Incident Response

Explore the three-tier soc model where automation handles commodity malware, tier one resolves easier alerts, tier two tackles advanced cases, and tier three conducts proactive threat hunting and forensics.

Demonstrate edr, xdr, siem, and soar within a soc framework, including defender for endpoint and cloud, Sentinel, and Logic Apps for automated incident response.

Explain threat informed defense by defining your organization's mission, identifying target threat actors and their motivations, and mapping ttps to enhance detection, protection, and threat hunting in your SoC.

The pyramid of pain ranks indicators by how hard attackers must change them, from hashes and ip addresses to tools, emphasizing detection of tactics, techniques, and procedures to hinder breaches.

Define zero trust as a security strategy and mindset, not a product. Verify explicitly, enforce just-in-time least-privilege access, and assume breach to minimize blast radius.

Explore the seven-step SANS incident response process, compare it with NIST, and examine the preparation, identification, containment, eradication, recovery, and lessons learned phases.

Develop an incident response plan and cross-functional team, unite IT, security, legal, public relations, and HR, and implement training, tools maintenance, and clear internal and external communication guidelines.

Conduct a post-incident review to assess actions, improve policies and trainings, and share findings with all stakeholders for a continuous, robust incident response.

The LM cyber kill chain outlines how adversaries progress through reconnaissance, weaponization, delivery, exploitation, installation, C2, and actions on objective, guiding incident response and prevention efforts.

Explore exploitation phase of the cyber kill chain, where malware exploits a vulnerability. Recognize signs like unexpected behavior or crashes, and support rapid containment with patch management.

Identify malware persistence during installation, including registry keys, startup items, DLLs, rootkits, and containers, then execute eradication, recovery, post-restoration monitoring, and patch management with EDR/XDR.

Explore the 424 sub techniques in incident response and how adversaries implement attacks, with examples like vulnerability scanning, phishing, malware, DLL injection, RDP, password spraying, and asymmetric cryptography for exfiltration.

Identify and onboard data sources to collect telemetry and detect adversaries, focusing on network traffic and logs for vulnerability scanning within the MITRE ATT&CK framework.

Explain how threat groups are named differently by vendors, showing Apt41 as a common example, and compare naming conventions used by Mandiant, CrowdStrike, and Microsoft.

Map tactics and techniques from D3FEND to the CDI model, and understand why defend uses subclasses instead of sub techniques for procedures.

Examine defense techniques and attack countermeasures, including application hardening, pointer and stack validation, network mapping, network isolation, decoy environments, and restoring compromised systems.