activity, and multi-stage attacks. In the AI-powered hunting module, they extend Garuda with an AI layer for event triage, cross-event correlation, timeline reconstruction, IOC extraction, MITRE ATT&CK mapping, reporting, and suspicious-pattern identification without relying solely on known indicators, signatures, or pre-built rules.

Every module includes scenario-driven labs using real malware samples, infected memory images, and endpoint telemetry. Participants perform each major workflow manually and then repeat or extend it using an AI agent. This allows them to compare results, identify gaps or incorrect conclusions, and understand where analyst verification, guardrails, and human judgment are required.

By the end of the course, attendees will be able to perform practical malware analysis, reverse engineering, memory forensics, and endpoint threat hunting, while using AI-augmented workflows to improve speed and consistency.

Difficulty Level

Intermediate - The student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.

Advanced - The student is expected to have significant practical experience with the tools and technologies that the training will focus on.;Expert or Specialized - The student has a solid understanding of the topic at hand, usually with knowledge of relevant standards, tactics, tools, and years of relevant hands-on experience. Students should expect to use these skills with agility to solve problems in novel ways.

Suggested Prerequisites

• Students should be familiar with using Windows/Linux
• Students should have an understanding of basic programming concepts, while programming experience is not mandatory.

What Students Should Bring

• A laptop with at least 8 GB of RAM and 60 GB of free disk space.
• VMware Workstation or VMware Fusion installed on the laptop
• A 64-bit Windows 11 or Windows 10 installed inside VMware Workstation or VMware Fusion.
• An active Claude Pro subscription. A one-month subscription is sufficient. This is required to use Claude Code and to complete the AI-assisted malware analysis, reverse engineering, memory forensics, and threat-hunting exercises.

Important Notes:

• Students must have full administrator access to the Windows virtual machine.
  
• VMware Player and VirtualBox are not suitable for this training.
  
• Apple systems using M1 or other Apple Silicon processors are not suitable because they do not support the virtualization setup required for the course.

What the Trainer Will Provide

1. Course material in PDF format.
2. Lab solution manual.
3. Malware samples and malware-infected memory images used in the course and lab exercises.
4. Video demonstrations used in the course
5. Custom scripts and utilities developed for the course.
6. MCP-connected toolchains for malware sandboxing, reverse engineering, memory forensics, and threat hunting.
7. A preconfigured Linux virtual machine with the required tools, scripts, samples, MCP integrations, and supporting environment

Trainer(s) Bio

Monnappa K A is a cybersecurity professional with over 19 years of experience in incident response, digital investigations, malware analysis, and threat hunting. He is the author of the best-selling book "Learning Malware Analysis" and serves on the review boards for Black Hat Asia, Black Hat USA, Black Hat Europe, and Black Hat India. He previously worked at Microsoft and Cisco as a security investigator and threat hunter, focusing on the investigation and research of advanced cyberattacks.He is the creator of the Garuda Threat Hunting Framework and the Limon Linux Sandbox, and was the winner of the Volatility Plugin Contest in 2016. He also co-founded Cysinfo, a cybersecurity research community.

Monnappa has trained thousands of security professionals worldwide through highly rated, hands-on courses on malware analysis, reverse engineering, memory forensics, and threat hunting. He has delivered training at major conferences, including Black Hat USA, Black Hat Europe, Black Hat Asia, Black Hat MEA, DEF CON, BruCON, HITB, FIRST; SEC-T, OPCDE and the 4SICS SCADA/ICS Cybersecurity Summit.

He has also presented his research at numerous security conferences and events, including Black Hat, DEF CON, FIRST, DSCI, the National Cyber Defence Summit, Bharat NCX, and Cysinfo meetings. His presentations cover malware analysis, reverse engineering, memory forensics, threat hunting, and advanced cyberattack investigations. He has also contributed articles to eForensics and Hakin9 magazines. You can find some of his contributions to the community on his YouTube channel (http://www.youtube.com/c/MonnappaKA), and you can read his blog posts at https://cysinfo.com Twitter/X: @monnappa22

Sajan Shetty is a Cyber Security enthusiast. He is an active member of Cysinfo, an open Cyber Security Community(https://www.cysinfo.com) committed to educating, empowering, inspiring, and equipping cyber security professionals and students to better fight and defend against cyber threats. He has conducted training sessions at Black Hat, DEFCON, BRUCON and HITB, and his primary fields of interest include machine learning, malware analysis, and memory forensics. He has various certifications in machine learning and is passionate about applying machine learning techniques to solve cybersecurity problems.

Proficiency Exam

Solve 70% of the lab exercises that involves analyzing real malware samples and hunting for malicious artifacts using memory foreniscs and endpoint Telemtery