Phase 09 - Incident Response, Forensics, Detection, and Malware Triage
Duration: 8 weeks (Months 19-20)
Objective: lead a defensible incident from detection through recovery while preserving evidence,
improving controls, and communicating uncertainty.
Deep guides: WARMUP.md unifies incident command, evidence, detection, timeline, response, and learning; HITCHHIKERS-GUIDE.md builds and tests the cross-source detection lab and investigation workflow.
Required Theory
- Preparation, detection, triage, scoping, containment, eradication, recovery, post-incident review, legal/privacy/HR interfaces, and executive cadence.
- Order of volatility, chain of custody, disk/memory/network/cloud/container evidence, timeline normalization, clock drift, and forensic uncertainty.
- Windows Event Logs/Sysmon, Linux audit/journal, macOS logs, cloud control/data logs, Kubernetes audit, endpoint telemetry, and identity-provider events.
- SIEM/data pipelines, Sigma, YARA for benign lab samples, Suricata, Zeek, osquery, Volatility, Timesketch, MITRE ATT&CK, threat intelligence quality, and detection-as-code.
- Safe static/dynamic malware triage concepts using inert or purpose-built samples only.
8-Week Lab Sequence
| Week | Labs | Deliverable |
|---|---|---|
| 1 | detection range and logging contract | source inventory, schemas, retention, health alerts |
| 2 | Windows and Linux telemetry | benign behavior fixtures, normalized events, coverage map |
| 3 | cloud/K8s/identity telemetry | joined user-workload-resource timeline |
| 4 | Sigma, YARA, Suricata, Zeek, osquery | 12 tested rules with positive/negative fixtures |
| 5 | disk and memory forensics | evidence manifest, process/file/network findings and caveats |
| 6 | packet and timeline analysis | UTC super-timeline with confidence and alternative hypotheses |
| 7 | safe malware triage | static metadata, behavior in isolated sandbox, containment guidance |
| 8 | tabletop and live simulation | command log, status reports, recovery, PIR, detection backlog |
Runnable lab portfolio
- Detection-as-Code Correlation Engine
- Forensic Timeline Normalizer
- Detection Coverage and Data-Health Auditor
These cover behavioral correlation, UTC/skew/confidence handling, ATT&CK-style coverage, fixture quality, ownership, runbooks, and unhealthy telemetry.
Generate incident behavior through benign administrative scripts and seeded artifacts. Do not build malware, persistence, credential theft, evasion, or destructive payloads.
Capstone - Full Incident Simulation
Scenario: a developer token is accidentally exposed in a lab repository, used by a seeded simulator to deploy an unauthorized container that accesses synthetic records. Evidence spans Git, identity, cloud, Kubernetes, network, Linux, and application logs.
Deliver:
- incident charter, roles, severity, hypotheses, and decision log;
- evidence collection with chain of custody;
- scoping queries and high-confidence UTC timeline;
- containment plan that preserves business operation;
- credential/key rotation, workload rebuild, validation, and monitored recovery;
- root-cause and contributing-factor analysis;
- technical report, executive report, and post-incident review;
- improved controls plus tested detections.
Measures
- Detect and declare within the exercise SLO.
- Executive updates state known, unknown, actions, risk, and next update time.
- Timeline events cite evidence IDs and confidence.
- Containment and recovery decisions include blast radius and operational tradeoffs.
- Every detection has owner, runbook, data dependency, false-positive strategy, and test.
Tools and Sources
OpenSearch/Wazuh/Splunk-like stack, Sigma, YARA, Suricata, Zeek, osquery, Sysmon, auditd, Volatility, Autopsy/Sleuth Kit concepts, Timesketch, Velociraptor, cloud-native query tools. Read NIST SP 800-61/86, MITRE ATT&CK, platform logging docs, Sigma specification, and public incident reports.
Evaluation Checklist
- Preserve evidence while taking urgent containment action.
- Separate facts, hypotheses, and disproven hypotheses.
- Scope identity, endpoint, cloud, data, and persistence risk without unsafe collection.
- Write detections robust to harmless variation and test them.
- Lead technical and executive briefings.
- Convert root cause into durable engineering and process improvements.
Common Mistakes and Interview Questions
Mistakes: rebuilding before evidence collection, announcing attribution too early, searching only for known indicators, ignoring clock/timezone, alert-count metrics, brittle exact-string rules, over-collecting personal data, and blaming an individual instead of fixing system conditions.
Questions: lead the first 30 minutes of a cloud credential incident; investigate suspicious PowerShell without assuming maliciousness; validate a memory-forensics claim; design detection for unexpected K8s workload creation; communicate an uncertain blast radius to executives.
Portfolio and Stretch
Publish only synthetic evidence and sanitized reports. Stretch: detection CI, schema contract tests, purple-team measurement, endpoint collection package, threat-informed detection coverage, or automated evidence freshness/health monitoring.