Detection and Analysis Flashcards by John Vargas | Brainscape

Q

Network-Related Indicators

A

Bandwidth

Beaconing

Irregular P2P communication

Rogue devices

Common protocols over nonstandard ports

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Host-Related Indicators

A

Capacity consumption

Unauthorized software

Whitelisting - modifying this list

Malicious processes

Memory contents

Unauthorized changes

File system

Unauthorized privileges

Data exfiltration

Registry changes

Unauthorized scheduled tasks

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Application-Related Indicators

A

Anomalous activity

New accounts

Unexpected output

Unexpected outbound communication

Service interruption

Memory overflows

Application logs

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Evidence acquisitions

A

Chain of custody

Validating data integrity

Preservation

Legal hold

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Data and log analysis

A

SPLUNK

How well did you know this?

1

Not at all

2

3

4

5

Perfectly