CTDC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NetFlow vs. full packet capture

Flow records summarize the 5-tuple, byte and packet counts, timestamps, and TCP flags without payload, while full packet capture retains content. Use flows for baselining and beaconing statistics; use PCAP for signatures and protocol anomaly review.

Beaconing coefficient of variation

For repeated connections to one destination, divide the standard deviation of inter-arrival intervals by their mean. A low value indicates regular automated check-ins typical of command-and-control; human browsing produces high variance.

JA3 fingerprint

A hash of selected TLS ClientHello fields such as version, cipher suites, extensions, and elliptic curves. Malware families often reuse the same JA3 even when destination IPs and server names rotate, making it a host-independent indicator.

DNS tunneling indicators

Watch for high volumes of TXT, NULL, or AAAA queries to a single domain, unusually long encoded subdomain labels, high entropy in the leftmost label, and query rates far above the host baseline.

East-west lateral movement signal

Internal host-to-host SMB, RDP, or WinRM connections fanning out to many distinct destinations in a short window. Score on distinct-destination count rather than raw traffic volume, since lateral movement is broad but shallow.

Encrypted traffic analysis inputs

Without decryption, detection relies on Server Name Indication, certificate subject and issuer, JA3 and JA3S fingerprints, packet-size distributions, and connection duration. Self-signed, short-lived, or rare certificates raise risk score.

Sysmon Event ID 1

Process creation. Records image path, command line, parent process, user, and file hashes, making it the primary telemetry for command-line and parent-child lineage detections on Windows endpoints.

Process injection evidence

Remote thread creation in another process, unbacked executable memory regions, and processes whose loaded modules do not back their memory. Correlate CreateRemoteThread and WriteProcessMemory events with image-load anomalies.

LSASS credential dumping signals

Handle requests to lsass.exe with read permissions from non-security products, comsvcs.dll MiniDump invocation, and procdump or rundll32 targeting LSASS. Treat any confirmed instance as high severity regardless of the user account involved.

Ransomware precursor commands

Volume shadow copy deletion via vssadmin, bcdedit setting recoveryenabled to no, and mass file rename with entropy change. Detect on command line plus file-extension burst rate rather than on file content alone.

LOLBin parent-child pairs

Office applications spawning powershell, cmd, wscript, or mshta; wmic with process call create; rundll32 loading remote DLLs; regsvr32 with scrobj.dll; mshta fetching HTTP URLs. These lineage pairs are high-confidence abuse indicators.

Containment versus evidence preservation

Network-isolate a host before remediation to preserve memory and disk, then collect volatile data such as process lists, network connections, and a memory image. Rebooting destroys volatile evidence needed for root-cause analysis.

Windows Event ID 4624 logon types

Type 2 is interactive, Type 3 is network, Type 10 is remote desktop. Correlating logon type with source address and account reveals lateral movement and unauthorized remote access that simple success counts would hide.

Kerberos event IDs 4768 and 4769

4768 records a ticket-granting ticket request; 4769 records a service ticket request. Spikes in 4769 with RC4 encryption for many service names from one account indicate Kerberoasting activity.

Stateful correlation rule anatomy

A rule needs a trigger event, optional state such as thresholds or joins within a time window, and a stable entity key like host, user, or hash. Joining on unstable fields merges unrelated events and creates false positives.

Log source coverage gaps

Common blind spots are DNS queries, proxy traffic, cloud control-plane audit logs, and identity provider authentication. Missing DNS or proxy logs prevents beaconing and exfiltration detection regardless of endpoint visibility quality.

Alert triage ordering

Rank by severity times asset criticality times confidence, then verify indicator context such as internal versus external addresses and known-good hashes, check estate-wide prevalence, and record a documented disposition of true positive, benign, or inconclusive.

Indicator volatility and expiry

IP addresses decay in hours to days, domains in days to weeks, and file hashes remain useful for months. Set indicator expiry inversely to volatility at ingestion time so stale blocks do not accumulate.

Pyramid of Pain

A model ranking indicator types by how much cost they impose on an adversary. Hashes and IPs are trivially changed, while tactics, techniques, and procedures are costly to alter, so behavioral detections outlast atomic blocklists.

STIX and TAXII

STIX 2.x is a data model expressing indicators, observables, malware, and their relationships as objects. TAXII 2.1 is the transport protocol for sharing those collections between platforms and trusted communities.

Indicator false-positive controls

Normalize and deduplicate indicators, exclude known-good infrastructure such as cloud providers, content delivery networks, and your own address ranges, and require a confidence threshold before any automated blocking action is taken.

Newly registered domain risk

Domains registered within roughly the last thirty days carry elevated risk because they are cheap to create for phishing and command-and-control. WHOIS creation age is a fast enrichment signal for suspicious domains.

ATT&CK tactic versus technique

Tactics describe adversary goals, such as Persistence or Credential Access. Techniques describe how the goal is achieved, such as T1053 Scheduled Task or T1003 OS Credential Dumping, with sub-techniques adding specificity.

T1562 Impair Defenses

A defense evasion technique covering actions that disable or weaken security controls, such as turning off logging, stopping antivirus, or modifying firewall rules. Detecting control tampering is itself a high-value detection.

T1003 OS Credential Dumping

A credential access technique extracting secrets from operating system memory or databases, including LSASS memory, SAM, and NTDS.dit. Detection focuses on suspicious process access to LSASS and dump utility execution.

Kerberoasting technique

T1558.003 requests service tickets for accounts with service principal names, then cracks the encrypted ticket offline to recover the service account password. Weak service account passwords and RC4 ticket encryption are key risk factors.

ATT&CK coverage mapping

Tag each detection rule with the techniques it covers, then aggregate coverage per tactic. Tactics with no mapped rules, often Discovery and Collection, reveal detection blind spots that should drive new rule development.

NIST incident response phases

Preparation, Detection and Analysis, Containment Eradication and Recovery, and Post-Incident Activity. Each phase has defined entry and exit criteria, an accountable owner, and documentation that feeds the final incident report.

Escalation triggers

Confirmed malware on a server, credential dumping, ransomware indicators, privileged account compromise, or evidence of data exfiltration. These bypass the tier-one queue and page the on-call responder directly.

Chain of custody

A documented record of who collected, accessed, and transferred each piece of evidence and when. Hash disk and memory images at acquisition so integrity can be proven later during investigation or legal proceedings.

Attack surface reduction rules

Windows Defender policy controls that block common attack behaviors, such as Office applications creating child processes, script execution from email, and credential theft tooling. They mitigate technique classes rather than specific hashes.

Detection-as-code pipeline

Rules live in version control with peer review, unit tests using sample events, continuous integration syntax validation, staged rollout, and rollback. Each rule carries an owner and a written statement of intent.