HTB CDSA cheat sheet

Incident response lifecycle per NIST SP 800-61: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity.

Severity triage inputs: data sensitivity, blast radius (hosts/accounts affected), attacker dwell time, and whether persistence or lateral movement is confirmed.

Order of volatility for collection: CPU registers/cache, RAM, network state, running processes, disk, remote logs, archival backups.

Hunting hypothesis structure: threat actor TTP (from ATT&CK) + observable data source + expected artifact; a hunt without a data source is not executable.

Containment decision rule: network isolation before credential reset when active C2 is suspected; credential reset first when only credential misuse is observed.

Dwell time = first malicious artifact timestamp to detection timestamp; measured from earliest reliable log, not from alert time.

Eradication is verified by absence of the persistence mechanism across all scoped hosts, not by absence of the original alert.

Lessons-learned output must map each finding to a detection gap (missing log source, missing rule, or missing telemetry field).

Windows Security event IDs: 4624 logon, 4625 failed logon, 4634/4647 logoff, 4648 explicit credentials, 4672 special privileges, 4688 process creation, 4720 account created, 4768/4769/4771 Kerberos TGT/TGS/preauth failure.

Logon type codes: 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 new credentials, 10 RDP, 11 cached interactive.

Sysmon IDs: 1 process create, 3 network connect, 7 image load, 8 CreateRemoteThread, 10 process access, 11 file create, 12/13/14 registry, 22 DNS query, 25 process tampering.

Correlation rule anatomy: aggregation key (user, host, source IP), threshold, time window, and suppression to prevent alert storms.

EPSS gives probability of exploitation in 30 days; CVSS base score measures severity, not likelihood; prioritization uses both plus asset criticality.

Clock skew breaks correlation: normalize all sources to UTC and alert when a source deviates beyond an agreed tolerance.

Sigma rules are vendor-neutral detections compiled to SIEM query languages; the logsource block (product, service, category) determines applicability.

Absence-of-event detections (e.g., no 4688 from a host for 24h) often indicate agent tampering rather than a quiet endpoint.

TCP flag interpretation: SYN only = connection attempt; SYN/ACK = open port; RST = closed or filtered; FIN/PSH/URG combination is used by nmap NULL/FIN/XMAS scans.

Beaconing detection: low variance in connection intervals to a single destination, consistent payload size, and periodic jitter are stronger signals than destination reputation.

DNS tunneling indicators: high volume of TXT/NULL queries, long encoded subdomain labels, high entropy in query names, and one authoritative domain receiving all queries.

Suricata/Snort rule anatomy: action, protocol, source/destination, direction operator (-> or <>), rule options in parentheses, sid and rev for versioning.

PCAP triage order: protocol hierarchy statistics, conversations sorted by bytes, then follow-stream on anomalous flows.

JA3/JA3S fingerprints hash TLS client/server hello parameters; a known-malware JA3 is a durable detection even when domains rotate.

SMB lateral movement indicators: 445/tcp sessions from workstations to workstations, ADMIN$ or IPC$ access, and service creation via SVCCTL.

IDS evasion: fragmentation overlap, TCP segmentation, and protocol ambiguity require stream reassembly enabled on the sensor to be detected.

Process tree anomaly rules: Office or browser spawning cmd/powershell/wscript; lsass access by non-security processes; svchost with a non-system parent.

Command-line hunting strings: -enc/-EncodedCommand, -nop, -w hidden, IEX, DownloadString, FromBase64String, certutil -urlcache, bitsadmin /transfer.

LSASS access detection: Sysmon Event ID 10 with GrantedAccess 0x1010 or 0x1410 and a calling process outside known security tooling.

Persistence locations to check: Run/RunOnce keys, services, scheduled tasks, WMI event subscriptions, startup folders, and logon scripts.

Parent PID reuse and orphaned processes: a process whose parent no longer exists may indicate injection or a terminated loader.

Memory analysis order: process list, network connections, injected memory regions (RWX), loaded modules, then strings and YARA scans.

Living-off-the-land binaries (LOLBins): certutil, regsvr32, mshta, rundll32, wmic, and installutil are signed and abused for download or execution.

EDR isolation blocks network but preserves agent channel; it does not stop local process execution, so memory capture should precede or accompany it.

NTFS artifacts: $MFT (file records), $UsnJrnl:$J (change journal), $LogFile (metadata transactions), $Secure, and alternate data streams.

Windows timestamps: $STANDARD_INFORMATION can be modified by timestomping; $FILE_NAME timestamps in the MFT are harder to alter and are compared for discrepancy.

Registry hives: SYSTEM (services, timezone), SOFTWARE (installed apps, run keys), SAM (local accounts), SECURITY (cached credentials), NTUSER.DAT (per-user activity).

Prefetch shows execution count and last run; Amcache and ShimCache indicate presence/execution; BAM/DAM records background activity per user SID.

Static malware analysis order: hashes, strings, PE headers and sections, imports, entropy per section, then YARA matching.

High section entropy plus a small import table suggests packing; unpack by running in an instrumented sandbox and dumping memory.

Chain of custody requires hash of the image at acquisition, documented handler, and hash verification at each transfer.

Anti-forensics indicators: event log clearing (1102), USN journal deletion, timestomping, and secure-deletion tools leaving sparse MFT records.

Kerberoasting: 4769 with RC4 encryption type (0x17) for service accounts, often high volume from one source; defense is AES-only and long service-account passwords.

AS-REP roasting: 4768 with pre-authentication disabled (0x0) returned for accounts lacking 'Do not require Kerberos preauthentication'.

DCSync: replication rights abuse detected via 4662 with GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 (DS-Replication-Get-Changes) from a non-DC principal.

Golden ticket: forged TGT with abnormal ticket lifetime and a domain SID from a krbtgt hash; validate with 4769 anomalies and krbtgt double-reset.

Pass-the-hash indicators: 4624 type 3 with NTLM authentication, no preceding 4648, and mismatched workstation name versus source IP.

Domain controller audit policy must enable 'Audit Directory Service Access' for 4662 and 'Audit Kerberos Authentication Service' for 4768/4769.

BloodHound-style attack paths rely on ACL edges (GenericAll, WriteDACL, ForceChangePassword); monitor 5136 directory changes for ACL modification.

GPO abuse: modification of SYSVOL scripts or new scheduled tasks pushed domain-wide appears as 5136 on groupPolicyContainer objects and 4688 on many hosts.

Executive summary states business impact, current status, and decisions needed in the first paragraph; technical detail follows in appendices.

Findings must be reproducible: include the query, log source, time range, and host or account identifiers for every claim.

Timeline entries require a timestamp, source system, actor, action, and confidence level; unverified entries are labeled as hypotheses.

IOC table columns: type, value, first seen, last seen, confidence, and recommended action (block, hunt, monitor).

Severity language aligns to a defined scale (e.g., Critical/High/Medium/Low) with explicit criteria so readers cannot reinterpret labels.

ATT&CK mapping in reports shows technique ID, observed evidence, and detection coverage status, enabling gap analysis.

Recommendations are prioritized by risk reduction per effort and assigned an owner and due date, otherwise they are not actionable.

Regulatory and contractual notification triggers (e.g., personal data exposure) are decided with legal, and the decision is documented with rationale.