ECIH cheat sheet

An event is any observable occurrence; an incident is an event that actually or potentially harms confidentiality, integrity, or availability.

The CIA triad-confidentiality, integrity, availability-is the standard basis for describing incident impact.

Core IH&R phases: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

A CSIRT typically includes incident lead, analysts, forensic specialists, communications, legal, and IT operations liaisons.

Severity classification commonly considers data sensitivity, number of affected systems, business criticality, and attacker access level.

Evidence handling requires documented chain of custody, integrity hashes, and controlled storage.

Regulatory and contractual notification duties may apply to breaches involving personal, financial, or health data.

Common incident categories include malware, email, network, web application, cloud, insider, and endpoint incidents.

Preparation establishes policies, roles, communication channels, toolkits, jump kits, training, and pre-approved evidence access.

Detection and analysis validates whether an event is an incident, determines scope, and assigns severity.

Short-term containment limits immediate damage, such as isolating a host; long-term containment supports continued operations securely.

Eradication removes the root cause: malware, unauthorized accounts, persistence mechanisms, and exploited vulnerabilities.

Recovery restores systems from trusted sources, validates integrity, and monitors for reinfection.

Post-incident activity documents lessons learned, metrics, corrective actions, and follow-up tasks.

A timeline should record every action, timestamp, system, actor, and evidence item throughout the process.

Escalation criteria define when an analyst must notify management, legal, HR, or external responders.

First responder priority order: safety of people, preservation of evidence, containment, then detailed technical investigation.

Volatile evidence collection order: registers and cache, RAM, swap, network connections, running processes, then disk.

Do not power off a compromised system unless necessary; shutting down destroys volatile memory evidence.

Network isolation can preserve host state while preventing spread, but it may disrupt live attacker monitoring.

Disk imaging uses a write blocker and a cryptographic hash to verify integrity.

Record system time, time zone, and any clock offset before correlating logs.

Initial interviews should capture what was observed, when, by whom, and any actions already taken.

Responders must confirm authorization and legal constraints before seizing or imaging systems.

Malware categories include viruses, worms, trojans, ransomware, rootkits, spyware, adware, bots, and fileless malware.

Common indicators include unexpected CPU use, new services, unusual network traffic, AV alerts, and changed files or registry keys.

Containment actions include isolating hosts, blocking command-and-control domains or IPs, and disabling compromised accounts.

Static analysis examines hashes, strings, headers, imports, and code without executing the sample.

Dynamic analysis executes malware in an isolated sandbox while monitoring process, file, registry, and network behavior.

Ransomware response: isolate, preserve evidence, identify the strain, restore from validated backups, and avoid paying unless authorized.

Rootkits may require memory analysis, cross-view detection, or offline scanning because they hide from the running OS.

Eradication may require reimaging rather than cleaning when persistence or integrity compromise is extensive.

Phishing variants include spear phishing, whaling, clone phishing, vishing, smishing, and business email compromise.

Header analysis examines Received, Return-Path, Message-ID, Reply-To, and authentication results.

SPF, DKIM, and DMARC results help verify whether the sending domain was authorized and the message was altered.

Attachments should be hashed and detonated in a sandbox rather than opened on production systems.

URLs should be defanged and checked against reputation services before investigation from a safe environment.

Business email compromise requires verifying payment or credential requests through an independent channel.

Containment includes blocking the sender, purging matching messages, resetting credentials, and warning recipients.

Preserve the raw message with full headers as evidence before deleting or quarantining it.

Useful network evidence sources include firewall logs, IDS/IPS alerts, NetFlow or IPFIX, DNS logs, proxy logs, and packet captures.

Beaconing is periodic outbound communication to an external server, often indicating malware command-and-control.

DNS tunneling indicators include unusually long queries, high query volume, or many TXT requests to one domain.

Containment can include ACLs, firewall blocks, switch-port disabling, network segmentation, and DNS sinkholes.

Packet capture analysis uses filters by IP, port, protocol, and payload pattern to reconstruct sessions.

DDoS response may involve upstream scrubbing, rate limiting, traffic filtering, and load balancer configuration.

Lateral movement signs include SMB/RDP scanning, credential use from unusual hosts, and service creation across systems.

ARP spoofing and MITM detection rely on duplicate MAC warnings, ARP table anomalies, and traffic asymmetry.

OWASP Top 10 categories include broken access control, injection, cryptographic failures, and security misconfiguration.

Key evidence sources are web server access logs, error logs, WAF logs, application logs, and authentication logs.

SQL injection inserts malicious SQL into input fields to bypass authentication, modify data, or extract records.

Cross-site scripting injects scripts into pages viewed by other users, enabling session theft or defacement.

SSRF tricks the server into making requests to internal resources; IDOR exposes objects through missing authorization checks.

Indicators include encoded payloads, unusual parameters, spikes in 4xx/5xx errors, and requests from anomalous geographies.

Containment may include WAF blocking, disabling vulnerable features, taking the app offline, and patching code.

After remediation, retest in staging and review whether stolen sessions or credentials must be revoked.

The shared responsibility model divides provider infrastructure security from customer data, identity, and configuration security.

Cloud audit sources include AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs, and provider-native security tools.

Identity incidents often involve leaked access keys, over-privileged roles, missing MFA, or federated trust misuse.

Common misconfigurations include public storage buckets, open security groups, and overly permissive IAM policies.

Containment actions include revoking keys, disabling accounts, isolating instances, and applying restrictive security groups.

Preserve provider logs, API audit records, instance snapshots, and metadata before remediation destroys evidence.

Cloud investigations often require provider cooperation and consideration of data jurisdiction and legal process.

CASB and cloud SIEM tools help detect anomalous API activity, data exfiltration, and shadow IT use.

Insider threat types include malicious, negligent, and compromised insiders.

Indicators include unusual access hours, mass downloads, access to unrelated records, USB use, and privilege changes.

UEBA baselines normal behavior and flags anomalies; DLP detects sensitive data movement.

Least privilege, separation of duties, and periodic access reviews reduce insider opportunity.

Containment may include revoking access, disabling accounts, monitoring activity, and preserving device evidence.

HR and legal should coordinate before confrontation, termination, or law enforcement involvement.

Evidence sources include badge logs, endpoint logs, email records, file access logs, and removable media records.

Interviews should be conducted by HR or legal with documented questions and without tipping off other subjects.

Endpoint evidence sources include EDR telemetry, antivirus logs, host firewall logs, HIDS alerts, and Windows event logs.

Sysmon records process creation, network connections, file changes, and registry events useful for host forensics.

Common persistence mechanisms include Run keys, scheduled tasks, services, startup folders, and WMI subscriptions.

Containment actions include host isolation, process termination, account disabling, and blocking malicious hashes.

Live response should capture volatile data before shutdown and document every command executed.

Memory and disk forensics can recover malware, credentials, and attacker artifacts not present in logs.

Prevention controls include patching, application allowlisting, least privilege, and EDR policy enforcement.

Indicators include unusual parent-child process relationships, privilege escalation, and unsigned binaries running from temp paths.