BTL1 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Received header order

Each mail server prepends a Received line, so the bottom-most line is the origin and the top-most is the final hop. Reading bottom-up reconstructs the delivery path.

SPF purpose

A DNS TXT record listing IPs authorized to send for the envelope sender domain. It validates the sending server, not the visible From header, so it does not prevent display-name spoofing.

DKIM validation

A cryptographic signature over selected headers and a body hash, verified against a public key published at the signing domain. It proves integrity and domain signing.

DMARC alignment

Requires SPF or DKIM to align with the From header domain, then applies a policy of none, quarantine, or reject and sends aggregate reports to the rua address.

Reply-To mismatch

The Reply-To address differs from the From address, so replies go to a different mailbox. Common in brand impersonation where the display name looks trusted.

HTML smuggling

A technique where JavaScript in an HTML attachment or page assembles an encoded payload into a file blob in the browser, evading email gateway attachment scanning.

Defanging indicators

Rewriting live indicators so they cannot be clicked accidentally, such as hxxp for http and bracketed dots for periods, while keeping them readable for sharing.

Intelligence cycle stages

Direction, collection, processing, analysis, dissemination, and feedback. Feedback restarts direction, making intelligence a continuous loop rather than a linear process.

Pyramid of Pain

A model ranking indicators by attacker cost to change. Hashes are easy to change and low value; TTPs are hard to change and highest value for detection.

Diamond Model vertices

Adversary, capability, infrastructure, and victim. Pivoting from one vertex to related events on another builds a picture of the intrusion and supports attribution hypotheses.

TLP marking levels

RED limits sharing to named recipients, AMBER to the organization, GREEN to the community, CLEAR is public. The marking defines sharing scope, not data classification.

ATT&CK tactic versus technique

Tactics are adversary goals such as persistence or credential access. Techniques are the specific methods used to achieve them, and detections map to technique identifiers.

Indicator decay

Atomic indicators like IPs and hashes lose value quickly as attackers rotate infrastructure. Check first-seen and last-seen dates before blocking, and set short TTLs.

Analytic confidence

A statement about how strongly evidence and source reliability support a judgment, kept separate from probability. High confidence does not necessarily mean high likelihood.

Order of volatility

Collection priority from most to least volatile: registers and cache, RAM, network state, running processes, disk, remote logs, archival media. Capture volatile data first.

Chain of custody

A documented record of who handled evidence, when, and how at every transfer. Gaps or undocumented handling can render evidence inadmissible or unreliable.

NTFS $MFT

The master file table stores a record per file with attributes and timestamps. It can retain entries for deleted files and is central to file-system timelines.

USN journal

The NTFS change journal records modifications to files and directories with timestamps, useful for reconstructing recent activity even after files are deleted.

Prefetch artifacts

Windows files recording program execution, run count, and last-run times. They help confirm whether a suspicious binary actually executed on the host.

Timestomping detection

Attackers alter $STANDARD_INFORMATION timestamps with user-mode tools. Comparing them against $FILE_NAME timestamps reveals mismatches that indicate manipulation.

Event ID 4624

A successful logon event. The LogonType field distinguishes interactive, network, service, and remote interactive sessions, which is critical for triage.

Memory process hiding

Malware can unlink processes from the active list. Cross-checking with pool scanning and inspecting suspicious memory regions reveals hidden or injected processes.

Correlation rule types

Threshold rules fire when event count exceeds a value within a window. Sequence rules fire when specified events occur in order, catching multi-stage behavior.

Log normalization

Mapping raw source fields into a common schema so that user, source IP, and process name are consistently named and searchable across heterogeneous log sources.

Sigma rules

A vendor-neutral detection format describing log source, detection logic, and false positives. Rules convert into queries for many SIEM platforms.

LogonType 10

Remote interactive logon, typically Remote Desktop. It is a common lateral movement indicator, especially from unusual source hosts or at odd hours.

Alert triage sequence

Confirm the alert is not a duplicate, enrich with asset criticality and threat intelligence, decide true or false positive, then escalate or close with documented rationale.

Clock skew impact

Unsynchronized clocks across log sources break sequence correlation and timeline reconstruction. Verify NTP health before trusting joins between sources.

NIST IR phases

Preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. The phases are iterative, and lessons learned feed back into preparation.

Containment tradeoffs

Isolating a host stops spread but may alert the adversary and destroy volatile evidence. Choose based on blast radius versus the need to preserve evidence.

Evidence before eradication

Capture memory and relevant logs before wiping or reimaging. Eradication destroys forensic artifacts, so preservation must precede remediation steps on affected systems.

Eradication verification

Confirm root cause removal by checking for malicious accounts, scheduled tasks, services, and persistence mechanisms, not just deleting the initially observed payload.