> For the complete documentation index, see [llms.txt](https://karim-ashraf.gitbook.io/karim_ashraf_space/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/lets-defend/incident-responder-path/cybersecurity-incident-handling-guide/detection-and-analysis.md).

# Detection and Analysis

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fl4S5r4vHDBMgGCY0Ib86%2Fimage.png?alt=media&amp;token=1fe72542-be89-41f8-80e2-f74988579ee8" alt=""><figcaption></figcaption></figure>

## **Incident Responder Profile**

Proficient **Incident Responder** with expertise in **detection, verification, and prioritization** of cybersecurity incidents. Skilled in **root cause analysis**, incident management, and response coordination, adhering to **NIST guidelines**. Adept at maintaining efficient communication, documentation, and leveraging issue tracking systems to streamline incident response processes. Committed to improving security posture through continuous monitoring and proactive incident handling.

***

## **Core Competencies**

### **1. Detection**

* **Key Understanding**: Detection is the first critical step in the incident response lifecycle.
* **Sources**:
  * **SIEM Alerts**: Analyze correlation rules and event aggregation.
  * **Security Product Notifications**: Monitor AV, EDR, and other security tools.
  * **Internal/External Reports**: Leverage inputs from IT teams and external partners.
* **Best Practices**:
  * Use multiple detection sources to minimize blind spots.
  * Log every detection event for future reference and cross-checking.

### **2. Verification**

* **Objective**: Confirm whether the detected event constitutes a true cybersecurity incident.
* **Approach**:
  * **Preliminary Investigation**:
    * Analyze the **source** of detection.
    * Cross-reference system and network logs (e.g., **Sysmon**, **firewall logs**).
  * **Key Techniques**:
    * Identify suspicious **file extensions** or unexpected system behaviors.
    * Use historical data to check for anomalies.
  * **Documentation**:
    * Update the **issue tracking system** with:
      * Current incident status.
      * Summary and supporting indicators.
      * Chain of custody for collected evidence.
* **Best Practices**:
  * Avoid premature actions (e.g., isolation or shutdown) without incident verification to prevent unnecessary service disruptions.

### **3. Prioritization**

* **Purpose**: Ensure incidents are handled based on risk, not arrival order.
* **Key Factors**:
  * **Severity**: Immediate impact on confidentiality, integrity, and availability.
  * **Criticality**: Importance of the affected systems (e.g., financial or healthcare systems).
  * **Potential Damages**: Long-term implications, such as data loss or reputation damage.
* **Methodology**:
  * Use **NIST categorization** to classify incidents:
    * Functional impact.
    * Information impact.
    * Recoverability.
  * Assign priority levels:
    * **High**: Immediate response required.
    * **Medium**: Needs attention within a defined window.
    * **Low**: Monitor and escalate if necessary.

### **4. Notification**

* **Key Goal**: Notify the right stakeholders promptly to minimize response delays.
* **Process**:
  * Use a pre-established **contact list**:
    * Internal: Security, IT, legal, and management.
    * External: Regulators, law enforcement, and third-party vendors.
  * **Documentation**:
    * Record:
      * Who was notified.
      * When and how communication occurred.
  * **Communication Channels**:
    * Ensure secure communication using **encrypted email** or **dedicated lines**.

### **5. Analysis**

* **Purpose**: Understand the full scope of the attack.
* **Key Activities**:
  * **Timeline Reconstruction**:
    * Track the attack from **initial access** to **latest actions**.
    * Analyze attacker behavior across **MITRE ATT\&CK stages**.
  * **Root Cause Analysis**:
    * Identify vulnerabilities exploited by the attacker.
    * Examples:
      * Exploiting a **web application flaw**.
      * Phishing campaigns leading to **credential theft**.
  * **Containment, Eradication, & Recovery**:
    * Implement containment strategies immediately after root cause identification.
    * Ensure eradication of all traces, such as **malware** or **unauthorized accounts**.
    * Restore systems from known **clean backups**.

### **6. Continuous Detection & Analysis Cycle**

* **Key Concept**: Incident response is an iterative process.
* **Cycle**:
  * **Continuous Monitoring**: Maintain vigilance for secondary or related incidents.
  * **Dynamic Response**:
    * Adjust strategies based on new threat intelligence.
    * Keep detection rules updated to handle emerging threats.
* **Isolation Protocols**:
  * Swiftly isolate compromised devices or accounts.
  * Regularly verify the integrity of recovered systems.

***

## **Key Tools & Techniques**

* **Process Hacker**: Analyze processes, detect malicious activity, and inspect parent-child relationships.
* **Autoruns**: Identify persistence mechanisms in startup items and services.
* **FullEventLogView**: Comprehensive event log analysis.
* **LastActivityView**: Track user activity to detect anomalous behavior.
* **BrowsingHistoryView**: Analyze web browsing activity for indicators of compromise.
* **Sysmon Logs**: Deep dive into system events for anomaly detection.

***

## **Incident Management Best Practices**

* **Streamlined Documentation**:
  * Maintain thorough incident documentation in real time.
  * Standardize report templates for consistent post-incident analysis.
* **Cross-Functional Collaboration**:
  * Work closely with IT, legal, and other departments.
  * Foster open communication for faster response escalation.
* **Continuous Improvement**:
  * Learn from each incident.
  * Update **playbooks**, **protocols**, and **training** to strengthen response capabilities.

By leveraging these skills and processes, this **Incident Responder** ensures rapid detection, thorough verification, and efficient prioritization of cybersecurity incidents, fostering a secure and resilient environment.