Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CyberSecurity > DFIR > Flashcards

DFIR Flashcards

1
Q

DF

A

Digital Forensics: Examining and analyzing artifacts after a cyberattack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

IR

A

Incident Response: Performing actions when a cyber event occurs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

DFIR

A

Investigate and respond to a cyberattack after an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Threat Hunting

A

Active defense. Proactively search for threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

IRP

A

Incident Response Plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Stages of Incident Response Planning

A

Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

DFIR Process

A

Collect Evidence, Examine Collected Data, Analyze Important Artifacts, Report the Findings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

DF Analysis Types

A

Dead Analysis (powered off computers)
Live Analysis (powered on computers)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Targeted Artifacts

A

Files on a Drive, Memory Artifacts, Processes, Log Files, Cached Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Acquisition Tools

A

dd (data Dump): Drive Acquisition
FTK Imager: Drive and Memory Acquisition
DumpIt: Memory Acquisition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Non-Repudiation

A

Provides proof of the origin and integrity of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

RACI

A

Responsible, Accountable, Consulted, Informed
Used to assigned roles and responsibilities for each incident alert

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

NIST

A

National Institution of Standards and Technology
Government agency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SANS

A

Private organization. Offers research and education in the field of information security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

DRP

A

Disaster Recovery Plan
Outlines response strategies for unplanned events. Helps minimize the effects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Data Acquisition Recommendations

A

Memory before drive acquisition
Memory captures are better is user is logged on
Use sterilized media
Document the capture properly
System interaction should be minimal
Capture to an external source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Full Clone

A

The closest option to having the actual drive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Logical Image

A

Narrows the search field. Some evidence may be spread across multiple partitions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Capture Formats

A

RAW, ISO, EWF, dd

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Clonezilla

A

Linux distribution for cloning drives. Not typically for forensic purposes.
Can clone over the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

FTK Imager

A

Part of Forensic Toolkit Suite. Clone drive through interactive wizard

22
Q

Forensic Image Formats

A

E01: Provides compression per file checksum and password protection
AFF: Stores the imaged disk as compressed segments for better saving and metadata of the image

23
Q

Autopsy

A

Uses forensic tools from The Sleuth Kit. Created cases for captures

24
Q

Image Splitting

A

Virtualization software may split a drive into multiple files. Splitting is done to increase read and write speeds

25
Q

History

A

Includes entered URLs and webpages marked as favorites

26
Q

Cache

A

Files, images, scripts, and other media-related data

27
Q

Prefetch Files

A

Applications executed in Windows create prefetch filed
The files are used as cache for loading time optimization

28
Q

Power Forensics

A

Add-on to PowerShell and is a Forensics framework
Works with FAT and NTFS and can be launched from live systems
Depends mostly on the MFT (Master File Table)

29
Q

PowerForensics Operation Modes

A

Live System and Mounted Drive
Errors can occur if the drive is lager than 2TB

30
Q

PowerForensics Analysis Capabilities

A

Boot and Partitions, NTFS and EXT4, Windows Artifacts, Windows Registry, Application Cache

31
Q

Boot Record types

A

MBR: Supports up to 4 partitions per storage device and only with storage devices up to 2 TB
GPT: Supports up to 16 exabytes and supports up to 128 partitions

32
Q

NTFS Specialties

A

Journaling: Recording storage device activity
Indexing: Enables quick access to files stored on devices
Alternate Data Stream (ADS): More than one resource included in a single file

33
Q

File Carving

A

Reassembles files from fragments when no metadata is available.
Can be used to recover partially overwritten files

34
Q

Memory Analysis 6 Investigation Steps

A

Processes, DLL & Handles, Network, Code Injection, Rootkits, Dump

35
Q

Network Investigation: Network Connections

A

Connscan: Scans for identifiable TCP connections in older versions of Windows (Netscan can be used in more recent versions of Windows)
Sockets: Scans for all open sockets

36
Q

Logs

A

Automatically created to sore records of events

37
Q

Log Classification

A

Informational, Debug, Warning, Error, Alert

38
Q

Log Attacks- What to Attack

A

Host which logs are generated, Transmitted logs, Agents that collect logs, Database in which logs are stored

39
Q

Threat Hunting

A

Proactive approach to handling cyberattacks. Aims to protect an organization from covert cyberthreats

40
Q

Threat Intelligence

A

Based on learning from other’s mistakes. Forensic researchers can learn about new exploration techniques from public sources

41
Q

IOC

A

Indicators of Compromise. Help determine is an organization was harmed by a threat that was implemented. Can be used to distinguish false positives.

42
Q

Malware Forensics Suspicious Behavior

A

Increased Traffic, Accessed File Types, Service Inspection, Domain Identification, Persistence

43
Q

Zeek

A

Framework used to parse, normalize, and correlate logs. Focuses on extracting security-related information from logs to detect anomalies.

44
Q

Malware Analysis

A

Describes all actions, methods, and tools used to identify and study malicious behavior.

45
Q

Reverse Engineering

A

The process of deconstructing an executable to reveal its design, architecture, and activity

46
Q

Static Analysis

A

Can provide a lot of info even without executing the code. Used to identify IoC’s

47
Q

Binwalk

A

Static Malware Analysis tool. Enables identification of magic byte patterns in a file.

48
Q

DLL

A

Dynamic Linked Library: A Windows file containing code and data that can be used by another program

49
Q

Dynamic Analysis

A

Methodology based on executing malware. Used to analyze malware’s behavior and impact on the system

50
Q

Monitored Data

A

File System Changes, Network Activity, Registry Changes

CyberSecurity (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions