GCFA · Domain 1
Advanced Incident Response
About 25% of the exam
Response lifecycle
- Prepare
- Identify
- Contain
- Eradicate
- Recover
- Lessons learned
- Preparation decides how fast identification lands
- Scope fully before you contain
- Eradicate every foothold in one move
- Recover with monitoring still elevated
- Lessons learned feed detection engineering
Partial eradication invites the attacker straight back, so find every foothold before cutting any of them
Order of volatility
- Registers and cache
- Memory
- Network state
- Temporary files
- Disk
- Backups
- Registers and cache vanish first
- Memory holds keys and injected code
- Connections and ARP cache die on shutdown
- Disk survives, so capture it later
- Record system time before anything else
Volatility ranks sources by how fast they disappear, not by how useful they turn out to be
Live triage collection
- Run trusted tools from removable media
- Never execute binaries off the suspect disk
- Capture memory before killing any process
- Record system time and time zone
- Save connections, processes, services, open handles
- Log every command and its output
- Hash collected files as you go
- Minimize footprint, then document what changed
Chain of custody
- Who and when
- every handler, every transfer time
- Unique item ID
- one label per evidence item
- Sealed packaging
- tamper-evident bag per device
- Transport
- the courier belongs on the record
- Hash at seizure
- baseline for every later check
- Re-verify
- compare hashes after transport and storage
- Gaps
- unexplained time invites a challenge
- Access
- need to know, logged and limited
Lateral movement artifacts
PsExec and services
- Service binary dropped into System32
- System 7045 records the install
- Named pipe plus admin share
- Security 4697 when auditing is on
WMI and DCOM
- WmiPrvSE parents the spawned process
- No new service is created
- Remote object instantiation over DCOM
- Check the WMI-Activity operational log
RDP and SMB
- Type 10 logon marks remote interactive
- Type 3 logon marks network access
- LocalSessionManager 21, 24, 25
- Client bitmap cache holds screen tiles
Ask what each technique leaves behind: a service, a WMI provider parent, or only a logon record
Event IDs worth memorizing
- 4624
- successful logon, read the type
- 4625
- failed logon, note the reason
- 4634
- logoff, pairs with the session
- 4648
- explicit credentials, runas or pivot
- 4672
- special privileges assigned at logon
- 4688
- process created, command line optional
- 4720
- user account created
- 7045
- service installed, System log
- 1102
- security log cleared
System 104 also records a cleared log, so a missing 1102 never proves nothing happened
Scoping and IOC sweep
- Turn findings into hashes, domains, mutexes
- Sweep every endpoint, not the loud ones
- Hunt at scale with query agents
- Confirm hits before you count them
- Re-scope when a new foothold appears
- Blast radius drives containment scale
Containment choices
- Single workstation
- isolate the host, keep it running
- Domain compromise
- credential reset plus segmentation
- Golden ticket
- reset KRBTGT twice, suitably spaced
- Active attacker
- cut access, still preserve evidence
- Network isolation
- block egress, leave memory alive
- Power off
- last resort, volatile evidence dies
Credential abuse to spot
- Pass the hash
- NTLM hash reused, no cracking
- Pass the ticket
- stolen Kerberos ticket replayed
- Kerberoasting
- service tickets cracked offline
- RC4 downgrade
- legacy ticket type on modern hosts
- DCSync
- replication rights pull password hashes
- DSRM change
- 4794 backdoor on a controller
- LSASS access
- odd process opens a handle
Acquisition decisions
Physical image
- Every sector, slack and unallocated
- Default choice when scope allows
- Write blocker between disk and workstation
- Verify the hash, then work on copies
Logical or targeted
- Named files only, scope limited
- Huge arrays make full imaging impractical
- Still hash and document what was taken
- State the scope inside the report
Live and cloud
- Memory first on a running host
- Encrypted volumes must be captured unlocked
- Cloud data needs provider legal process
- Live hashes verify the image, not the source
A logical acquisition is defensible when its scope is stated, hashed and explained, never when it is quietly narrower than claimed
Persistence hunt list
- Run keys in both hives
- Services with random names, temporary paths
- Scheduled tasks and their trigger conditions
- WMI filter, consumer and binding trio
- Startup folder shortcuts and scripts
- DLL search order hijacks
- Kernel drivers from writable directories
Reporting and handoff
- State scope, method and limitations
- Every timeline entry cites an artifact
- Separate observation from interpretation
- Give containment owners concrete indicators
- Peer review before the report ships
- Say what the evidence cannot show
Key artifacts
- Prefetch
- execution, run count, last runs
- Amcache
- path, size and SHA-1 hash
- ShimCache
- presence, file modified time only
- SRUM
- per application bytes and CPU
- BAM and DAM
- last execution time per user
- Jump Lists
- recent files with access counts
- Shellbags
- folders browsed, removable media included
- $UsnJrnl
- change records, wraps when full
Know the order
- Photograph and document
- Capture memory
- Capture network state
- Image the disk
- Hash and seal
- Analyze the copy
Volatile before persistent, and never analyze the original once a verified copy exists
Reference strip: response, evidence, telemetry
Windows telemetry
- Security, System and Application channels
- Sysmon process, network and image loads
- PowerShell script block logging
- Task Scheduler 106 created, 200 ran
- TerminalServices operational logs
Volatile order
- Registers, cache, memory
- Network state and ARP cache
- Running processes and open handles
- Temporary files and swap
- Disk, then backups and archives
Collection tooling
- Memory capture with hashing
- Fleet hunting with query agents
- Timeline builders and artifact parsers
- Write blockers, hardware and software
Legal terms
- Chain of custody and legal hold
- Spoliation and preservation obligations
- Warrant scope and consent limits
- Business records and hearsay exceptions
Techniques to name
- Remote service creation and WMI execution
- Golden and silver tickets
- Web shells and reverse tunnels
- Log clearing and ETW patching
Quick exam traps
- Trap: Pulling the plug preserves the most evidence
- Trap: A cleared security log leaves no trace behind
- Trap: Containment must wait until analysis is finished
- Trap: Remote service execution and WMI leave identical artifacts
- Trap: ShimCache proves that the program executed
- Trap: One KRBTGT reset invalidates every forged ticket
- Trap: An IOC sweep with no hits proves a single host
cybercertprep.com · original revision sheet written from the public body of knowledge