BTL1 study plan

Dissect a raw email header line by line, tracing the Received chain and identifying the originating IP, SPF/DKIM/DMARC results, and Reply-To mismatches.

Catalogue at least 15 phishing red flags across sender, subject, body, URL, and attachment categories, and write a one-sentence detection rationale for each.

Defend the difference between spoofing, look-alike domains, and compromised legitimate accounts, and explain which header evidence distinguishes them.

Set up a safe analysis workspace using a disposable VM and a URL-expansion tool, then document the verification steps that keep you from clicking live links.

Analyze at least 10 email artifacts for embedded URLs, decoding obfuscated links and recording the final destination host, scheme, and registration age.

Inspect attachment types commonly used to deliver malware, and describe what static indicators (file type mismatch, macro presence, embedded objects) you would extract without executing anything.

Reconstruct a phishing attack timeline from initial delivery through credential capture, and map each stage to the artifacts that would prove it.

Write a phishing incident report template that separates confirmed indicators from assumptions and states recommended containment actions.

Classify intelligence sources into strategic, operational, and tactical tiers, and state the confidence and freshness limits of each.

Apply a structured analytical technique to a threat report, separating observed facts from analytic judgment and noting alternative explanations.

Build an indicator list from a public threat write-up, then rank each indicator by durability and explain why hashes expire faster than infrastructure.

Explain the purpose of standards for expressing and sharing threat intelligence, and describe how a sharing model supports detection engineering.

Map indicators from your week-3 brief onto observable host and network artifacts, and identify which ones a defender could realistically collect.

Set up a lab endpoint with logging enabled, then create and collect at least five artifact types (process execution, autoruns, network connections, user activity, file metadata).

Explain the order of volatility and justify a collection sequence for a live system versus a powered-off disk.

Compare file system timestamps and describe how timestamp discrepancies can indicate anti-forensic activity.

Perform a structured disk triage on a lab image or VM, locating evidence of program execution, persistence, and recent user activity.

Extract and interpret Windows event log evidence for logon, process creation, and service installation, and explain what each event ID proves.

Analyze browser and file-system artifacts to reconstruct what a user did and when, distinguishing user-initiated actions from background activity.

Write findings that cite specific artifacts, avoid overstating conclusions, and flag where evidence is inconclusive.

Explain the role of log collection, normalization, and correlation in a SIEM, and describe why unparsed logs produce blind spots.

Write at least five detection queries against sample log data, covering authentication anomalies, suspicious process execution, and unusual outbound connections.

Tune one noisy rule by adding exclusions, and document the tradeoff between false positives and missed detections.

Map three of your detections to a known adversary technique and explain what telemetry the detection depends on.

Triage an alert queue scenario, ranking at least eight alerts by severity and justifying each prioritization decision.

Walk through the incident response lifecycle phases and describe the decisions and documentation required at each.

Draft containment, eradication, and recovery actions for a confirmed compromise, including what to preserve before making changes.

Draft a post-incident review that distinguishes root cause from contributing factors and assigns concrete follow-up actions.

Complete two timed full-length practice sets under exam conditions and log every missed question by domain and reasoning error.

Re-derive the weakest three concepts from first principles and write a short explanation of each without notes.

Review your accumulated deliverables and convert recurring mistakes into a one-page pre-exam reference sheet.

Simulate explaining a full incident end to end, from phishing email to SIEM alert to forensic confirmation to response, in under ten minutes.