CTDC cheat sheet

Full-packet capture vs. flow records: NetFlow/IPFIX records carry 5-tuple, byte/packet counts, timestamps, and TCP flags but no payload; use flow analytics for lateral-movement and beaconing baselines, and PCAP for content signatures and protocol anomaly review.

Beaconing detection formula: for repeated connections to the same destination, compute inter-arrival intervals and their coefficient of variation (CV = standard deviation / mean). Low CV (< ~0.2) with jittered sleep values indicates automated C2; human browsing shows high variance.

DNS tunneling indicators: high volume of TXT/NULL/AAAA queries to one domain, long encoded subdomain labels (> 50 chars), high entropy in the leftmost label, and query rates exceeding the host baseline.

JA3/JA3S fingerprinting hashes TLS ClientHello/ServerHello fields; the same malware family often reuses a JA3 hash even when IPs and SNI rotate, so treat JA3 as a host-independent indicator.

Protocol anomaly checks: HTTP requests with mismatched Host headers, non-standard ports carrying HTTP, missing User-Agent, and TLS on ports other than 443/8443 are common tunneling and proxy-bypass signals.

East-west traffic baselining: internal host-to-host SMB (445), RDP (3389), and WinRM (5985/5986) fan-out to many distinct hosts in a short window maps to lateral movement and should be scored on distinct-destination count, not raw volume.

Data-exfiltration sizing: compare outbound bytes to inbound bytes per host per day; a ratio above the host's 30-day p95 plus sustained large uploads to low-reputation ASNs is a prioritization signal, not proof.

Encrypted-traffic analysis without decryption relies on SNI, certificate subject/issuer, JA3/JA3S, packet-size distributions, and connection duration; self-signed or short-lived certs to rare SNI values raise score.

EDR telemetry primitives: process creation (image, command line, parent, user, hash), network connection, file write/rename, registry modification, module load, and script-block logging; detections should key on parent-child lineage plus command-line content.

Known LOLBin abuse pairs: office apps spawning powershell/cmd/wscript/mshta; wmic.exe with process call create; rundll32 with javascript: or remote DLL paths; regsvr32 with scrobj.dll (Squiblydoo); mshta with http(s) URLs.

Process injection evidence: a remote thread created in another process, unbacked executable memory (RWX), and a process whose loaded modules do not include the module backing its memory; correlate with CreateRemoteThread and WriteProcessMemory events.

Credential-access signals: lsass.exe handle requests with read permissions from non-security products, comsvcs.dll MiniDump invocation, and procdump/rundll32 targeting LSASS; treat as high severity regardless of user.

Persistence surfaces to monitor: Run/RunOnce keys, scheduled tasks, services, WMI event subscriptions (__EventFilter/__EventConsumer), startup folders, and browser extensions; new entries with obfuscated commands warrant review.

Isolation and containment tradeoffs: network-isolate the host first (preserves memory and disk), then collect volatile data (process list, netstat, memory image) before remediation; rebooting destroys volatile evidence.

Ransomware precursors: volume shadow copy deletion (vssadmin delete shadows), bcdedit recoveryenabled set to no, and mass file rename with entropy change; detect on command line and on file-extension burst rate.

Endpoint detection tuning input: allowlist by signed publisher plus hash for known-good admin tools, and require behavioral context (parent, user, path) before alerting on dual-use binaries.

Windows Security event IDs to know: 4624 logon (Type 3 network, 10 RDP, 2 interactive), 4625 failure, 4648 explicit credentials, 4672 special privileges, 4688 process creation, 4720 account created, 4768/4769 Kerberos TGT/service ticket, 7045 service installed.

Sysmon event IDs: 1 process create, 3 network connect, 7 image load, 8 CreateRemoteThread, 10 process access, 11 file create, 12/13/14 registry, 22 DNS query, 25 process tampering.

Log-source coverage gaps: authentication (DC, VPN, IdP), endpoint (EDR, Sysmon), network (firewall, proxy, DNS), cloud control plane (CloudTrail/Audit Log/Activity Log), and email; missing DNS or proxy logs blinds beaconing and exfil detections.

Correlation rule anatomy: a detection needs a trigger event, optional join/state (threshold, time window, entity key), and a scoring/severity mapping; stateful joins must key on a stable entity (host, user, hash) to avoid false merges.

Time normalization: store all events in UTC with source timezone recorded; clock skew between sources breaks sequence-based correlation, so monitor for NTP drift and flag hosts with offset beyond tolerance.

Triage order: severity x asset criticality x confidence, then verify indicator context (is the IP internal? is the hash known-good?), check prevalence across the estate, and decide true positive / benign / inconclusive with documented reasoning.

Alert enrichment fields that speed triage: process lineage, user privilege level, first-seen vs. last-seen for the indicator, asset owner, and whether the same behavior exists on other hosts.

Log retention and integrity: forward logs off-host immediately, protect with hashing or WORM storage, and keep retention aligned to investigation windows (commonly 90 days hot, 1 year cold) so incident timelines can be reconstructed.

Indicator types and decay: IP addresses are volatile (hours-days), domains moderate (days-weeks), file hashes stable (months-years); expiry should scale inversely with volatility and be set at ingestion.

Confidence and provenance: every indicator needs a source, first-seen date, confidence score, and TLP marking; unprovenanced IOCs should not auto-block.

Pyramid of Pain: hash and IP blocking is easily evaded; TTP-level detection (behavior) costs the adversary more, so prioritize behavioral rules over atomic blocklists.

STIX/TAXII: STIX 2.x models indicators, observables, malware, and relationships as objects; TAXII 2.1 is the transport for sharing collections; MISP and OpenCTI are common platforms.

False-positive controls for feeds: deduplicate by normalized indicator, exclude known-good infrastructure (CDN, cloud, AV vendors, your own ranges), and require confidence threshold before automated action.

Aging and review: run periodic sweeps removing indicators not re-observed within their TTL; track hit rate per feed and retire feeds with high false-positive yield.

Enrichment lookups: passive DNS history, WHOIS/creation age, ASN reputation, and sandbox reports turn a bare IP or hash into context; newly registered domains (< 30 days) carry elevated risk.

Sharing hygiene: strip internal hostnames, usernames, and customer data before sharing externally; verify TLP permits redistribution.

ATT&CK structure: Tactics are the why (14 enterprise tactics from Reconnaissance through Impact); Techniques are the how (T1059 Command and Scripting Interpreter, T1055 Process Injection, T1071 Application Layer Protocol); Sub-techniques add specificity.

Initial Access examples: T1566 Phishing, T1190 Exploit Public-Facing Application, T1078 Valid Accounts, T1133 External Remote Services.

Execution and Persistence: T1053 Scheduled Task/Job, T1543 Create or Modify System Process, T1547 Boot or Logon Autostart, T1546 Event Triggered Execution (WMI subscriptions).

Privilege Escalation and Defense Evasion: T1068 exploitation for privilege escalation, T1134 Access Token Manipulation, T1562 Impair Defenses (disable logging/AV), T1070 Indicator Removal (clear logs, timestomp), T1218 System Binary Proxy Execution.

Credential Access and Discovery: T1003 OS Credential Dumping (LSASS, NTDS), T1558 Steal or Forge Kerberos Tickets (Kerberoasting, Golden Ticket), T1087 Account Discovery, T1018 Remote System Discovery.

Lateral Movement and C2: T1021 Remote Services (SMB/RDP/WinRM), T1570 Lateral Tool Transfer, T1071.001 Web Protocols, T1573 Encrypted Channel, T1090 Proxy, T1105 Ingress Tool Transfer.

Collection, Exfiltration, Impact: T1560 Archive Collected Data, T1074 Data Staged, T1041 Exfiltration Over C2 Channel, T1048 Exfiltration Over Alternative Protocol, T1486 Data Encrypted for Impact.

Mapping detections to ATT&CK: tag each rule with the technique(s) it covers, then compute coverage per tactic; uncovered tactics (often Discovery and Collection) reveal detection blind spots.

Incident lifecycle: Preparation, Detection & Analysis, Containment, Eradication, Recovery, Post-Incident Activity (NIST SP 800-61r2); each phase has entry/exit criteria and an owner.

Severity matrix inputs: data sensitivity, number of affected hosts/accounts, whether the adversary has persistence or domain admin, business-critical asset involvement, and regulatory exposure.

Escalation triggers: confirmed malware execution on a server, credential dumping, ransomware indicators, privileged-account compromise, or data exfiltration evidence; these bypass tier-1 queue and page on-call.

Containment options in order of invasiveness: monitor-only, account disable/password reset + token revocation, host network isolation, block at perimeter, and full subnet isolation; document the chosen action and time.

Evidence handling: maintain chain of custody, hash images at acquisition, record who accessed what and when, and preserve volatile data before shutdown.

Communication cadence: assign an incident commander, scribe, and comms lead; set update intervals by severity and keep a timestamped incident log used for the final report.

Recovery validation: confirm persistence removed (scheduled tasks, services, accounts, keys), rotate all credentials exposed on the host, and monitor for adversary return for a defined period before closing.

Post-incident outputs: root cause, detection gaps, timeline, and concrete tuning actions; feed missed detections back into detection engineering as new rule requirements.

Identity hardening: enforce MFA on all remote and privileged access, disable legacy protocols (NTLMv1, SMBv1, unsigned LDAP), tier admin accounts, and remove standing domain-admin rights in favor of just-in-time elevation.

Credential protection: enable Credential Guard and LSA protection on Windows, restrict LSASS access, disable WDigest, and enforce least privilege to reduce dumpable credentials.

Endpoint controls: application allowlisting (WDAC/AppLocker), attack surface reduction rules blocking Office child processes and script execution, EDR tamper protection, and patch SLAs by CVSS and exposure.

Network segmentation: separate user, server, OT, and management planes; restrict east-west SMB/RDP/WinRM to required flows; deny direct internet egress except via proxy so C2 and exfil are observable.

Email and web defenses: DMARC enforcement (p=reject), SPF/DKIM alignment, attachment sandboxing, macro blocking, and URL rewriting with detonation.

Logging and monitoring as a control: enable PowerShell script-block logging, command-line auditing in process creation, DNS logging, and centralized retention; disabling these is itself a detection.

Backup and resilience: offline/immutable backups, tested restore procedures, and protected backup credentials so ransomware cannot delete recovery points.

Mitigation mapping: each control should reference the ATT&CK technique it mitigates (e.g., MFA mitigates T1078 Valid Accounts), enabling gap analysis against the threat model.

Detection-as-code pipeline: version control rules, peer review, unit tests with sample events, CI validation of syntax, staged deployment, and rollback capability; every rule has an owner and a documented intent.

Precision vs. recall tradeoff: tightening logic (adding conditions) raises precision and lowers recall; measure both with a labeled test set before and after each change rather than tuning by anecdote.

False-positive reduction levers: scope to environment (exclude known admin subnets), add parent/child context, require behavioral combinations, use allowlists by signed publisher plus hash, and raise thresholds only after measuring baseline distribution.

Signal quality metrics: false positive rate, true-positive yield per rule, mean time to triage, and alert-to-incident ratio; retire or rewrite rules whose yield stays near zero after tuning.

Baseline first: compute 30-day per-entity distributions for the behavior (connection counts, process frequency, distinct destinations) and set thresholds at a documented percentile so the rule has an evidence basis.

Suppression hygiene: every suppression needs an owner, a reason, an expiry date, and a scope (host/user/hash); permanent unscoped suppressions are detection debt.

Purple-team validation: execute the technique in a controlled lab or with atomic tests, confirm the rule fires, and record the result; a rule never validated against real telemetry is unproven.

Alert fatigue control: deduplicate and group related alerts by entity and time window, enrich before paging, and route low-confidence signals to hunting queues rather than the on-call pager.