CAT 520 - Introduction to Open-Source Intelligence for Cybercrime Investigations

Course Description

This course covers the fundamentals of open-source intelligence (OSINT) and its application to cybercrime investigations. Students are introduced to techniques for collecting, evaluating, preserving, and reporting publicly available information from online sources while maintaining investigative integrity. The course explores online identity and username research, domain and IP address analysis, infrastructure research, social media review, source validation, and evidence preservation. Students can expect hands-on cyber range exercises involving structured online searches, identification of linked accounts and aliases, analysis of publicly available technical records, preservation of online evidence, and preparation of clear OSINT findings for investigative use.

Course Details

By the completion of this course, successful students will be able to:

Skills Acquired:

• Understanding of OSINT principles and investigative use cases
• Ability to conduct structured online research safely and effectively
• Skills in identifying digital footprints, aliases, domains, and infrastructure
• Knowledge of source validation and evidence preservation practices
• Ability to prepare clear OSINT findings for investigative use

Course Components:
Lectures (Theory Component):

• Introduction to OSINT and Its Role in Cybercrime Investigations
• Legal, Ethical, and Operational Considerations
• Online Identity and Username Research
• Domain, IP Address, and Infrastructure Analysis
• Social Media and Public Web Investigative Techniques
• Source Reliability, Documentation, and Evidence Preservation

Cyber Range-Based Labs (Hands-On Component):

• Conducting Structured Online Searches
• Identifying Linked Accounts, Aliases, and Digital Footprints
• Reviewing Domains, IP Addresses, and Public Technical Records
• Capturing and Preserving Online Evidence
• Producing an OSINT Findings Summary