eCDFP cheat sheet

CIA triad: Confidentiality (unauthorized disclosure), Integrity (unauthorized modification), Availability (disruption of access); a control is mapped to the property it primarily protects.

Defense in depth layers: perimeter, network segmentation, host hardening, application controls, data protection, and monitoring; a single failed layer should not expose the asset.

Preventive vs. detective vs. corrective controls: firewalls and ACLs prevent, IDS and log review detect, backups and reimaging correct; compensating controls substitute when a primary control is infeasible.

Risk = likelihood x impact; residual risk is what remains after controls. Risk treatment options are mitigate, transfer, avoid, and accept.

Least privilege and separation of duties limit blast radius: a compromised account should hold only the rights required for its function, and no single identity should authorize and execute a sensitive action.

Vulnerability vs. exploit vs. threat: a vulnerability is a weakness, an exploit is the method that abuses it, a threat is the actor or event that may act on it. CVSS scores severity, not organizational risk.

Patch and configuration management: asset inventory precedes patching; unmanaged or unknown assets are the most common gap in coverage.

Authentication factors are knowledge, possession, and inherence; MFA requires two different categories, and two passwords are not MFA.

Data classification drives handling: public, internal, confidential, restricted - retention, encryption, and access rules follow the highest classification of the data involved.

TCP three-way handshake: SYN, SYN/ACK, ACK. A flood of SYNs without completed handshakes indicates SYN scanning or SYN flood; RST responses to SYN indicate closed ports.

Common ports for triage: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 123 NTP, 135/139/445 SMB, 389/636 LDAP(S), 443 HTTPS, 1433 MSSQL, 3306 MySQL, 3389 RDP, 5985/5986 WinRM.

DNS tunneling indicators: unusually long or high-entropy subdomain labels, high volume of TXT/NULL queries, many NXDOMAIN replies, and a single client querying one domain at a steady cadence.

Beaconing detection: repeated connections at near-constant intervals with jitter, small and consistent byte counts, and destination IPs or domains with low reputation or newly registered age.

PCAP analysis workflow: protocol hierarchy and conversations first to find outliers, then filter by suspect IP or port, then follow the stream to reconstruct payloads and extract files.

Lateral movement over the network: SMB (445) and WinRM (5985/5986) from workstation to workstation, RDP fan-out, and NTLM authentication to many hosts from one source.

Encryption does not hide metadata: JA3/JA3S fingerprints identify TLS client and server stacks, SNI reveals the requested hostname, and certificate fields expose issuers and validity anomalies.

Egress filtering and segmentation: outbound allowlists block command-and-control, and VLAN or microsegmentation stops flat-network spread; east-west traffic matters as much as north-south.

NetFlow/IPFIX records give src/dst IP, ports, protocol, byte and packet counts, and timestamps - use them for volume anomalies and long-duration low-and-slow sessions when full PCAP is not retained.

Windows process ancestry: normal chains are services.exe -> svchost.exe, winlogon.exe -> userinit.exe -> explorer.exe. Office applications spawning powershell.exe, cmd.exe, wscript.exe, or mshta.exe is a strong malicious-macro indicator.

LOLBins to flag: powershell.exe, cmd.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, wmic.exe, and msiexec.exe when used for download or execution.

Encoded PowerShell: -enc or -EncodedCommand with a long Base64 blob; decode offline to inspect. Also watch -nop, -w hidden, and -ExecutionPolicy Bypass combinations.

Persistence locations: Run and RunOnce registry keys, Startup folders, scheduled tasks, services, WMI event subscriptions, and logon scripts. Autoruns enumerates most of these in one view.

Linux persistence and execution: cron and systemd units, ~/.bashrc and profile scripts, SSH authorized_keys additions, and LD_PRELOAD; deleted binaries still running appear with a (deleted) suffix in /proc.

Sysmon key event IDs: 1 process create, 3 network connect, 7 image load, 8 remote thread create, 11 file create, 13 registry set, 22 DNS query. Event 8 across processes suggests injection.

Credential access artifacts: LSASS access by non-system processes, comsvcs.dll MiniDump usage, and NTDS.dit or SAM/SECURITY hive copies indicate credential dumping.

File integrity and hashing: compare SHA-256 of suspicious binaries against known-good baselines; note that attackers can timestomp, so creation and modification times may disagree with the sequence of events.

EDR telemetry value: process trees, command lines, parent-child relationships, and network connections per process give context that standalone antivirus alerts lack.

Windows Security event IDs to know: 4624 logon success, 4625 logon failure, 4634/4647 logoff, 4648 explicit credential logon, 4672 special privileges assigned, 4688 process creation, 4720 account created, 4728/4732 group member added, 4768/4769 Kerberos TGT/TGS.

Logon types in 4624: 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 runas, 10 RDP, 11 cached credentials. Type 3 with NTLM to many hosts suggests lateral movement.

Kerberos attack signatures: 4769 with RC4 encryption (0x17) and no preceding 4768 suggests Kerberoasting; a spike of 4768 with 0x6 failure codes indicates password spraying against the KDC.

Syslog severity: 0 emergency through 7 debug. Authentication events typically arrive via auth, authpriv, or security facilities; correlate with sudo and sshd entries on Linux hosts.

Detection logic structure: select the data source, define the event condition, add baseline or threshold context, and specify the response. A rule without a threshold produces alert fatigue on routine admin activity.

False positive reduction: whitelist known administrative accounts and maintenance windows explicitly, and tune thresholds against a measured baseline rather than guessing.

Log integrity and retention: centralize logs off-host, synchronize time with NTP, and protect the log store from tampering - attacker-cleared event logs (1102) are themselves a detection.

Correlation across sources: an alert is stronger when an endpoint process event, a network connection, and an authentication event agree on the same host, user, and timestamp window.

Sigma-style rules are portable: they describe detection logic in a vendor-neutral form that can be converted to SIEM query languages, keeping logic separate from platform syntax.

IR phases: preparation, identification, containment, eradication, recovery, and lessons learned. Containment precedes eradication; evidence preservation must not be skipped to shorten response time.

Order of volatility: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media. Capture the most volatile evidence first.

Containment options: isolate the host from the network, disable the account, block the indicator at the perimeter, or segment the VLAN. Short-term containment stops spread; long-term containment restores controlled operations.

Chain of custody: record who collected each item, when, where, and how; hash evidence at acquisition and verify the hash later. A break in custody weakens evidentiary value.

Threat hunting starts from a hypothesis, not an alert: form a hypothesis from threat intelligence or ATT&CK technique coverage, query telemetry, and convert confirmed findings into a new detection rule.

MITRE ATT&CK tactic order gives a hunting roadmap: initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, impact.

Indicator types: atomic (IP, hash, domain) are easy to change; behavioral (process chain, command-line pattern) indicators survive attacker retooling and are more durable detections.

Purple teaming measures detection coverage: emulate a specific technique, check whether telemetry and rules fire, and record the gap as a prioritized detection engineering task.

Post-incident review outputs: root cause, timeline of attacker actions, controls that failed, and concrete detection or hardening changes with owners and dates.

CIA triad: Confidentiality (unauthorized disclosure), Integrity (unauthorized modification), Availability (disruption of access); a control is mapped to the property it primarily protects.

Defense in depth layers: perimeter, network segmentation, host hardening, application controls, data protection, and monitoring; a single failed layer should not expose the asset.

Preventive vs. detective vs. corrective controls: firewalls and ACLs prevent, IDS and log review detect, backups and reimaging correct; compensating controls substitute when a primary control is infeasible.

Risk = likelihood x impact; residual risk is what remains after controls. Risk treatment options are mitigate, transfer, avoid, and accept.

Least privilege and separation of duties limit blast radius: a compromised account should hold only the rights required for its function, and no single identity should authorize and execute a sensitive action.

Vulnerability vs. exploit vs. threat: a vulnerability is a weakness, an exploit is the method that abuses it, a threat is the actor or event that may act on it. CVSS scores severity, not organizational risk.

Patch and configuration management: asset inventory precedes patching; unmanaged or unknown assets are the most common gap in coverage.

Authentication factors are knowledge, possession, and inherence; MFA requires two different categories, and two passwords are not MFA.

Data classification drives handling: public, internal, confidential, restricted - retention, encryption, and access rules follow the highest classification of the data involved.

TCP three-way handshake: SYN, SYN/ACK, ACK. A flood of SYNs without completed handshakes indicates SYN scanning or SYN flood; RST responses to SYN indicate closed ports.

Common ports for triage: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 123 NTP, 135/139/445 SMB, 389/636 LDAP(S), 443 HTTPS, 1433 MSSQL, 3306 MySQL, 3389 RDP, 5985/5986 WinRM.

DNS tunneling indicators: unusually long or high-entropy subdomain labels, high volume of TXT/NULL queries, many NXDOMAIN replies, and a single client querying one domain at a steady cadence.

Beaconing detection: repeated connections at near-constant intervals with jitter, small and consistent byte counts, and destination IPs or domains with low reputation or newly registered age.

PCAP analysis workflow: protocol hierarchy and conversations first to find outliers, then filter by suspect IP or port, then follow the stream to reconstruct payloads and extract files.

Lateral movement over the network: SMB (445) and WinRM (5985/5986) from workstation to workstation, RDP fan-out, and NTLM authentication to many hosts from one source.

Encryption does not hide metadata: JA3/JA3S fingerprints identify TLS client and server stacks, SNI reveals the requested hostname, and certificate fields expose issuers and validity anomalies.

Egress filtering and segmentation: outbound allowlists block command-and-control, and VLAN or microsegmentation stops flat-network spread; east-west traffic matters as much as north-south.

NetFlow/IPFIX records give src/dst IP, ports, protocol, byte and packet counts, and timestamps - use them for volume anomalies and long-duration low-and-slow sessions when full PCAP is not retained.

Windows process ancestry: normal chains are services.exe -> svchost.exe, winlogon.exe -> userinit.exe -> explorer.exe. Office applications spawning powershell.exe, cmd.exe, wscript.exe, or mshta.exe is a strong malicious-macro indicator.

LOLBins to flag: powershell.exe, cmd.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, wmic.exe, and msiexec.exe when used for download or execution.

Encoded PowerShell: -enc or -EncodedCommand with a long Base64 blob; decode offline to inspect. Also watch -nop, -w hidden, and -ExecutionPolicy Bypass combinations.

Persistence locations: Run and RunOnce registry keys, Startup folders, scheduled tasks, services, WMI event subscriptions, and logon scripts. Autoruns enumerates most of these in one view.

Linux persistence and execution: cron and systemd units, ~/.bashrc and profile scripts, SSH authorized_keys additions, and LD_PRELOAD; deleted binaries still running appear with a (deleted) suffix in /proc.

Sysmon key event IDs: 1 process create, 3 network connect, 7 image load, 8 remote thread create, 11 file create, 13 registry set, 22 DNS query. Event 8 across processes suggests injection.

Credential access artifacts: LSASS access by non-system processes, comsvcs.dll MiniDump usage, and NTDS.dit or SAM/SECURITY hive copies indicate credential dumping.

File integrity and hashing: compare SHA-256 of suspicious binaries against known-good baselines; note that attackers can timestomp, so creation and modification times may disagree with the sequence of events.

EDR telemetry value: process trees, command lines, parent-child relationships, and network connections per process give context that standalone antivirus alerts lack.

Windows Security event IDs to know: 4624 logon success, 4625 logon failure, 4634/4647 logoff, 4648 explicit credential logon, 4672 special privileges assigned, 4688 process creation, 4720 account created, 4728/4732 group member added, 4768/4769 Kerberos TGT/TGS.

Logon types in 4624: 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 runas, 10 RDP, 11 cached credentials. Type 3 with NTLM to many hosts suggests lateral movement.

Kerberos attack signatures: 4769 with RC4 encryption (0x17) and no preceding 4768 suggests Kerberoasting; a spike of 4768 with 0x6 failure codes indicates password spraying against the KDC.

Syslog severity: 0 emergency through 7 debug. Authentication events typically arrive via auth, authpriv, or security facilities; correlate with sudo and sshd entries on Linux hosts.

Detection logic structure: select the data source, define the event condition, add baseline or threshold context, and specify the response. A rule without a threshold produces alert fatigue on routine admin activity.

False positive reduction: whitelist known administrative accounts and maintenance windows explicitly, and tune thresholds against a measured baseline rather than guessing.

Log integrity and retention: centralize logs off-host, synchronize time with NTP, and protect the log store from tampering - attacker-cleared event logs (1102) are themselves a detection.

Correlation across sources: an alert is stronger when an endpoint process event, a network connection, and an authentication event agree on the same host, user, and timestamp window.

Sigma-style rules are portable: they describe detection logic in a vendor-neutral form that can be converted to SIEM query languages, keeping logic separate from platform syntax.

IR phases: preparation, identification, containment, eradication, recovery, and lessons learned. Containment precedes eradication; evidence preservation must not be skipped to shorten response time.

Order of volatility: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media. Capture the most volatile evidence first.

Containment options: isolate the host from the network, disable the account, block the indicator at the perimeter, or segment the VLAN. Short-term containment stops spread; long-term containment restores controlled operations.

Chain of custody: record who collected each item, when, where, and how; hash evidence at acquisition and verify the hash later. A break in custody weakens evidentiary value.

Threat hunting starts from a hypothesis, not an alert: form a hypothesis from threat intelligence or ATT&CK technique coverage, query telemetry, and convert confirmed findings into a new detection rule.

MITRE ATT&CK tactic order gives a hunting roadmap: initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, impact.

Indicator types: atomic (IP, hash, domain) are easy to change; behavioral (process chain, command-line pattern) indicators survive attacker retooling and are more durable detections.

Purple teaming measures detection coverage: emulate a specific technique, check whether telemetry and rules fire, and record the gap as a prioritized detection engineering task.

Post-incident review outputs: root cause, timeline of attacker actions, controls that failed, and concrete detection or hardening changes with owners and dates.

CIA triad: Confidentiality (unauthorized disclosure), Integrity (unauthorized modification), Availability (disruption of access); a control is mapped to the property it primarily protects.

Defense in depth layers: perimeter, network segmentation, host hardening, application controls, data protection, and monitoring; a single failed layer should not expose the asset.

Preventive vs. detective vs. corrective controls: firewalls and ACLs prevent, IDS and log review detect, backups and reimaging correct; compensating controls substitute when a primary control is infeasible.

Risk = likelihood x impact; residual risk is what remains after controls. Risk treatment options are mitigate, transfer, avoid, and accept.

Least privilege and separation of duties limit blast radius: a compromised account should hold only the rights required for its function, and no single identity should authorize and execute a sensitive action.

Vulnerability vs. exploit vs. threat: a vulnerability is a weakness, an exploit is the method that abuses it, a threat is the actor or event that may act on it. CVSS scores severity, not organizational risk.

Patch and configuration management: asset inventory precedes patching; unmanaged or unknown assets are the most common gap in coverage.

Authentication factors are knowledge, possession, and inherence; MFA requires two different categories, and two passwords are not MFA.

Data classification drives handling: public, internal, confidential, restricted - retention, encryption, and access rules follow the highest classification of the data involved.

TCP three-way handshake: SYN, SYN/ACK, ACK. A flood of SYNs without completed handshakes indicates SYN scanning or SYN flood; RST responses to SYN indicate closed ports.

Common ports for triage: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 123 NTP, 135/139/445 SMB, 389/636 LDAP(S), 443 HTTPS, 1433 MSSQL, 3306 MySQL, 3389 RDP, 5985/5986 WinRM.

DNS tunneling indicators: unusually long or high-entropy subdomain labels, high volume of TXT/NULL queries, many NXDOMAIN replies, and a single client querying one domain at a steady cadence.

Beaconing detection: repeated connections at near-constant intervals with jitter, small and consistent byte counts, and destination IPs or domains with low reputation or newly registered age.

PCAP analysis workflow: protocol hierarchy and conversations first to find outliers, then filter by suspect IP or port, then follow the stream to reconstruct payloads and extract files.

Lateral movement over the network: SMB (445) and WinRM (5985/5986) from workstation to workstation, RDP fan-out, and NTLM authentication to many hosts from one source.

Encryption does not hide metadata: JA3/JA3S fingerprints identify TLS client and server stacks, SNI reveals the requested hostname, and certificate fields expose issuers and validity anomalies.

Egress filtering and segmentation: outbound allowlists block command-and-control, and VLAN or microsegmentation stops flat-network spread; east-west traffic matters as much as north-south.

NetFlow/IPFIX records give src/dst IP, ports, protocol, byte and packet counts, and timestamps - use them for volume anomalies and long-duration low-and-slow sessions when full PCAP is not retained.

Windows process ancestry: normal chains are services.exe -> svchost.exe, winlogon.exe -> userinit.exe -> explorer.exe. Office applications spawning powershell.exe, cmd.exe, wscript.exe, or mshta.exe is a strong malicious-macro indicator.

LOLBins to flag: powershell.exe, cmd.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, wmic.exe, and msiexec.exe when used for download or execution.

Encoded PowerShell: -enc or -EncodedCommand with a long Base64 blob; decode offline to inspect. Also watch -nop, -w hidden, and -ExecutionPolicy Bypass combinations.

Persistence locations: Run and RunOnce registry keys, Startup folders, scheduled tasks, services, WMI event subscriptions, and logon scripts. Autoruns enumerates most of these in one view.

Linux persistence and execution: cron and systemd units, ~/.bashrc and profile scripts, SSH authorized_keys additions, and LD_PRELOAD; deleted binaries still running appear with a (deleted) suffix in /proc.

Sysmon key event IDs: 1 process create, 3 network connect, 7 image load, 8 remote thread create, 11 file create, 13 registry set, 22 DNS query. Event 8 across processes suggests injection.

Credential access artifacts: LSASS access by non-system processes, comsvcs.dll MiniDump usage, and NTDS.dit or SAM/SECURITY hive copies indicate credential dumping.

File integrity and hashing: compare SHA-256 of suspicious binaries against known-good baselines; note that attackers can timestomp, so creation and modification times may disagree with the sequence of events.

EDR telemetry value: process trees, command lines, parent-child relationships, and network connections per process give context that standalone antivirus alerts lack.

Windows Security event IDs to know: 4624 logon success, 4625 logon failure, 4634/4647 logoff, 4648 explicit credential logon, 4672 special privileges assigned, 4688 process creation, 4720 account created, 4728/4732 group member added, 4768/4769 Kerberos TGT/TGS.

Logon types in 4624: 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 runas, 10 RDP, 11 cached credentials. Type 3 with NTLM to many hosts suggests lateral movement.

Kerberos attack signatures: 4769 with RC4 encryption (0x17) and no preceding 4768 suggests Kerberoasting; a spike of 4768 with 0x6 failure codes indicates password spraying against the KDC.

Syslog severity: 0 emergency through 7 debug. Authentication events typically arrive via auth, authpriv, or security facilities; correlate with sudo and sshd entries on Linux hosts.

Detection logic structure: select the data source, define the event condition, add baseline or threshold context, and specify the response. A rule without a threshold produces alert fatigue on routine admin activity.

False positive reduction: whitelist known administrative accounts and maintenance windows explicitly, and tune thresholds against a measured baseline rather than guessing.

Log integrity and retention: centralize logs off-host, synchronize time with NTP, and protect the log store from tampering - attacker-cleared event logs (1102) are themselves a detection.

Correlation across sources: an alert is stronger when an endpoint process event, a network connection, and an authentication event agree on the same host, user, and timestamp window.

Sigma-style rules are portable: they describe detection logic in a vendor-neutral form that can be converted to SIEM query languages, keeping logic separate from platform syntax.

IR phases: preparation, identification, containment, eradication, recovery, and lessons learned. Containment precedes eradication; evidence preservation must not be skipped to shorten response time.

Order of volatility: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media. Capture the most volatile evidence first.

Containment options: isolate the host from the network, disable the account, block the indicator at the perimeter, or segment the VLAN. Short-term containment stops spread; long-term containment restores controlled operations.

Chain of custody: record who collected each item, when, where, and how; hash evidence at acquisition and verify the hash later. A break in custody weakens evidentiary value.

Threat hunting starts from a hypothesis, not an alert: form a hypothesis from threat intelligence or ATT&CK technique coverage, query telemetry, and convert confirmed findings into a new detection rule.

MITRE ATT&CK tactic order gives a hunting roadmap: initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, impact.

Indicator types: atomic (IP, hash, domain) are easy to change; behavioral (process chain, command-line pattern) indicators survive attacker retooling and are more durable detections.

Purple teaming measures detection coverage: emulate a specific technique, check whether telemetry and rules fire, and record the gap as a prioritized detection engineering task.

Post-incident review outputs: root cause, timeline of attacker actions, controls that failed, and concrete detection or hardening changes with owners and dates.

CIA triad: Confidentiality (unauthorized disclosure), Integrity (unauthorized modification), Availability (disruption of access); a control is mapped to the property it primarily protects.

Defense in depth layers: perimeter, network segmentation, host hardening, application controls, data protection, and monitoring; a single failed layer should not expose the asset.

Preventive vs. detective vs. corrective controls: firewalls and ACLs prevent, IDS and log review detect, backups and reimaging correct; compensating controls substitute when a primary control is infeasible.

Risk = likelihood x impact; residual risk is what remains after controls. Risk treatment options are mitigate, transfer, avoid, and accept.

Least privilege and separation of duties limit blast radius: a compromised account should hold only the rights required for its function, and no single identity should authorize and execute a sensitive action.

Vulnerability vs. exploit vs. threat: a vulnerability is a weakness, an exploit is the method that abuses it, a threat is the actor or event that may act on it. CVSS scores severity, not organizational risk.

Patch and configuration management: asset inventory precedes patching; unmanaged or unknown assets are the most common gap in coverage.

Authentication factors are knowledge, possession, and inherence; MFA requires two different categories, and two passwords are not MFA.

Data classification drives handling: public, internal, confidential, restricted - retention, encryption, and access rules follow the highest classification of the data involved.

TCP three-way handshake: SYN, SYN/ACK, ACK. A flood of SYNs without completed handshakes indicates SYN scanning or SYN flood; RST responses to SYN indicate closed ports.

Common ports for triage: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 123 NTP, 135/139/445 SMB, 389/636 LDAP(S), 443 HTTPS, 1433 MSSQL, 3306 MySQL, 3389 RDP, 5985/5986 WinRM.

DNS tunneling indicators: unusually long or high-entropy subdomain labels, high volume of TXT/NULL queries, many NXDOMAIN replies, and a single client querying one domain at a steady cadence.

Beaconing detection: repeated connections at near-constant intervals with jitter, small and consistent byte counts, and destination IPs or domains with low reputation or newly registered age.

PCAP analysis workflow: protocol hierarchy and conversations first to find outliers, then filter by suspect IP or port, then follow the stream to reconstruct payloads and extract files.

Lateral movement over the network: SMB (445) and WinRM (5985/5986) from workstation to workstation, RDP fan-out, and NTLM authentication to many hosts from one source.

Encryption does not hide metadata: JA3/JA3S fingerprints identify TLS client and server stacks, SNI reveals the requested hostname, and certificate fields expose issuers and validity anomalies.

Egress filtering and segmentation: outbound allowlists block command-and-control, and VLAN or microsegmentation stops flat-network spread; east-west traffic matters as much as north-south.

NetFlow/IPFIX records give src/dst IP, ports, protocol, byte and packet counts, and timestamps - use them for volume anomalies and long-duration low-and-slow sessions when full PCAP is not retained.

Windows process ancestry: normal chains are services.exe -> svchost.exe, winlogon.exe -> userinit.exe -> explorer.exe. Office applications spawning powershell.exe, cmd.exe, wscript.exe, or mshta.exe is a strong malicious-macro indicator.

LOLBins to flag: powershell.exe, cmd.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, wmic.exe, and msiexec.exe when used for download or execution.

Encoded PowerShell: -enc or -EncodedCommand with a long Base64 blob; decode offline to inspect. Also watch -nop, -w hidden, and -ExecutionPolicy Bypass combinations.

Persistence locations: Run and RunOnce registry keys, Startup folders, scheduled tasks, services, WMI event subscriptions, and logon scripts. Autoruns enumerates most of these in one view.

Linux persistence and execution: cron and systemd units, ~/.bashrc and profile scripts, SSH authorized_keys additions, and LD_PRELOAD; deleted binaries still running appear with a (deleted) suffix in /proc.

Sysmon key event IDs: 1 process create, 3 network connect, 7 image load, 8 remote thread create, 11 file create, 13 registry set, 22 DNS query. Event 8 across processes suggests injection.

Credential access artifacts: LSASS access by non-system processes, comsvcs.dll MiniDump usage, and NTDS.dit or SAM/SECURITY hive copies indicate credential dumping.

File integrity and hashing: compare SHA-256 of suspicious binaries against known-good baselines; note that attackers can timestomp, so creation and modification times may disagree with the sequence of events.

EDR telemetry value: process trees, command lines, parent-child relationships, and network connections per process give context that standalone antivirus alerts lack.

Windows Security event IDs to know: 4624 logon success, 4625 logon failure, 4634/4647 logoff, 4648 explicit credential logon, 4672 special privileges assigned, 4688 process creation, 4720 account created, 4728/4732 group member added, 4768/4769 Kerberos TGT/TGS.

Logon types in 4624: 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 runas, 10 RDP, 11 cached credentials. Type 3 with NTLM to many hosts suggests lateral movement.

Kerberos attack signatures: 4769 with RC4 encryption (0x17) and no preceding 4768 suggests Kerberoasting; a spike of 4768 with 0x6 failure codes indicates password spraying against the KDC.

Syslog severity: 0 emergency through 7 debug. Authentication events typically arrive via auth, authpriv, or security facilities; correlate with sudo and sshd entries on Linux hosts.

Detection logic structure: select the data source, define the event condition, add baseline or threshold context, and specify the response. A rule without a threshold produces alert fatigue on routine admin activity.

False positive reduction: whitelist known administrative accounts and maintenance windows explicitly, and tune thresholds against a measured baseline rather than guessing.

Log integrity and retention: centralize logs off-host, synchronize time with NTP, and protect the log store from tampering - attacker-cleared event logs (1102) are themselves a detection.

Correlation across sources: an alert is stronger when an endpoint process event, a network connection, and an authentication event agree on the same host, user, and timestamp window.

Sigma-style rules are portable: they describe detection logic in a vendor-neutral form that can be converted to SIEM query languages, keeping logic separate from platform syntax.

IR phases: preparation, identification, containment, eradication, recovery, and lessons learned. Containment precedes eradication; evidence preservation must not be skipped to shorten response time.

Order of volatility: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media. Capture the most volatile evidence first.

Containment options: isolate the host from the network, disable the account, block the indicator at the perimeter, or segment the VLAN. Short-term containment stops spread; long-term containment restores controlled operations.

Chain of custody: record who collected each item, when, where, and how; hash evidence at acquisition and verify the hash later. A break in custody weakens evidentiary value.

Threat hunting starts from a hypothesis, not an alert: form a hypothesis from threat intelligence or ATT&CK technique coverage, query telemetry, and convert confirmed findings into a new detection rule.

MITRE ATT&CK tactic order gives a hunting roadmap: initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, impact.

Indicator types: atomic (IP, hash, domain) are easy to change; behavioral (process chain, command-line pattern) indicators survive attacker retooling and are more durable detections.

Purple teaming measures detection coverage: emulate a specific technique, check whether telemetry and rules fire, and record the gap as a prioritized detection engineering task.

Post-incident review outputs: root cause, timeline of attacker actions, controls that failed, and concrete detection or hardening changes with owners and dates.