CoreQ Academy4.4 Given a scenario, analyze data and artifacts in support of incident response activities.
Incident analysis turns artifacts (malware, memory, disks, logs, metadata) into answers: what happened, how, when, and what to fix.
Malware analysis
- Detonation
- Executing a sample in a controlled environment to observe behaviour.
- IoC extractions
- Pulling hashes, domains, IPs and file paths from samples for detection.
- Sandboxing
- Isolated environments for safe dynamic analysis.
- Code stylometry
- Analysing coding style to relate samples.
- Variant matching
- Identifying samples as variants of known families.
- Code similarity
- Comparing code to find shared components across samples.
- Malware attribution
- Linking malware to a threat actor using code, infrastructure and TTP evidence; attribution is difficult and should be stated with confidence levels.
Reverse engineering
- Disassembly and decompilation
- Converting machine code to assembly or approximate source to understand behaviour.
- Binary
- Analysing compiled native executables.
- Byte code
- Analysing intermediate code such as Java or .NET, which decompiles more readily.
Storage, network and host analysis
- Volatile/non-volatile storage analysis
- Memory (processes, connections, injected code) versus disk (files, registry, artifacts); capture volatile first.
- Network analysis
- Packet captures and flow logs revealing C2, lateral movement and exfiltration.
- Host analysis
- Examining processes, persistence, logs and file systems on affected hosts.
Metadata analysis
- Email header
- Received chain, authentication results and originating IPs.
- Images
- EXIF data such as device, time and GPS location.
- Audio/video
- Embedded metadata and signs of manipulation (deepfakes).
- Files/filesystem
- Timestamps (MAC times), authors, alternate data streams and journal entries.
Hardware and recovery
- Hardware analysis
- Examining physical devices.
- Joint test action group (JTAG)
- A hardware debug interface used to extract firmware or memory from devices.
- Data recovery and extraction
- Recovering deleted or damaged data forensically.
Response activities
- Threat response
- Containment, eradication and recovery actions.
- Preparedness exercises
- Tabletops and simulations that improve response readiness.
- Timeline reconstruction
- Building an ordered sequence of events from all sources.
- Root cause analysis
- Finding the underlying cause so it can be fixed.
- Cloud workload protection platform (CWPP)
- Protection and telemetry for cloud workloads (VMs, containers, serverless) used during cloud investigations.
- Insider threat
- Investigations involving trusted users; coordinate with HR and legal and protect privacy.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.4 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.