I85PREP
⌘ K
eCDFP study materials
eCDFP study resources

eCDFP: Incident Response and Threat Hunting

eCDFP · Work through your exam, one topic at a time.

All guide sections

Incident Response and Threat Hunting

This domain tests process discipline under pressure: following the incident response lifecycle, preserving evidence in volatility order, and running hypothesis-driven hunts that end in a standing detection rather than a one-off answer.

Core rules and concepts

  • Lifecycle (NIST SP 800-61): Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity. Containment can be short-term (isolate the host now) or long-term (rebuild, patch, re-image), and the choice balances stopping spread against preserving evidence.
  • Order of volatility (RFC 3227): CPU and cache, memory, network state, running processes, temporary files, disk, remote logs, archival media. Capture memory before disk, and never reboot a suspect host before acquisition.
  • Evidence handling: chain-of-custody record, SHA-256 hash at acquisition and verification afterwards, write blockers, forensic images in E01 or raw dd, originals preserved untouched, every action timestamped in UTC.
  • Triage questions: how many hosts, patient zero, dwell time, initial access vector, persistence mechanism, what data was touched.
  • Hunting is hypothesis-driven, not alert-driven. Pick a technique from ATT&CK, name the data sources that would record it, query, investigate anomalies, then convert findings into automated detection.
  • Communications: legal, privacy, regulator and law-enforcement obligations may run on fixed clocks; involve them early rather than after containment.

Worked example

Hypothesis: 'Adversaries use scheduled tasks for persistence on servers.' Data: Security 4698, TaskScheduler operational events 106, 200 and 201, and Sysmon Event 1. Query tasks created in the last 30 days whose action launches powershell.exe or a binary under %TEMP%, and whose author is not the configuration-management account. Reasoning: legitimate tasks are created by patching or SCCM and point into Program Files. Result: two servers run a task named GoogleUpdateTaskMachineCore pointing to C:\ProgramData\svchost.exe, with 106 and a matching Sysmon 1 proving execution. Convert to a standing rule, sweep the fleet for the same task name, and scope other hosts that contacted the same binary path.

Traps that cost marks

Rebooting or re-imaging before memory capture; 'containing' by wiping evidence; treating a scanner run as a hunt; reporting local wall-clock times; skipping legal and notification obligations; ending a hunt with an answer but no reusable detection.

Key points

  • NIST phases: Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity.
  • Capture memory before disk; never reboot a suspect host first.
  • Hash evidence with SHA-256 and keep a chain-of-custody record.
  • Hunts start from an ATT&CK-based hypothesis, not an alert.
  • Every hunt should end in a tuned, reusable detection.