HTB CDSA key terms

A structured sequence of phases used to handle a security incident, typically preparation, identification, containment, eradication, recovery, and lessons learned. Each phase produces evidence and decisions that later phases depend on.

The phase in which an analyst limits the spread of an intrusion, for example by isolating a host, disabling an account, or blocking a malicious IP. Containment choices balance stopping damage against preserving evidence.

Removing the root cause of an intrusion, such as deleting malware, closing the exploited vulnerability, or resetting compromised credentials. It follows containment so the attacker cannot simply re-establish access.

A testable statement about attacker behavior that guides proactive searching through telemetry, for example that a specific tool is being used in the environment. A good hypothesis names the data source and the observable evidence.

Rapidly assessing alerts or incidents to rank severity and decide which need immediate investigation. Triage uses context such as asset criticality, user role, and whether the activity is expected.

A knowledge base of adversary tactics and techniques observed in real intrusions, organized by platform. Analysts use it to map detections, prioritize coverage gaps, and describe attacker behavior consistently in reports.

Logic that matches telemetry patterns and raises an alert, such as a SIEM correlation search or an EDR behavioral rule. Good rules specify the data source, the condition, and the expected false-positive sources.

An alert triggered by benign activity that resembles malicious behavior, such as a legitimate administrator running a scripting tool. Distinguishing it from a true positive requires context about the asset and user.

A SIEM search that combines multiple events across time or sources to detect a pattern, such as many failed logons followed by a success. Correlation reduces noise compared with single-event alerts.

A vendor-neutral, YAML-based format for describing log-based detections. Rules can be converted to queries for different SIEM platforms, making detections portable across environments.

Security Information and Event Management: a platform that centralizes logs from many sources, normalizes fields, and supports searching, correlation, and alerting. It is the primary workspace for log-driven investigation.

The process of collecting and transporting log data from endpoints, servers, network devices, and cloud services into a central platform. Missing or delayed ingestion creates blind spots that undermine detection.

Mapping raw log fields from different products into a common schema so they can be searched and correlated consistently. For example, mapping multiple vendors' user fields to a single account-name field.

A mismatch between timestamps on different systems, often caused by unsynchronized clocks or time zones. It can break correlation and misorder events, so analysts verify time sources during investigations.

A recorded picture of normal activity for a system, user, or network, used to spot deviations. Baselines can be statistical, such as typical login hours, or behavioral, such as usual process trees.

Identifying activity that deviates from an established baseline, such as an unusual volume of outbound traffic or logons at odd hours. It surfaces unknown threats but requires context to separate benign change from attack.

A file recording raw network traffic, including headers and often payloads, captured on an interface. Analysts use it to reconstruct sessions, extract transferred files, and confirm what actually crossed the wire.

Summarized connection records showing source, destination, ports, byte counts, and timing without payload. Flows are efficient for spotting scanning, beaconing, and large data transfers across long time windows.

Regular, repeated outbound connections from an infected host to attacker infrastructure, often with consistent intervals or jitter. Periodic timing to an uncommon destination is a strong command-and-control indicator.

The channel attackers use to send instructions to compromised hosts and receive results. It may use HTTP, DNS, or custom protocols, and detecting it often depends on traffic patterns rather than signatures.

Encoding data inside DNS queries and responses to bypass network controls or exfiltrate information. Indicators include unusually long or high-entropy subdomains and high query volume to one domain.

A hash derived from the fields of a TLS client or server handshake, used to identify client applications independent of IP address. It helps spot malware using TLS libraries that differ from normal browsers.

Examining packet payloads, not just headers, to identify protocols, files, or malicious content. It enables file extraction and protocol misuse detection but is limited by encryption.

A profile of normal traffic patterns, such as typical protocols, peer-to-peer flows, and data volumes per host. Deviations like new external connections or unusual ports guide investigation.

Endpoint Detection and Response: agent software that records process, file, network, and registry activity on hosts and supports remote response actions. Its telemetry is central to reconstructing attacker behavior on endpoints.

The parent-child relationships among running processes, showing which program launched which. Anomalies such as a word processor spawning a command shell reveal malicious execution chains.

Legitimate built-in operating system binaries, such as PowerShell or certutil, abused by attackers to download, execute, or evade detection. Their presence is normal, so context and arguments matter.

A response action that cuts an endpoint off from the network while keeping the agent connected for investigation. It stops lateral movement and exfiltration while preserving volatile evidence.

Techniques attackers use to keep access across reboots or credential changes, such as scheduled tasks, services, or registry run keys. Finding persistence mechanisms is key to full eradication.

A Windows utility that lists programs configured to start automatically, including logon entries, services, and scheduled tasks. Analysts use it to spot suspicious persistence that may be hidden from casual inspection.

A documented record of who handled evidence, when, and how, from collection through storage and analysis. Gaps or undocumented transfers weaken evidence integrity and can invalidate findings in legal or disciplinary proceedings.

The principle of collecting the most perishable evidence first, such as memory and network connections, before disk data. Following it prevents loss of artifacts that disappear on shutdown or reboot.

Analyzing a captured RAM image to recover running processes, network connections, loaded modules, and injected code. It reveals activity that never touches disk, such as fileless malware.

A bit-for-bit copy of a storage device or partition, often with a hash recorded at acquisition. Analysis is performed on the copy so the original remains unaltered as evidence.

The assurance that collected data has not been altered, typically demonstrated with cryptographic hashes taken at acquisition and rechecked later. It underpins the credibility of every forensic conclusion.

A technique where malware writes code into another running process and executes it there, often to hide or inherit trust. Memory analysis and unusual cross-process memory regions help detect it.

An attack that requests service tickets for accounts with service principal names and cracks them offline to recover passwords. Detection focuses on unusual ticket requests and weak service account passwords.

An Active Directory attribute that binds a service instance to an account so clients can locate it. Accounts with SPNs are Kerberoasting targets because tickets encrypted with their keys can be requested.

A Windows security event logged when a Kerberos service ticket is requested. Unusual volumes, encryption downgrades, or requests from unexpected hosts can indicate Kerberoasting.

Extracting password hashes or plaintext credentials from memory or registry hives, for example with LSASS access. Detection looks for suspicious access to LSASS and known dumping tool behavior.

The Windows Local Security Authority Subsystem Service process that handles authentication and holds credential material in memory. Unexpected processes reading its memory are a strong credential-theft indicator.

Authenticating with a stolen password hash instead of the plaintext password, allowing lateral movement without cracking it. Detection relies on anomalous logon types and source hosts for the affected account.

Techniques attackers use to move from one compromised host to others, such as remote services or stolen credentials. Correlating authentication events across hosts exposes the path taken.

A post-incident document analyzing what happened, what worked, and what should change in process, tooling, or training. It converts incident findings into concrete improvements and is often requested by stakeholders.

A short, non-technical opening section of a report stating impact, scope, and recommended actions for decision-makers. It avoids jargon and focuses on business risk rather than raw indicators.

Observable artifacts such as file hashes, domains, IP addresses, or registry keys associated with an intrusion. Reports list them with context so defenders can search for the same activity.