504.1 Flashcards
PICERL
Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned
Preparation
All the things an organization does before an incident. Including policy, procedure, introducing internal monitoring, security best practices, etc.
Identification
When the incident is identified. Maybe through an IDS, customer report
Containment
There are several ways to contain an incident. short and long term containment with evidence collection.
Eradication
Undoing the damage the attackers did. Killing attacker processes, changing passwords, removing malicious data, launching fraud investigations etc
Recovery
Steps taken to get business systems back up and running.
Lessons Learned
When the final report is written, and the vulnerabilities the threat actors exploited are fixed.
Cyber Chef
Tool for transforming encoded data to its natural state for analysis.
wmic
used to search for processes. search for running processes that have base 64 encoded command line options, especially powershell.
netstat
use to search for listening and active tcp and udp ports.
ASEPs
registry and file locations that can be used to start software without a user taking a specific action to activate it.
Process explorer
gives detailed information for running processes
Autoruns
gives list of autostart extensibility points
process monitor
Shows file system,registry, network, and process information in real time
TCPView
maps listening and active tcp and udp activity to the associated applications
Sysmon
collects detailed event information for system monitoring and analysis
procdump
cli tool to capture memory for a running process for analysis
tcpdump
command line tool to capture and display network traffic
Volatility
python framework and tool for analyzing images of memory
winpmem
tool used to capture RAM from a windows system, which can the be analyzed.
RegShot
takes and compares a snapshot of the registry and the file system then provides a summary of changes between first and second snapshots after running malware
Scoping
Determine where threat actors are for proper containment. Scan networks for known IOCs
Velociraptor
Server software for data collection and analysis to help with scoping. Query’s file system, registry, runs remote commands, interrogate client artifacts
Berkeley Packet Filters
Specialized language to filter network packets
certutil
calculate the MD5 hash of a file on windows
