Revision sheet: Fundamentals of Cyber Incident Handling

📋 Course Outline

1. Incident Handling Definition and Scope
2. Incident Handling Value and Goals
3. Cyber Kill Chain Stages
4. Incident Response Lifecycle
5. Preparation and Readiness
6. Protective Controls and Hardening
7. Detection and Initial Analysis
8. Incident Timeline and Triage
9. Investigation and IOC Usage

📖 1. Incident Handling Definition and Scope

🔑 Key Concepts & Definitions

• Event : An event is an action occurring in a system or network.
• Security incident : A security incident is an event that has negative consequences.
• IT security incident : An IT security incident is an event with a clear intent to cause harm performed against a computer system.
• Incident handling : Incident handling is a clearly defined set of procedures used to manage and respond to security incidents in a computer or network environment.
• Incident handling plan : An incident handling plan is a comprehensive plan that covers multiple incident types and the steps to identify, contain, eradicate, and recover.

📝 Essential Points

• Incidents can stem from more than attacks, including malicious insiders, availability issues, and loss of intellectual property.
• An organization may run incident handling in-house or use third-party providers either continuously or when needed.
• It may not be obvious at first whether an event is an incident until an initial investigation is performed.
• Suspicious events should be treated as incidents unless proven otherwise.
• Incident handling aims to restore normal business operations as quickly and efficiently as possible.

💡 Memory Hook

Event = occurrence; Incident = occurrence with harmful intent/consequences; Incident handling = procedures to identify→contain→eradicate→recover.

📖 2. Incident Handling Value and Goals

🔑 Key Concepts & Definitions

• Incident response team : A specialized team that handles security events systematically to reduce information theft and service disruption during incidents.
• Incident manager : The incident handling leader who directs the response, can obtain employee cooperation, and provides single-point status communication.
• Prioritization of incidents : The practice of ranking incidents by severity so higher-impact events get immediate attention and resources.
• Investigations and remediation : The incident handling activities used to determine what happened and apply fixes to stop ongoing harm and restore operations.

📝 Essential Points

• Incident handling is necessary when an organization cannot afford loss of confidentiality, integrity, or availability due to security incidents.
• Some incidents only affect a few devices, while others can compromise large parts of the environment.
• Incident-handling decisions before, during, and after the event change its overall impact on the organization.
• The incident manager usually has the mandate to require timely actions from any employee if needed.
• A commonly used resource for incident handling guidance is NIST's Computer Security Incident Handling Guide.

💡 Memory Hook

Triage Drives Action: Severity first → immediate resources → investigation/remediation → faster impact reduction.

📖 3. Cyber Kill Chain Stages

🔑 Key Concepts & Definitions

• Reconnaissance stage : A preparatory stage where the attacker identifies targets, gathers information, and finds vulnerabilities to exploit.
• Weaponize stage : A stage where the attacker crafts malware and embeds it into an exploit or payload deliverable for initial access.
• Delivery stage : A stage where the exploit or payload is sent to victims, commonly via phishing links or attachments, or via web sites that host the payload.
• Exploitation stage : A stage where the delivered exploit or payload is triggered to run code and gain access or control.
• Command and control stage : A stage where the attacker establishes remote access to the compromised machine, often using modular stagers and additional tools.

📝 Essential Points

• Malware is developed in the weaponize stage to be lightweight and designed to evade antivirus and detection tools.
• The delivery stage commonly uses phishing emails with malicious attachments or links, including web pages that host exploits or payloads.
• During exploitation, the attacker typically tries to execute code on the target system to gain access or control.
• After installation, command and control enables remote access and can load additional scripts on-the-fly, including malware variants to survive discovery.
• The chain is not strictly linear, and earlier stages can repeat, such as repeating reconnaissance after a successful installation.

💡 Memory Hook

W-R-D-E-C = Weaponize, Delivery, Exploit, Install/Execute, Command & Control.

📖 4. Incident Response Lifecycle

🔑 Key Concepts & Definitions

• Incident handling process : An incident-handling process is an organizational capability to prepare, detect, and respond to malicious events in a structured way.
• Preparation stage : The preparation stage builds incident-handling capability and equips the team to detect and respond when malicious activity occurs.
• Detection and analysis stage : The detection and analysis stage focuses on finding malicious events and gathering understanding to guide the next response actions.
• Investigating activity : Investigating is one of the core incident-handling activities that determines what happened using newly discovered evidence.
• Recovery activity : Recovery is one of the core incident-handling activities that uses a recovery plan to restore business operations after disruptions.

📝 Essential Points

• The incident handling process is cyclic rather than linear, and newly found evidence can change the next steps taken.
• Incident handlers spend most of their time in the first two stages, but resources must continuously support them to avoid disrupting preparation and detection.
• You should not skip steps in the process, because moving on after partially responding can notify an attacker and lead to unpredictable results.
• When an incident is fully handled, a report is issued that includes the cause and cost of the incident.
• After recovery, the business should resume normal operations if the incident caused any disruptions.

💡 Memory Hook

Lifecycle is a loop: evidence changes next steps, and the core path is Investigate → Recover (then report + lessons learned).

📖 5. Preparation and Readiness

🔑 Key Concepts & Definitions

• Incident documentation system : A set of records you keep so incident handling progress, evidence, and decisions are traceable during and after the investigation.
• Incident reporting capability : A prepared workflow that lets you report incidents effectively while the investigation is happening, not only after it ends.
• Jump bag : A pre-packed kit of ready-to-use forensic and investigative tools so the team can start immediately without waiting for approvals.
• Chain of custody forms : Evidence paperwork that records handling of collected materials so investigators can prove who accessed what and when.
• Secure facility for storage : A protected location used to store evidence and perform investigations safely without exposing data to unauthorized access.

📝 Essential Points

• During investigation notes, capture timestamps, the activity performed, its result, and who did it, to answer who what when where why and how.
• Documentation system must be independent from the organization’s infrastructure and properly secured, assuming the domain may be fully compromised and systems can become unavailable.
• Use communications channels outside the organization’s systems because adversaries may read email and other internal channels.
• User accounts with excessive privileges are enabled when an incident is confirmed and disabled once the incident is over, with a mandatory password reset when disabling.
• Prepare “jump bag” tools because collecting everything on the fly can take days or weeks before response is ready.
• When preserving disk images and logs, use forensic workstations and tools while disabling antivirus to allow malware testing in the investigation environment.

💡 Memory Hook

Calm notes (timestamps + actions + results) + grab-and-go tools (jump bag) + isolated comms/docs to beat chaos when everything is assumed compromised.

📖 6. Protective Controls and Hardening

🔑 Key Concepts & Definitions

• Endpoint hardening : Endpoint hardening is the protection of workstations and laptops as the most common entry points for everyday attacks.
• Network segmentation : Network segmentation is isolating business-critical systems so a breach cannot easily spread across the organization.
• SSL/TLS interception : SSL/TLS interception is decrypting traffic so IDS/IPS can identify malicious behavior from content on the wire rather than IP reputation.
• Attack Surface Reduction (ASR) rules : Attack Surface Reduction (ASR) rules are Microsoft Defender configurations that reduce exposure by blocking or limiting common attack behaviors.
• PowerShell ConstrainedLanguage mode : PowerShell ConstrainedLanguage mode is a restriction that limits PowerShell language features to reduce script-based attack capability.

📝 Essential Points

• Widely used endpoint hardening baselines include CIS and Microsoft baselines and they should serve as building blocks for your organization’s hardening.
• Business-critical systems should be isolated and internal resources should not face the Internet directly unless they are placed in a DMZ.
• IDS/IPS performance improves when SSL/TLS interception is used so detection relies on content on the wire instead of inefficient IP-based reputation.
• Application whitelisting should at least block execution from user-writable folders like Downloads, Desktop, AppData, and also block script types such as .hta, .vbs, .cmd, .bat, and .js.
• Disable or configure LLMNR/NetBIOS, use LAPS, remove admin privileges from regular users, and enable PowerShell in ConstrainedLanguage mode.
• For end-to-end endpoint protection, deploy an EDR product that integrates with AMSI so obfuscated scripts can be inspected before execution.

📖 7. Detection and Initial Analysis

🔑 Key Concepts & Definitions

• Detection & Analysis phase : The detection and analysis phase is the work of spotting incidents using sensors and logs while applying trained people, shared knowledge, and context-based threat intelligence.
• Initial Investigation : Initial investigation is the early fact-finding effort after an alert to collect enough context before assembling the full team or escalating to wider response.
• Incident Timeline : An incident timeline is a time-sorted record of event details that keeps the investigation organized and adds context for later-discovered evidence.
• Levels of Detection : Levels of detection are the logical network categories (perimeter, internal network, endpoint, and application) used to find and correlate compromise signals.
• Indicator of Compromise IOC : An indicator of compromise is a structured artifact that indicates compromise, such as IP addresses, file hashes, or filenames, and can be shared and searched in standard formats.

📝 Essential Points

• Detection can be sourced from the perimeter, internal network, endpoint, and application layers using components like IDS/IPS, firewalls, SIEM, and EDR, plus threat hunting and third-party notifications.
• Initial investigation decisions depend on context such as the affected system and the event time zone, because misinterpreting them can lead to wrong conclusions.
• An incident timeline time-sorts events by when they occurred even if evidence is uncovered in a different order during later investigation.
• IOC-related investigation follows a 3-step cycle: create and use IOCs, identify new leads and impacted systems, then collect and analyze data from those new leads.
• Incidents and investigation information should be shared on a need-to-know basis unless laws or management decisions permit broader disclosure, with appointed personnel handling external or internal communications.

💡 Memory Hook

Think “Context → Timeline → IOCs”: first interpret the alert, then time-order events for meaning, then use IOCs to branch into new leads.

📖 8. Incident Timeline and Triage

🔑 Key Concepts & Definitions

• Incident timeline table : An incident timeline table records when relevant attacker activities occurred, with associated context like hostnames and evidence sources.
• Detection discovery source : A detection discovery source is where the activity was first observed, and it must be recorded so the associated systems can be linked to the evidence.
• Impacted systems list : An impacted systems list is a compiled set of systems affected by the incident, used to scope extent and guide prioritization.
• Incident severity & extent questions : Incident severity and extent questions are targeted queries that estimate impact, sophistication signals, and the scale of response needed.

📝 Essential Points

• A timeline primarily focuses on attacker behavior so entries capture when the attack occurred, when connections were made, and when files were downloaded.
• For every timeline entry, record where the activity was detected or discovered and which systems are associated with that observation.
• Assemble a list of impacted systems and document who accessed them and what actions were taken to support scope and triage decisions.
• Mark whether the incident is ongoing or whether the suspicious activity has been stopped to set urgency and next steps.
• Triage uses questions on exploitation impact, exploitation requirements, affected business-critical systems, remediation suggestions, number of impacted systems, wild use, and worm-like capabilities to gauge severity and extent.

💡 Memory Hook

Timeline = when + where it was seen + which host; Triage = impact, requirements, scope, and wild/worm potential.

📖 9. Investigation and IOC Usage

🔑 Key Concepts & Definitions

• Indicators of Compromise : Indicators of Compromise are observable artifacts used to search for signs of malicious activity during an investigation.
• Yara : Yara is a standard language used to describe and apply detection rules for artifacts found in incidents.
• IOC Editor : IOC Editor is a tool used to create or modify IOC artifacts for later search and investigation use.
• WinRM : WinRM is a Windows connection protocol that avoids caching privileged credentials on remote systems after login.
• Chain of custody : Chain of custody is the documented control of collected evidence so the data remains court-admissible if legal action follows.

📝 Essential Points

• To leverage IOCs, investigators typically use an IOC-obtaining or IOC-searching tool, potentially at scale.
• In Windows environments, IOC-related operations are commonly performed with WMI or PowerShell.
• During IOC searching, avoid tools/protocols that cache privileged credentials on compromised systems after successful login, such as using WinRM.
• Windows logon type 3 Network Logon typically does not cache credentials on remote systems.
• PsExec with explicit credentials caches those credentials on the remote machine, but using PsExec without explicit credentials via the current user session does not cache them on the remote machine.
• Live response is common because shutting down a system can lose valuable artifacts stored only in RAM memory.

💡 Memory Hook

IOC hunt = “search, beware credentials, then preserve evidence”: choose WinRM-style logons so PsExec-style caching doesn’t leave extra tracks.

📊 Synthesis Tables

Cyber Kill Chain: delivery vs exploitation vs installation

Stage	Main action	Typical outcome
Delivery stage	Deliver exploit/payload (often phishing attachments/links or web-hosted payloads)	Victim receives payload/exploit trigger path
Exploitation stage	Trigger delivered exploit/payload; execute code	Gain access/control
Installation stage	Execute initial stager on compromised machine	Stager runs and supports attacker goals (incl. remote access/persistence)

⚠️ Common Pitfalls & Confusions

1. Believing incident handling covers only intrusions, while the scope also includes malicious insiders, availability issues, and loss of intellectual property.
2. Assuming an alert is an incident without initial investigation context; suspicious events should be treated as incidents only until proven otherwise.
3. Thinking the cyber kill chain is strictly linear; attackers can repeat earlier stages such as recon after successful installation.
4. Skipping steps in the incident handling process; partially containing and moving on can notify attackers and cause unpredictable outcomes.
5. Confusing short-term vs long-term containment; patching is not the “short-term” action type described, and long-term actions can include password changes, patches, and system shutdowns.
6. Misbuilding an incident timeline by ordering entries by when evidence was found instead of sorting by when the events occurred.
7. Using the wrong Windows remote execution method for IOC work; WinRM-style approaches are preferred to avoid cached privileged credentials, unlike PsExec with explicit credentials.

✅ Exam Checklist

1. Define the terms: event, security incident, IT security incident, incident handling, and incident handling plan (and what the plan must cover).
2. Explain why incident handling capability is needed, including the confidentiality/integrity/availability impact rationale and the role of prioritization.
3. List the cyber kill chain stages in order and state the key purpose of each stage (recon, weaponize, delivery, exploitation, installation, command & control, final objective).
4. Describe the incident handling process as cyclic (preparation, detection & analysis, investigating activity, recovery activity) and state why skipping steps is dangerous.
5. State what must be prepared for effective incident documentation and reporting during investigation (timestamps, activity, result, who; independent secured system; out-of-organization comms).
6. Identify the incident-handling readiness tools/resources that must be “grab and go” (e.g., jump bag, forensic workstations, chain of custody forms, secure evidence storage).
7. From the protective controls section, name at least three concrete measures (e.g., DMARC, endpoint hardening/EDR+AMSI, network segmentation/DMZ rules, disable LLMNR/NetBIOS, ConstrainedLanguage, ASR rules, app execution blocking).
8. From detection & initial analysis, explain initial investigation goals and what drives decisions (e.g., context like affected system and time zone).
9. Explain how to build and use an incident timeline (time-sorted, capture where discovered and associated systems) and what triage questions assess (impact, requirements, business-critical exposure, number impacted, wild/worm capabilities).
10. In investigation & IOC usage, state the IOC cycle (create/use IOCs; identify new leads/impacted systems; collect/analyze from those leads) and name the credential-caching warning about tools/protocols such as WinRM vs PsExec.
11. In containment/eradication/recovery, distinguish short-term vs long-term containment actions and describe what eradication and recovery each accomplish.
12. In post-incident activity, state what the final incident report must cover (what happened/when; team performance vs plans; improvements; containment/eradication actions; preventive measures) and that lessons learned/training occur.