← Back to Shield House

CFR-310 Incident Response Toolkit

CertNexus CyberSec First Responder - Practical IR Skills & Tools

CFR-310 | CyberSec First Responder | CertNexus

Incident Response Lifecycle

Click on each phase to explore the activities and deliverables. Communication occurs throughout all phases.

1

Preparation

2

Identification

3

Containment

4

Eradication

5

Recovery

6

Post-Incident

Phase 1: Preparation

  • Develop and maintain IR policies and procedures
  • Build and train the incident response team (IRT)
  • Deploy security tools and monitoring infrastructure
  • Establish communication plans (internal & external)
  • Create contact lists for stakeholders and third parties
  • Set up evidence collection and preservation procedures
  • Conduct tabletop exercises and simulations
  • Maintain up-to-date asset inventory

Phase 2: Identification

  • Detection: Monitor alerts from SIEM, IDS/IPS, EDR
  • Analysis: Triage and validate potential incidents
  • Collection: Gather initial evidence and logs
  • Determine incident scope, severity, and impact
  • Identify affected systems, users, and data
  • Document timeline of events
  • Assign incident classification and priority
  • Notify appropriate stakeholders

Phase 3: Containment

  • Short-term: Isolate affected systems immediately
  • Long-term: Apply temporary fixes and patches
  • Block malicious IPs, domains, and hashes
  • Disable compromised accounts
  • Implement network segmentation
  • Preserve evidence before changes
  • Deploy additional monitoring on affected segments
  • Document all containment actions taken

Phase 4: Eradication

  • Remove malware and malicious artifacts
  • Delete unauthorized accounts and access
  • Apply permanent patches and fixes
  • Reset compromised credentials
  • Clean or reimage affected systems
  • Update firewall and security rules
  • Verify complete removal of threat
  • Address root cause vulnerabilities

Phase 5: Recovery

  • Restore systems from clean backups
  • Rebuild systems if necessary
  • Verify system integrity before production
  • Monitor closely for signs of reinfection
  • Gradually restore services and access
  • Validate business processes are functioning
  • Confirm security controls are operational
  • Document recovery timeline

Phase 6: Post-Incident

  • Root Cause Analysis: Identify how and why incident occurred
  • Lessons Learned: Conduct after-action review meeting
  • Documentation: Complete incident report including:
    • Executive Summary
    • Incident Description & Timeline
    • Technical Analysis
    • Impact Assessment
    • Remediation Actions
    • Recommendations
  • Update IR procedures based on findings
  • Improve detection and prevention controls
  • Share threat intelligence (if appropriate)

Incident Response Tools

Registry Analysis Persistence

Examine registry for persistence mechanisms and configuration changes

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Network Connections Network

View active network connections and listening ports

netstat -ano | findstr ESTABLISHED

Running Processes Process

List processes with their PIDs and memory usage

tasklist /v /fo table

Autoruns Persistence

Sysinternals tool to view all auto-start locations

autorunsc.exe -accepteula -a * -c -h -s -v

Process Explorer Process

Advanced process viewer with DLL inspection and VirusTotal integration

procexp.exe

Process Monitor Forensics

Real-time file system, registry, and process activity monitoring

procmon.exe /Quiet /Minimized /BackingFile log.pml

Wireshark Network

Capture and analyze network traffic for malicious communications

tshark -i 1 -w capture.pcap -f "host 192.168.1.1"

Hash Verification Integrity

Calculate file hashes for malware identification

certutil -hashfile malware.exe SHA256

Memory Analysis Forensics

Capture and analyze volatile memory with Rekall

winpmem_mini_x64.exe memdump.raw

Services Persistence

List running services and their status

net start | more

Scheduled Tasks Persistence

View scheduled tasks that may be malicious

schtasks /query /fo LIST /v

User Accounts Access

List local and domain user accounts

net user && net localgroup administrators

Network Connections Network

View active network connections with process information

ss -tulnp | grep LISTEN

Running Processes Process

Display running processes with full details

ps auxf --forest

Open Files Forensics

List files opened by processes

lsof -i -n -P | grep ESTABLISHED

Packet Capture Network

Capture network traffic with tcpdump

tcpdump -i eth0 -w capture.pcap -n

File Hashing Integrity

Calculate file hash for identification

sha256sum suspicious_file

Memory Dump Forensics

Create memory dump with dd

dd if=/dev/mem of=/tmp/memdump.raw bs=1M

Volatility Forensics

Analyze memory dumps for malicious artifacts

volatility -f memdump.raw linux_pslist

Strings Analysis Malware

Extract readable strings from binaries

strings -n 8 malware_sample | less

User Sessions Access

Show logged in users and their activity

w && last -20

Cron Jobs Persistence

List scheduled cron tasks

crontab -l && cat /etc/crontab

Startup Scripts Persistence

Check common persistence locations

ls -la /etc/init.d/ /etc/rc.local ~/.bashrc

System Activity Monitoring

Real-time process monitoring

htop

Indicators of Compromise Checklist

Click items to mark as checked during your investigation. Use this as a systematic approach to identify compromise indicators.

Unauthorized programs in startup locations
Presence of attack tools or malware
Suspicious registry entries
Unusual outbound network traffic
Abnormal bandwidth usage spikes
Malicious C2 communications
Off-hours system activity
New admin/user accounts created
Guest account enabled/used
Unknown open ports listening
Unknown protocols in use
Service disruption or degradation
Website defacement
Unauthorized file modifications
Suspicious emails received/sent
Unauthorized remote sessions
Failed login attempts spike
Rogue hardware devices detected

Data Sources for Analysis

Network-Based Sources

Source Type Key Information
Firewall Logs Network Allowed/blocked connections, source/dest IPs, ports
IDS/IPS Logs Network Attack signatures, alerts, blocked threats
WAF Logs Network Web attacks, SQLi, XSS attempts
Proxy Logs Network URLs accessed, user agent strings, downloads
Packet Captures Network Full packet data, payload analysis
NetFlow/IPFIX Network Traffic patterns, volume, flow data
DNS Logs Network Domain queries, potential C2 domains

Host-Based Sources

Source Type Key Information
Windows Event Logs Host Security events, logons, process creation
Syslog Host Linux system events, service activity
Registry Host Persistence, configuration changes
Memory Dump Host Running processes, injected code, credentials
File System Host Artifacts, timestamps, suspicious files
EDR Telemetry Host Process trees, file changes, network activity

Application Sources

Source Type Key Information
Web Server Logs App HTTP requests, errors, attack attempts
Database Logs App Queries, access patterns, errors
Authentication Logs App Login attempts, MFA events, password changes
Email Logs App Phishing attempts, data exfiltration

Containment Strategies

Blocking Methods

  • IP/Domain blacklisting
  • Hash-based file blocking
  • Port blocking at firewall
  • URL/Content filtering
  • IDS/IPS rule updates

Network Isolation

  • VLAN quarantine
  • Network segmentation
  • Disable network ports
  • VPN termination
  • DNS sinkholing

Account Controls

  • Disable compromised accounts
  • Force password reset
  • Revoke API keys/tokens
  • Remove admin privileges
  • Enable MFA enforcement

Host Actions

  • Isolate from network
  • Disable services
  • Kill malicious processes
  • Snapshot for forensics
  • Apply emergency patches

Security Tools

  • Firewall rule updates
  • IDS/IPS signature updates
  • Web proxy restrictions
  • Anti-malware scans
  • DLP policy enforcement

Documentation

  • Log all containment actions
  • Record timestamps
  • Preserve evidence
  • Chain of custody
  • Stakeholder notifications

CFR-310 Knowledge Check

Q1: What is the correct order of the Incident Response lifecycle phases?

Identification → Preparation → Containment → Eradication → Recovery → Post-Incident
Preparation → Identification → Containment → Eradication → Recovery → Post-Incident
Preparation → Containment → Identification → Recovery → Eradication → Post-Incident
Detection → Analysis → Containment → Elimination → Recovery → Closure

Q2: Which Windows command would you use to view established network connections with their associated process IDs?

ipconfig /all
netstat -ano
net view
tasklist /v

Q3: Which of the following is NOT typically considered an Indicator of Compromise (IOC)?

Unusual outbound network traffic
New administrator accounts created
Scheduled system backups running on time
Unauthorized programs in startup locations

Q4: During which IR phase would you conduct a "lessons learned" meeting?

Preparation
Recovery
Post-Incident
Eradication

Q5: Which tool would you use to analyze volatile memory from a compromised Linux system?

tcpdump
strings
Volatility
lsof
Question 1 of 5