CISP-TRE cheat sheet

Intelligence levels: strategic (leadership, long-term risk), operational (campaigns, actor intent), tactical (TTPs, IOCs). Each drives different consumer decisions.

Diamond Model nodes: adversary, capability, infrastructure, victim. Every event links all four; pivot on any node to discover related activity.

Cyber Kill Chain stages: reconnaissance, weaponization, delivery, exploitation, installation, C2, actions on objectives. Detection at earlier stages yields lower response cost.

MITRE ATT&CK tactic order (Enterprise): Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.

Indicator confidence tiers: atomic (IP, hash) is volatile and easily changed; behavioral (TTP) is durable and costly for adversaries to alter. Prioritize TTPs for long-lived detection.

TLP 2.0: RED (named recipients only), AMBER (organization + clients need-to-know), AMBER+STRICT (organization only), GREEN (community), CLEAR (public). Marking governs sharing, not classification.

Structured Analytic Techniques counter bias: ACH (competing hypotheses), Key Assumptions Check, Red Team, Devil's Advocacy. Use when evidence supports multiple actor attributions.

IOC lifecycle: collection, normalization (STIX 2.1 objects: indicator, observed-data, malware, threat-actor), enrichment (WHOIS, passive DNS, ASN), scoring, aging/expiry. Stale atomic IOCs cause false positives.

Intelligence requirements flow: PIR (priority intelligence requirements) → collection plan → processing/exploitation → analysis → dissemination → feedback. Without PIRs, feeds produce noise rather than decisions.

Hunting hypothesis structure: 'If adversary uses TTP X (ATT&CK ID), then telemetry Y should show Z.' A hunt without a falsifiable hypothesis is monitoring, not hunting.

Hunting loop: hypothesis → data source identification → query/analytic → triage findings → convert confirmed findings into detections → measure coverage.

Pyramid of Pain (bottom to top): hash values, IP addresses, domain names, network/host artifacts, tools, TTPs. Higher tiers impose more cost on the adversary.

Detection-as-code pipeline: version control → peer review → CI tests (true-positive fixtures, false-positive fixtures) → staging → production → tuning feedback. Sigma is a vendor-neutral rule format compiled to SIEM queries.

Detection quality metrics: precision = TP/(TP+FP); recall = TP/(TP+FN). High-precision rules reduce analyst fatigue; high-recall rules reduce missed detections.

ATT&CK coverage mapping: map each detection to tactic/technique; uncovered techniques and data-source gaps (e.g., no process creation logging) define the hunt backlog.

Behavioral analytics: frequency analysis, rare-parent-child process trees, first-seen-in-environment, beaconing jitter detection (regular intervals with low variance).

Data source prioritization: process creation with command line, network flow, DNS, authentication logs, EDR telemetry. Absence of telemetry is a detection blind spot, not absence of attack.

Purple teaming: red team executes technique, blue team validates detection, both update rules. Measure mean time to detect (MTTD) before and after each iteration.

NIST SP 800-61 phases: Preparation; Detection & Analysis; Containment, Eradication & Recovery; Post-Incident Activity. Communication and coordination span all phases.

Severity triage inputs: data sensitivity, number of hosts, privilege of compromised account, whether adversary has persistence/C2, business criticality, regulatory impact.

Containment options: network isolation (host firewall, VLAN quarantine, EDR network containment), account disable, credential reset, block C2 at egress. Choose based on whether adversary is still active.

Eradication requires root cause: remove persistence (scheduled tasks, services, WMI subscriptions, registry Run keys, cron), patch initial-access vector, then verify with fresh telemetry.

Recovery criteria: validated clean state, monitoring in place, staged return to production, heightened watch period. Do not restore from backup without confirming backup integrity.

Evidence handling during IR: maintain chain of custody, hash acquired images (SHA-256), record collector identity and time, use write blockers for disk acquisition.

Regulatory/notification clocks vary: GDPR 72 hours to supervisory authority; sector rules (HIPAA, PCI DSS, SEC) impose separate timelines. Start the clock at awareness, not confirmation.

Post-incident review: timeline reconstruction, what worked/failed, detection gaps, control improvements, lessons-learned document with owners and due dates.

Incident command roles: incident commander, communications lead, technical lead, scribe. Single commander avoids conflicting containment decisions.

Analysis tiers: static (strings, PE headers, imports, entropy), dynamic (sandbox execution, API monitoring), code-level (disassembly/decompilation). Start static, escalate only as needed.

PE format key structures: DOS header, NT headers, section table (.text, .data, .rdata, .rsrc), import directory, export directory, TLS callbacks. High entropy in a section suggests packing/encryption.

Packing indicators: few imports, high section entropy (>7.0), unusual section names, small import table with LoadLibrary/GetProcAddress, entry point outside .text.

Dynamic analysis tooling categories: sandboxes (Cuckoo, CAPE), API monitors (Procmon, API Monitor), network capture (Wireshark, INetSim), registry/process monitors.

Anti-analysis techniques: debugger detection (IsDebuggerPresent, PEB checks), VM detection (CPUID, registry artifacts, MAC OUI), timing checks, sleep obfuscation, anti-disassembly (junk bytes, opaque predicates).

Unpacking workflow: identify packer (PEiD, Detect It Easy), set breakpoint on VirtualAlloc/WriteProcessMemory, dump memory at OEP, rebuild imports (Scylla/ImpRec).

Common malware behaviors to document: persistence mechanism, C2 protocol (HTTP/S, DNS, custom), encryption (AES key derivation, RC4), file/registry artifacts, exfiltration paths.

YARA rule anatomy: meta, strings (text/hex/regex with modifiers), condition (boolean logic, file size, entropy, math). Rules should be specific enough to avoid false positives on benign files.

Hashing for identification: MD5/SHA-1 for legacy matching, SHA-256 for authoritative identification. Imphash and fuzzy hashing (ssdeep) cluster related samples.

NSM data types: full packet capture (PCAP), session/flow data (NetFlow, IPFIX, Zeek conn.log), transaction logs (Zeek http/dns/ssl), alert data (IDS). Each answers different questions.

Zeek logs commonly used: conn.log (flows), dns.log, http.log, ssl.log, files.log, notice.log, weird.log. Zeek extracts protocol metadata without full payload storage.

Suricata/Snort rule anatomy: action (alert/drop), protocol, source/dest, ports, direction, options (content, pcre, flow, sid, rev, msg).

Beaconing detection: regular connection intervals (low jitter), consistent payload sizes, repeated DNS queries to unusual domains, TLS JA3/JA3S fingerprint reuse across hosts.

DNS tunneling indicators: high volume of TXT/NULL queries, long subdomain labels, high entropy in query names, unusual query types, periodic query cadence to a single authoritative server.

TLS analysis without decryption: JA3 (client fingerprint), JA3S (server), SNI inspection, certificate metadata (issuer, validity, SAN), self-signed or mismatched certs.

Lateral movement network signatures: SMB (445) admin share access, RDP (3389) from workstation to workstation, WinRM (5985/5986), PsExec service creation, WMI (135) remote calls.

Flow analysis for exfiltration: asymmetric byte counts (large outbound, small inbound), off-hours transfers, connections to newly registered domains or cloud storage APIs.

Capture placement: SPAN/mirror port, network TAP, host-based capture. TAPs avoid dropping frames under load; SPAN ports may drop under high utilization.

EDR telemetry categories: process creation with command line and parent, file writes, registry modifications, network connections, module loads, script block logging, authentication events.

Process tree analysis: unusual parent-child pairs (e.g., winword.exe → powershell.exe, wmiprvse.exe → cmd.exe), LOLBins (certutil, mshta, rundll32, regsvr32) with suspicious arguments.

Persistence locations to monitor: Run/RunOnce keys, scheduled tasks, services, WMI event subscriptions, startup folders, logon scripts, COM hijacking, DLL search order hijacking.

Credential access indicators: LSASS access by non-system processes (procdump, mimikatz), SAM/SECURITY hive access, DCSync (DRSUAPI), Kerberoasting (TGS-REQ with RC4).

Defense evasion: process injection (CreateRemoteThread, QueueUserAPC, process hollowing), AMSI bypass, ETW patching, LOLBin abuse, signed binary proxy execution.

Response actions available via EDR: isolate host from network, kill process, quarantine file, collect triage package (memory, autoruns, prefetch, event logs), live response shell.

Detection tuning: suppress known-good parent-child pairs, whitelist by signer + path, alert on first-seen binaries, monitor for unsigned binaries in user-writable paths.

Memory analysis for EDR gaps: capture process memory before termination; injected code may not appear in on-disk files. Use Volatility/winpmem for full memory acquisition.

Endpoint telemetry retention: process creation and network events typically 30–90 days; plan for longer retention of high-value events for retrospective hunting.

SOC tiers: Tier 1 triage/alert validation, Tier 2 investigation and containment, Tier 3 hunting/threat intel/engineering. Escalation criteria must be documented, not improvised.

Alert triage framework: severity, confidence, asset criticality, user context, whether activity is expected (change management, known maintenance). False-positive rate per rule drives tuning.

SOAR playbook design: trigger → enrichment (threat intel, asset DB, identity) → decision branch → action (isolate, disable, notify) → documentation. Human approval gates for destructive actions.

Automation guardrails: idempotent actions, dry-run mode, rollback path, audit logging of every automated action, rate limits to avoid mass isolation during false positives.

Case management: every alert links to a case with timeline, evidence, decisions, and owner. Metrics: MTTD, MTTA (acknowledge), MTTR (respond/resolve).

Shift handover: open cases, active incidents, pending approvals, known false positives, ongoing hunts. Written handover prevents context loss between shifts.

Playbook examples: phishing report triage (extract headers/URLs, detonate, search mailboxes, purge, block sender/domain), impossible travel (verify with user, check MFA logs, reset credentials).

SOC metrics that matter: alert volume per rule, true-positive ratio, time-to-detect by technique, coverage against ATT&CK, analyst workload per shift.

Threat intel integration into SOC: IOC feeds enrich alerts (match hash/IP/domain), but TTP-based detections outperform atomic IOC matching for novel activity.

Order of volatility (RFC 3227): CPU registers/cache → memory → network state → running processes → disk → remote logs → archival media. Collect most volatile first.

Chain of custody: every transfer documented with who, what, when, where, why. Hash at acquisition and at each transfer; store evidence in tamper-evident containers.

Acquisition methods: physical (bit-for-bit, includes deleted space) vs logical (file system only). Use write blockers for suspect media; validate with hash before and after.

Windows artifacts: $MFT (file records), $LogFile (metadata journal), $UsnJrnl (change journal), $Recycle.Bin, prefetch (execution), Amcache/ShimCache (execution evidence), SRUM (network/app usage), event logs (Security, System, Application, PowerShell).

Linux artifacts: /var/log/auth.log, syslog, journald, bash history, /etc/passwd and shadow, cron, systemd units, /proc for live state, auditd logs.

Memory forensics: acquire with winpmem/LiME, analyze with Volatility (pslist, pstree, netscan, malfind, dlllist, handles). Memory reveals injected code and network state not on disk.

Timeline analysis: normalize timestamps across sources (UTC), correlate file system, registry, event logs, and network logs to reconstruct attacker sequence.

Anti-forensics indicators: timestomping (MFT vs $STANDARD_INFORMATION discrepancy), log clearing (event ID 1102), secure deletion tools, USN journal gaps.

Reporting: findings must be reproducible, distinguish observed fact from inference, include methodology and tool versions for peer review.

Response tooling categories: EDR live response, SOAR orchestration, network enforcement (firewall, NAC, proxy block), identity response (disable, revoke tokens, reset credentials), forensic collection.

API-driven response: EDR APIs (isolate, kill, collect), SIEM APIs (query, case create), IAM APIs (disable user, revoke sessions), firewall APIs (block IOC). Automate with least-privilege service accounts.

Playbook-as-code: version-controlled YAML/JSON definitions with parameters, test fixtures, and CI validation. Treat changes like software deployments.

Enrichment pipeline: alert → asset inventory (owner, criticality) → identity provider (user risk) → threat intel (IOC match, TTP context) → decision. Enrichment latency affects MTTR.

Containment engineering: network quarantine via EDR or NAC, DNS sinkholing for known C2, egress filtering, proxy blocklists. Verify containment with fresh telemetry, not assumptions.

Telemetry pipeline: collection agents → message bus (Kafka) → parser/normalizer → SIEM/data lake → detection rules. Schema consistency (ECS/OCSF) enables cross-source correlation.

Tool integration pitfalls: duplicate alerting from overlapping tools, conflicting containment actions, clock skew across sources, API rate limits during mass response.

Validation: tabletop exercises, purple team scenarios, chaos engineering for detection (inject known-bad signals, confirm alert fires). Measure detection and response latency end-to-end.

Least privilege for response automation: separate read-only enrichment roles from write/containment roles; require approval gates for destructive actions (isolate, disable, delete).