CCOA (ISACA) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

PCAP vs. flow records

PCAP stores full headers and payload for content-based detection; flow records (NetFlow, Zeek conn.log) keep only the 5-tuple, byte counts, and timing, so payload signatures cannot be evaluated from flows alone.

TCP SYN scan signature

Many SYN packets to sequential or random destination ports from one source, with RST responses from closed ports and no completed handshakes. Indicates reconnaissance scanning rather than normal client behavior.

Beaconing detection criteria

Periodic connections with low interval jitter, consistent outbound-to-inbound byte ratio, repeated URI or SNI values, and fixed timing. These patterns distinguish automated C2 from human browsing traffic.

DNS tunneling indicators

High volumes of TXT or NULL queries to one domain, long high-entropy subdomain labels encoding data, and response sizes much larger than query sizes. Normal DNS rarely shows these patterns.

JA3 and JA4 fingerprints

Hashes of TLS ClientHello parameters that identify client tooling even when SNI is randomized or absent. Pivoting on a fingerprint across flows finds all hosts using the same client.

Suricata rule evaluation order

Signatures match packet header fields (5-tuple, direction) first, then sticky buffers such as http.uri, dns.query, or tls.sni. A signature hit is an alert requiring corroboration, not proof of compromise.

Process lineage anomaly

A parent-child process relationship that should not occur, such as an office application spawning cmd.exe or powershell.exe. Lineage is the highest-value endpoint triage artifact.

Sysmon Event ID 1

Process creation event containing image path, command line, parent process, user, and hashes. Command-line context is what separates benign admin tooling from abuse of the same binary.

LSASS access mask 0x1010

GrantedAccess value in Sysmon Event ID 10 indicating read access to LSASS memory by a non-OS process, a common credential-dumping indicator requiring corroboration with other host events.

Living-off-the-land binaries

Signed system utilities such as certutil, mshta, regsvr32, and rundll32 abused for download or execution. They are judged malicious by their arguments and parent process, not by the binary itself.

Windows Logon Type 3

A network logon recorded in Event ID 4624, typical of SMB or remote service access. Type 3 followed by Event ID 4672 on a server suggests lateral movement with elevated privileges.

Event ID 4720 and 4732

4720 records account creation; 4732 records adding a member to a security-enabled local group. Occurring in sequence, they indicate privilege escalation via a newly created account.

Kerberoasting indicator 4769

Service ticket request events using RC4 encryption (0x17) for many distinct SPNs from one account suggest offline cracking of service account passwords. Corroborate with account and host context.

Event ID 1102

Windows Security log cleared event. Its presence, or an unexplained gap in expected log ingestion, can indicate an attacker disabling or wiping logging to hide activity.

Log normalization schema

Mapping vendor-specific fields to a common schema such as ECS or OCSF for user, host, source IP, destination IP, and action, so correlation rules survive log source changes.

Indicator volatility ordering

File hashes are most stable, domains next, and IP addresses most volatile due to shared hosting and CDN reuse. An IP match alone is weak evidence of malicious activity.

Confidence versus severity

Confidence reflects source reliability and corroboration; severity reflects potential impact. A high-severity, low-confidence indicator warrants collection and validation, not immediate containment.

Traffic Light Protocol

TLP markings (CLEAR, GREEN, AMBER, RED) define the sharing scope of threat intelligence. Reports and indicator feeds must carry and respect the source's TLP marking.

Sinkhole false positive

A domain or IP pointing to a takedown or sinkhole server produces indicator matches with no attacker activity. Check resolution history before treating a match as malicious.

Passive DNS enrichment

Historical DNS resolution records showing which IPs a domain resolved to and when. Useful for infrastructure pivoting and for dating when a domain became active.

Triage scope-impact-urgency

Triage determines how many hosts and users are affected, what data or availability is at risk, and whether activity is ongoing. Containment urgency follows from these three factors.

Volatile data capture order

Per RFC 3227: capture memory and network state first, then running processes, then disk contents, then remote logs and backups. Shutting a host down destroys volatile memory evidence.

Chain of custody

A record of who collected each artifact, when, from where, and its hash, with write-protected storage. Required for any evidence that may reach legal or HR review.

Escalation trigger examples

Confirmed unauthorized access, ransomware or destructive activity, regulated data exposure, privilege escalation to domain admin, or an active external C2 channel warrant immediate escalation to incident command.

Process hollowing sequence

CreateProcess suspended, NtUnmapViewOfSection to remove the original image, WriteProcessMemory to insert the payload, SetThreadContext to point at it, then ResumeThread. A classic injection technique.

Ransomware host indicators

Shadow copy deletion via vssadmin or wbadmin, backup service tampering, mass file renames to a common extension, ransom note files, and high-volume file I/O on a host.

imphash and fuzzy hashing

imphash hashes a PE import table to group similar samples; ssdeep and TLSH compare files by similarity. Both help find variants when exact SHA-256 hashes differ.

Sandbox detonation with INetSim

Running malware in an isolated environment with a simulated internet service so C2 attempts are observed and logged without allowing real outbound exfiltration.

Packed PE section indicator

Sections with high entropy, unusual names, or an entry point outside normal sections suggest packing or obfuscation, which defeats static string and import analysis and warrants dynamic analysis.

Incident report structure

Summary, UTC timeline, affected assets and accounts, indicators, root cause, actions taken, status, and recommendations. Each claim must trace to a cited evidence source.

Dwell time metric

Elapsed time from initial compromise to detection. Reported consistently alongside detection and response times so trends across incidents are comparable.

Confidence language in reports

Using 'confirmed', 'likely', and 'unconfirmed' to convey evidence strength. Definitive attribution requires corroborating evidence; hedging is required when it is absent.