Incident Response and Threat Hunting
Incident Response and Threat Hunting
This domain tests the response lifecycle, evidence integrity, and hypothesis-driven hunting. The strongest discriminator on the exam is ordering: what you do first determines whether you can still investigate afterward.
The response lifecycle
The phases are Preparation; Identification and Analysis; Containment; Eradication; Recovery; and Lessons Learned. Containment precedes eradication - stop the spread before you clean anything. Lessons Learned must produce specific, owned changes (new detection, patched gap, revised playbook), not a narrative of blame. Playbooks make the sequence repeatable under pressure, and tabletop exercises expose decision gaps before a real event.
Evidence handling
Order of volatility runs roughly: CPU registers and cache → memory → network connections and temporary files → disk → remote logs → backups and archival media. Capture memory before powering a host off. Image disks with a write blocker, hash at acquisition (SHA-256), and re-verify the hash later. Chain of custody records who handled what, when, and why. Forensic images are working copies; the original is preserved.
Threat hunting
Hunting is hypothesis-driven, not alert-driven. Start from an ATT&CK technique or a sector-relevant threat report, define the telemetry required, query across it, then convert confirmed findings into a durable detection rule. IOC sweeps are fast but brittle, because attackers rotate indicators; TTP-based hunts survive rotation. Purple teaming validates that a detection actually fires on the behavior it claims to catch.
Worked example
"A ransomware note is found on a file server." Use EDR network containment to isolate the host while leaving memory intact, disable the compromised account, and acquire a memory image. Then hunt for the initial access vector and other encrypted hosts using file-extension rename telemetry and shadow-copy deletion events. Do not reimage before imaging, and do not begin restore before the scope is known - restoring into an active foothold re-infects the estate.
Traps
Pulling the power cord destroys volatile evidence and the timeline. Containment that wipes the host destroys the investigation. An incident is declared on impact and confidence, not on raw alert severity. Skipping Lessons Learned leaves the same gap open for the next event.