GCFA practice labs, one intrusion at a time
The GCFA objectives expect an examiner who can take a compromised host apart: baseline processes and connections in memory, find injected code and unlinked modules, trace a rogue admin across host artifacts, recognize an attacker's setup work before a payload, follow credential theft to lateral movement, and build the full intrusion timeline.
This pathway is the host-based capstone track. It starts with memory because every later case depends on it, moves through a rogue admin account and injected code in memory, then works a server caught before impact, a service account followed across hosts and an encrypted file server. The capstone, Operation Ledger, is a complete ransomware intrusion that asks for the whole timeline with every technique named.
7 cases · ~18 h 12 min of lab time · Easy to Expert · a different variant for everyone · verified answer keys
The pathway, in order
7 cases, about 18 h 12 min of lab time. Each step opens the case in the library, where you can read the brief, the evidence list and sample questions. Everyone gets a different variant of the same case, graded against a key that was verified in the evidence.
-
01
First Look: What's in Memory
Baseline: processes and connections in memory.
EASY~37 minUp to 15 questions -
02
Field Promotion (Rogue Admin Account)
Account creation and persistence across host artifacts.
MEDIUM~1 h 25 minUp to 20 questions -
03
Ghost in the RAM (Injected Code in Memory)
Memory analysis with malfind, dlllist and ldrmodules.
HARD~1 h 59 minUp to 20 questions -
04
Dry Run (Ransomware Precursor: Caught Mid-Setup)
Memory and logs on a server caught before impact.
HARD~2 h 14 minUp to 20 questions -
05
Pivot Point (Credential Theft and Lateral Movement)
Follow a service account across logs, memory and a capture.
HARD~2 h 4 minUp to 20 questions -
06
Double Cross (Ransomware: Double Extortion)
Memory, disk, logs and a capture on an encrypted file server.
HARD~2 h 29 minUp to 25 questions -
07
Operation Ledger (Ransomware Intrusion)
Capstone: a complete ransomware intrusion.
EXPERT~7 h 24 minUp to 35 questions
What this pathway covers
Who it's for
- Candidates preparing for the GCFA who want full intrusions to take apart with Volatility, timeline tools and the event logs.
- Instructors teaching an advanced forensics or IR capstone who need multi-hour cases that still grade themselves.
- Experienced responders who want hard practice with a verified key to check their work against.
What you get with every case
- A different variant per student. Same case, same rubric, different names, hashes, timestamps and answers, so students can talk about method without sharing answers.
- Evidence in the real on-disk format. Registry hives, EVTX, PCAP, SQLite, JSON audit logs and memory images open in the tools the exam expects.
- A verified answer key. Every answer is re-derived from the planted evidence before the lab ships, so grading disputes end at the artifact.
- One-click grading and LMS export. Canvas, Blackboard, Moodle, D2L and LTI 1.3 grade passback, or a CSV. See the student portal.
- Runs on the instructor's machine. Windows installer plus macOS and Linux, fully offline after activation. Nothing to host and no student data leaves the room. Course packs on courses.
Run this pathway with your own roster
Download the app, generate a three-student version of the first case in under five minutes, and grade it. First Look cases run free with no key, and the 30-day trial needs no card. Or open the sample lab first and work a student package in your own tools.
Related pathways
Ransomware Incident Response
The ransomware kill chain end to end, from initial access to double-extortion and recovery.
5 cases · ~11 h 51 min
Incident Handling (GCIH)
The incident-handling kill chain from the responder's own tooling: detection and triage through containment to a full-arc capstone, mapped to MITRE ATT&CK.
10 cases · ~13 h 8 min · GIAC GCIH
All learning pathways
Every certification-prep and role pathway across Digital Forensics and Incident Response, side by side.
Browse the overview →
ATT&CK® and MITRE ATT&CK® are registered trademarks of The MITRE Corporation. Red Herrings maps to published ATT&CK tactics and techniques for teaching; it isn't affiliated with or endorsed by MITRE. GIAC, GCFE, GASF, GNFA, GCIH, GCFR and GCFA are trademarks of GIAC. CompTIA and CySA+ are trademarks of CompTIA, Inc. SANS is a trademark of the SANS Institute. Red Herrings aligns its pathways to the published objectives of these programs for teaching; it's independent of, and not affiliated with or endorsed by, any certification body.