HTB CDSA study plan
HTB CDSA · Give each week a clear focus.
8 weeks · About 7 hours per week
Incident Response and Threat Hunting & Security Information and Event Management (SIEM) and Log Analysis
Build a personal incident-response playbook skeleton covering identification, containment, eradication, recovery, and lessons learned, with the specific evidence sources you would pull at each step
Map each SIEM data source you can access (Windows Event Logs, Sysmon, Linux auditd, firewall, proxy, DNS, EDR telemetry) to the questions it can answer during triage
Practice writing five hypothesis-driven hunt questions (for example: which hosts spawned an Office process that launched PowerShell?) and translate each into the exact log fields and query logic needed
Set up a lab SIEM with at least one Windows and one Linux log forwarder and confirm events arrive with correct timestamps and normalization
Your checkpoint
A written hunt-hypothesis document with five hypotheses, each paired with a working query and a screenshot-free description of the fields it relies on
Security Information and Event Management (SIEM) and Log Analysis
Write and tune detection queries against Windows Security event IDs for logon, privilege use, process creation, and service installation, documenting expected false positives
Parse and correlate Sysmon event categories (process creation, network connection, image load, registry, file create) into a single timeline for one simulated intrusion
Configure and validate at least three correlation rules that fire only when two or more related events occur within a defined window
Practice extracting indicators of compromise from raw log excerpts and enriching them with context such as asset criticality and user role
Your checkpoint
A detection rule pack of at least five queries with the rationale, expected false-positive sources, and a tested true-positive and true-negative case for each
Incident Response and Threat Hunting & Network Traffic Analysis and Intrusion Detection
Analyze packet captures to reconstruct a full TCP session, identify the client and server roles, and extract transferred files or credentials in cleartext
Identify common protocol abuse in traffic: DNS tunneling patterns, beaconing intervals, unusual TLS certificate attributes, and HTTP user-agent anomalies
Write IDS signatures for at least two behaviors observed in your lab traffic and verify they trigger on the malicious sample and stay quiet on benign traffic
Document an incident timeline from network evidence alone, noting where host or SIEM data would be required to close gaps
Your checkpoint
A network-focused incident writeup reconstructing one simulated intrusion from packet capture, including extracted indicators and the IDS rules that would have caught it
Endpoint Detection and Response (EDR) and Host-Based Analysis & Digital Forensics and Malware Analysis
Triage a suspicious endpoint using EDR-style telemetry: process trees, parent-child anomalies, command-line arguments, persistence locations, and network connections
Collect and preserve volatile and non-volatile host artifacts in a defensible order, documenting hash and chain-of-custody handling for each item
Perform static triage of a malware sample: file type identification, hashing, string and import analysis, packer indicators, and embedded configuration extraction where feasible
Correlate host artifacts with SIEM and network evidence to confirm or refute an initial access hypothesis
Your checkpoint
An endpoint triage report combining EDR timeline, collected artifacts with hashes, and a static malware summary that states what the sample does and how it persists
Digital Forensics and Malware Analysis & Active Directory and Windows Security Monitoring
Analyze Active Directory authentication events to distinguish normal logon patterns from pass-the-hash, kerberoasting, and password-spray indicators
Review domain controller and directory service logs for privilege escalation, group membership changes, and replication or DCSync-style activity
Examine filesystem and registry artifacts for execution evidence, including prefetch, shimcache, amcache, and userassist equivalents available in your lab
Build a forensic timeline that merges host, directory, and network events into one normalized view with consistent timezone handling
Your checkpoint
A merged forensic timeline of one simulated intrusion spanning at least three evidence sources, with an annotated explanation of each pivot point
Network Traffic Analysis and Intrusion Detection & Endpoint Detection and Response (EDR) and Host-Based Analysis
Run a full-scope hunt from a single starting indicator, pivoting across network, host, and identity telemetry until you exhaust the evidence
Simulate at least two attacker techniques in your lab and confirm which of your week 2 and week 3 detections fire and which miss
Tune or rewrite the detections that missed, documenting the blind spot each one covered
Assess coverage gaps against a technique matrix and prioritize the three most valuable new data sources to add
Your checkpoint
A detection coverage assessment listing tested techniques, pass/fail results, rewritten rules, and three prioritized data-source recommendations
Incident Response and Threat Hunting & Reporting and Communication
Write a full incident report for one of your simulated cases using a structure of summary, timeline, technical findings, impact, containment actions, and recommendations
Produce an executive summary of the same incident in under 250 words that states business impact without jargon or unexplained acronyms
Draft containment and remediation recommendations that are specific, prioritized, and tied to evidence rather than generic best practice
Practice a verbal briefing of the incident to a non-technical stakeholder and record the three questions you could not answer confidently
Your checkpoint
A complete incident report package containing the technical report, a one-page executive summary, and a prioritized remediation list
Incident Response and Threat Hunting & Security Information and Event Management (SIEM) and Log Analysis & Network Traffic Analysis and Intrusion Detection & Endpoint Detection and Response (EDR) and Host-Based Analysis & Digital Forensics and Malware Analysis & Active Directory and Windows Security Monitoring & Reporting and Communication
Complete a timed end-to-end capstone: detect, triage, contain, and report a multi-stage simulated intrusion within a fixed time budget
Revisit every missed detection and weak timeline from weeks 1 through 7 and close at least five specific gaps
Rewrite your incident-response playbook using lessons from the capstone so each step names the exact evidence source and decision criteria
Produce a personal weak-area list with a concrete practice task for each item to carry past the exam
Your checkpoint
A capstone incident report plus a revised playbook and a written weak-area remediation plan with at least five actionable items
Milestones
Week 2: You can take an unfamiliar Windows event log excerpt and explain, event by event, what happened and which events are benign
Week 4: You can reconstruct a simulated intrusion end to end from packet capture and host telemetry without consulting notes, and state which single evidence source you would drop last
Week 6: At least 70 percent of the techniques you simulated in your lab were caught by rules you wrote yourself, and every miss has a documented cause
Week 8: You completed the timed capstone within budget and your executive summary was understood by a non-technical reader without follow-up questions