Not a syllabus. The books I actually reopen when a sample starts living somewhere I cannot see from user-mode. Each shelf note is mine. The PDF is the book.
Elnaz Rabieinejad, Ali Dehghantanha, Fattane Zarrinkalam, and Sarina Dastgerdy
Twenty SOC practitioners, not a vendor deck. LLMs as drafts and leads for logs and first-pass triage. Nobody in the room trusted them for the high-stakes call.
Alex Matrosov, Eugene Rodionov, and Sergey Bratus
The book I hand people when they ask why the kernel still believes the firmware. Boot path, UEFI, and the malware that lives underneath the OS you thought you were analyzing.
Michael Sikorski and Andrew Honig
The lab book everyone claims they finished. Static, dynamic, packing, and the first time a sample lies to you on purpose.