HTB CDSA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Order of volatility

Collection priority ranking evidence by how quickly it changes or disappears: CPU and cache, RAM, network state, running processes, disk, remote logs, backups.

Dwell time

Elapsed time between the earliest reliable evidence of attacker presence and detection or containment. Measured from artifacts, not from when an alert fired.

Threat hunting hypothesis

A testable statement combining an adversary technique, a required data source, and the expected artifact. Without an available data source the hunt cannot be executed.

Containment decision rule

If active command-and-control traffic is confirmed, isolate the host before resetting credentials. If only credential misuse is seen, reset credentials first.

Windows event 4624

Successful logon. The Logon Type field distinguishes interactive (2), network (3), service (5), new credentials (9), and RDP (10) access.

Windows event 4688

Process creation recorded by the Security audit policy. Command-line inclusion requires the process creation command-line audit setting to be enabled.

Logon type 3

Network logon, typical of SMB access and lateral movement. Paired with NTLM and no preceding 4648, it suggests pass-the-hash.

Sysmon Event ID 10

ProcessAccess. Records one process opening another; GrantedAccess 0x1010 or 0x1410 against lsass.exe indicates credential dumping attempts.

Sigma rule logsource

The block declaring product, service, or category that determines which log sources a vendor-neutral detection applies to during conversion to a SIEM query.

EPSS versus CVSS

EPSS estimates the probability a vulnerability is exploited in the next 30 days. CVSS measures severity. Prioritization combines both with asset criticality.

Beaconing detection

Identifying periodic outbound connections by low variance in interval, consistent payload size, and jitter. More reliable than destination reputation alone.

DNS tunneling indicators

Long encoded subdomain labels, high query volume of TXT or NULL records, high name entropy, and a single authoritative domain receiving all queries.

JA3 fingerprint

A hash of TLS client hello parameters (version, ciphers, extensions, curves). Remains a durable detection when malware rotates domains and IPs.

TCP RST meaning

A reset flag indicates a closed or filtered port, or an abruptly terminated connection. A SYN/ACK instead proves the port is open.

IDS stream reassembly

Reconstructing TCP sessions before matching rules. Required to detect evasion via fragmentation overlap, segmentation, and protocol ambiguity.

LOLBins

Signed system binaries such as certutil, regsvr32, mshta, and rundll32 abused for download, execution, or proxy execution while appearing legitimate.

Suspicious parent-child process

Anomalous lineage such as Office or a browser spawning cmd, powershell, or wscript, or svchost.exe running under a non-system parent process.

WMI event subscription persistence

A durable, fileless persistence mechanism stored in the WMI repository. Detected by examining permanent event consumers, filters, and bindings.

EDR network isolation limit

Isolation blocks network traffic but does not stop local process execution. Capture memory before or alongside isolation to preserve volatile evidence.

$MFT

The NTFS Master File Table, one record per file. Holds $STANDARD_INFORMATION and $FILE_NAME timestamps, useful for detecting timestomping discrepancies.

$UsnJrnl:$J

The NTFS change journal recording file creations, deletions, and renames. Frequently targeted for deletion by anti-forensic tooling.

Timestomping detection

Comparing $STANDARD_INFORMATION timestamps, which user-mode tools can alter, against $FILE_NAME timestamps in the MFT, which are harder to modify.

Prefetch artifact

A Windows file recording execution count and last run time for an application, supporting proof that a binary actually ran on the host.

Packed malware indicator

High per-section entropy combined with a small import table. Unpack by executing in an instrumented sandbox and dumping the process memory.

Event ID 1102

The Security log was cleared. A strong anti-forensic indicator; correlate with 104 for other logs and with account context of the clearing user.

Kerberoasting indicator

Event 4769 requesting a service ticket with RC4 encryption type 0x17, often in volume from one source, enabling offline password cracking.

AS-REP roasting

Event 4768 for an account with Kerberos pre-authentication disabled, returning an encrypted blob crackable offline without any prior authentication.

DCSync detection

Event 4662 showing replication GUIDs such as DS-Replication-Get-Changes requested by a principal that is not a domain controller.

Golden ticket

A forged Kerberos TGT created with the krbtgt hash. Detected through abnormal ticket lifetimes and remediated by double-resetting krbtgt.

Pass-the-hash indicator

Logon type 3 with NTLM authentication, no preceding 4648 explicit-credential event, and a workstation name inconsistent with the source IP address.

Reproducible finding

A report claim accompanied by the exact query, log source, time range, and host or account identifiers so another analyst can independently verify it.

IOC table fields

Type, value, first seen, last seen, confidence, and recommended action. Enables consistent blocking, hunting, or monitoring decisions by consumers.