CySA+ cheat sheet

MITRE ATT&CK tactics in order: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.

Cyber Kill Chain phases: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command and Control → Actions on Objectives.

Windows logon events: 4624 = successful logon; 4625 = failed logon; 4648 = explicit credential use; 4672 = special privileges assigned; 4720 = account created; 7045 = service installed.

Linux authentication logs: /var/log/auth.log on Debian-based systems or /var/log/secure on RHEL-based systems; auditd provides syscall-level auditing.

SPF authorizes sending IPs; DKIM signs headers and body with a domain key; DMARC aligns SPF/DKIM and sets p=none, p=quarantine, or p=reject with reporting addresses.

Order of volatility (RFC 3227): CPU registers and cache > RAM and swap > network state > disk > logs > backups; collect most volatile first.

IDS detection methods: signature-based matches known patterns (low false positives, misses novel attacks); anomaly-based baselines normal behavior and flags deviations (higher false positives).

IoCs are artifacts such as hashes, IPs, and domains; TTPs are adversary behaviors. TTP-based detection remains effective longer than IOC-based detection.

CVSS v3.1 base score ranges: 0.0 none; 0.1–3.9 low; 4.0–6.9 medium; 7.0–8.9 high; 9.0–10.0 critical.

CVSS base metrics: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, Availability.

EPSS outputs a 0–1 probability of exploitation within 30 days; higher EPSS combined with a CISA KEV listing indicates priority remediation.

CISA KEV = confirmed known exploited vulnerabilities; CVE = specific vulnerability identifier; CWE = weakness class; CPE = product naming convention.

Risk = likelihood × impact; remediation priority combines severity, exploitability (EPSS/KEV), asset criticality, and exposure.

Credentialed scans authenticate to hosts for deeper inventory and fewer false positives; uncredentialed scans see only network-reachable services.

Scan modes: active sends probes and can disrupt fragile systems; passive observes traffic without sending packets; agent-based runs locally on the host.

Patch workflow: inventory → scan → prioritize → test → approve → deploy → verify → rescan.

Compensating controls when patching is not possible: WAF, network segmentation, virtual patching, disabling the vulnerable service, or enforcing MFA.

NIST SP 800-61 phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

PICERL sequence: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned.

Order of volatility for evidence: CPU/cache → RAM/swap → network state → disk → logs → backups; hash evidence at collection with SHA-256.

Containment options: isolate host via EDR, disable account, block IP/domain, segment VLAN, revoke tokens; power off only if volatile data is not needed.

Eradication removes the root cause (malware, persistence, exploited vulnerability); recovery restores from known-good state and monitors for recurrence.

Chain-of-custody record fields: evidence ID, description, collector, date/time, location, hash, and transfer log.

Breach notification timelines: GDPR 72 hours to supervisory authority; HIPAA 60 days from discovery; SEC material incident 4 business days.

Severity decision inputs: data sensitivity, number of affected hosts, business criticality, active versus contained status, and regulatory scope.

MTTD = total detection time ÷ number of incidents; MTTR = total response or recovery time ÷ number of incidents.

Report audiences: executives need business impact and decisions; technical teams need timeline, IOCs, and remediation steps; legal/regulatory need scope and notification status.

Post-incident report contents: executive summary, timeline, root cause, impact, evidence, containment actions, lessons learned, corrective actions.

Metrics: MTTD, MTTR, MTBF, SLA compliance, false positive rate, patch latency, vulnerability reopen rate.

Regulatory mapping: GDPR (personal data, 72 hours), HIPAA (PHI, 60 days), PCI DSS (card data, quarterly ASV scans), SOX (financial controls).

Data classification tiers commonly: public, internal, confidential, restricted; classification drives handling, encryption, and reporting requirements.

Communication plan defines stakeholders, message owners, approved channels, update cadence, and escalation thresholds.

Risk register fields: risk ID, description, likelihood, impact, score, owner, treatment (accept/mitigate/transfer/avoid), status.