I85PREP
⌘ K
CCFH study materials
CCFH study resources

CCFH: Incident Response and Malware Analysis

CCFH · Work through your exam, one topic at a time.

All guide sections

Incident Response and Malware Analysis

What this domain tests

This domain tests whether you can run a structured response, preserve volatile evidence, and produce defensible conclusions about malicious code and attacker behaviour.

Core rules and concepts

  • Response lifecycle. NIST SP 800-61 phases are preparation, detection and analysis, containment, eradication, and recovery, followed by post-incident lessons learned. Know where each action sits and why containment precedes eradication.
  • Volatility order. Capture memory, running processes, network connections, and logged-on sessions before touching disk, following RFC 3227 reasoning. Memory acquisition tools include WinPmem, DumpIt, and LiME.
  • Containment choices. Network isolation preserves memory and allows live response; shutdown destroys volatile evidence and may trigger destructive payloads. Document the decision either way.
  • Static analysis. File type and PE headers, imports, sections, entropy for packing, embedded strings, and YARA matching. Never execute on a production host.
  • Dynamic analysis. Sandboxed execution with network simulation, behavioural monitoring for file, registry, and process changes, and capture of command-and-control traffic.
  • Mapping behaviour. MITRE ATT&CK techniques structure findings: persistence through Run keys, scheduled tasks, or services; credential access; lateral movement; exfiltration over C2 channels.
  • Preservation. Hash triage outputs, keep a response log with times and actors, and maintain chain of custody for collected hosts and memory images.

Worked example

Ransomware is detected on a file server. The sequence is: photograph the ransom note and encrypted file extensions, capture memory if the host is still running, isolate it from the network without shutting down, collect logs and the note with hashes, then check for known decryptors using the sample hash rather than the note text. Only after preservation do eradication and restore from a verified backup proceed.

Traps that cost marks

  • Shutting down a host before capturing memory.
  • Running suspected malware on a production network.
  • Treating a hash match to a malware family as proof of the specific actor.
  • Reporting an IOC as a conclusion rather than an indicator requiring corroboration.
  • Failing to keep a response log, which later breaks the chain of custody.