Threat Detection and Incident Response
What this domain tests
Threat Detection and Incident Response tests the detect-respond-learn cycle: indicators, SIEM and EDR correlation, triage, containment, eradication, recovery, evidence handling, and lessons learned. Expect kill-chain and MITRE ATT&CK mapping questions and decisions about what to do first.
Core rules
- Detection needs telemetry: endpoint, identity, network, and cloud logs, time-synchronized and retained.
- Triage confirms scope and impact before containment; preserve volatile evidence before shutdown when feasible.
- Containment isolates affected hosts and accounts without destroying evidence; eradication removes the cause; recovery restores from trusted state; lessons learned updates detections.
- Maintain chain of custody: document who collected what, when, where, and hash evidence.
Worked example
An EDR alert shows WINWORD.EXE spawning PowerShell with an encoded command, followed by outbound TLS to a new domain. Treat it as a suspected intrusion: isolate the host via EDR, preserve memory and relevant logs, disable the user sessions, scope other hosts with the same command line or domain, block the domain and hash at egress, reset credentials, and only then remediate. Reasoning: isolation limits spread; memory may hold injected code; scoping prevents premature closure; blocking indicators buys time but is not eradication.
Traps
Rebooting or wiping before collecting evidence; containing before confirming scope can alert the adversary; closing on a single alert without checking lateral movement; and confusing an indicator of compromise with a vulnerability.