CISP-TRE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Diamond Model nodes

Adversary, capability, infrastructure, and victim. Every intrusion event links all four nodes; pivoting on any node reveals related activity across campaigns.

TLP 2.0 markings

RED: named recipients only. AMBER: organization plus clients need-to-know. AMBER+STRICT: organization only. GREEN: community. CLEAR: public. Marking governs sharing scope.

Pyramid of Pain

Ordered from low to high adversary cost: hash values, IP addresses, domain names, network/host artifacts, tools, TTPs. Higher tiers yield more durable detections.

Detection precision and recall

Precision = TP/(TP+FP), measuring how many alerts are real. Recall = TP/(TP+FN), measuring how many real events are caught. Both drive tuning decisions.

NIST IR phases

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. Communication and coordination span all four phases.

Containment decision inputs

Data sensitivity, host count, account privilege, adversary persistence/C2 presence, business criticality, and regulatory impact determine whether to isolate, disable, or monitor.

PE section entropy

Entropy above roughly 7.0 in a section suggests packing or encryption. Combined with few imports and unusual section names, it indicates a packed binary.

Unpacking at OEP

Set breakpoint on VirtualAlloc or WriteProcessMemory, run until original entry point, dump process memory, then rebuild the import table with Scylla or ImpRec.

Zeek conn.log

Connection summary log recording source/destination, ports, protocol, duration, bytes, and connection state. It supports flow analysis without storing full payloads.

JA3 fingerprint

A hash of TLS client hello fields (version, ciphers, extensions, curves). Reused across hosts, it identifies malware TLS stacks without decryption.

LOLBin abuse

Living-off-the-land binaries such as certutil, mshta, rundll32, and regsvr32 used with suspicious arguments to download, execute, or proxy code while appearing legitimate.

EDR network containment

An agent action that blocks most network traffic on a host while preserving the management channel, allowing investigation without full disconnection from the console.

MTTD and MTTR

Mean time to detect and mean time to respond. SOC performance metrics that measure detection and response latency across incidents, tracked per technique or severity.

SOAR approval gates

Human confirmation steps inserted before destructive automated actions such as host isolation or account disable, preventing mass impact from false positives.

Order of volatility

RFC 3227 collection order: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media. Collect most volatile evidence first.

Chain of custody

Documentation of every evidence transfer recording who, what, when, where, and why. Hashes at acquisition and each transfer preserve integrity and admissibility.

Playbook-as-code

Response procedures stored as version-controlled YAML or JSON with parameters, test fixtures, and CI validation, deployed like software to ensure reproducibility.

DNS sinkholing

Redirecting known malicious domain resolutions to a controlled address to disrupt command and control and to observe which hosts attempt to connect.

Structured Analytic Techniques

Methods such as Analysis of Competing Hypotheses, Key Assumptions Check, and Red Team that counter cognitive bias when evidence supports multiple attributions.

Sigma rule format

A vendor-neutral detection rule schema describing log source, detection logic, and metadata, compiled into SIEM-specific queries for portable detection engineering.

Purple teaming

Collaboration where red team executes a technique and blue team validates whether it is detected, then both update rules and measure detection latency.

Persistence locations

Run/RunOnce keys, scheduled tasks, services, WMI event subscriptions, startup folders, logon scripts, COM hijacking, and DLL search-order hijacking on Windows endpoints.

Process injection indicators

CreateRemoteThread, QueueUserAPC, process hollowing, and module loads from unusual paths. Injected code often exists only in memory, not on disk.

Beaconing detection

Identifying regular connection intervals with low jitter, consistent payload sizes, and repeated DNS queries to unusual domains, indicating automated command and control.

Lateral movement network signatures

SMB admin share access on 445, workstation-to-workstation RDP on 3389, WinRM on 5985/5986, PsExec service creation, and remote WMI calls on 135.

Eradication root cause

Removing persistence, patching the initial-access vector, and verifying with fresh telemetry. Without root cause, the same access path remains open.

Post-incident review

Timeline reconstruction, what worked and failed, detection gaps, control improvements, and a lessons-learned document with owners and due dates.

YARA rule anatomy

Meta, strings (text, hex, or regex with modifiers), and condition (boolean logic, file size, entropy). Specificity avoids false positives on benign files.

Imphash and fuzzy hashing

Imphash clusters samples by import table; ssdeep fuzzy hashing measures similarity. Both group related malware when exact hashes differ.

Windows execution artifacts

Prefetch, Amcache, ShimCache, and SRUM record program execution, file metadata, and resource usage, supporting timeline reconstruction during forensics.

Timestomping detection

Comparing $STANDARD_INFORMATION and $FILE_NAME timestamps in the MFT; discrepancies indicate manipulated file times used to obscure attacker activity.

Telemetry pipeline schema

Collection agents feed a message bus, parsers normalize to a common schema such as ECS or OCSF, and the SIEM or data lake applies detection rules.