GIAC Enterprise Incident Response

Scoping answers how far an intruder got. You catalog the data sources an enterprise has, aggregate telemetry from endpoints, identity, network and cloud, and use it to size an incident and find what else is affected.

• Enterprise data sources and their blind spots
• Endpoint, identity, network and cloud telemetry
• Aggregating and normalizing data from many sources
• Pivoting from one indicator to affected systems
• Scoping by time, account and technique
• Recording scope as it changes

You build A scoping worksheet and a data source map for a simulated enterprise compromise.

Waiting for alerts finds the attackers who were careless. You apply threat intelligence and the findings of proactive hunts to detect current intrusion techniques, and turn what you learn into detections.

• Threat intelligence for responders: sources and quality
• Mapping behavior to attack techniques
• Hypothesis-driven hunts across enterprise data
• Turning indicators into durable detections
• Detecting attacks on identity and cloud
• Feeding hunt results back to the response team

You build A hunt plan built from a threat report, with the queries and the detection it produces.

When hundreds of machines may be affected, you cannot image them all. You collect, process and analyze triage data across large numbers of endpoints with lightweight tools and a repeatable workflow.

• What to collect when time is short
• Remote collection tools and their trade-offs
• Processing triage data in bulk
• Stacking and outlier analysis across endpoints
• Deciding which systems merit deeper analysis
• Keeping collection safe for evidence and for production

You build A triage workflow and a result summary from a collection across a set of lab endpoints.

Linux hosts hold many of an organization’s most valuable systems. You learn the basics a responder needs, why Linux can be hard to monitor well, and how attackers move through it at each stage of an intrusion.

• Linux system structure, users and processes
• Command-line skills for investigation
• Challenges of securing and monitoring Linux
• Attack techniques on Linux across the lifecycle
• Remote access and credential abuse on Linux
• Common persistence and cover-up behaviors

You build A map of attacker techniques on Linux with the evidence each leaves.

Linux evidence lives in files, logs and configuration. You examine the file system, find the important logs and formats, and review key configuration files to reconstruct what an attacker did.

• Linux file systems and their metadata
• Important log locations and formats
• Authentication and system logs for intrusion
• Scheduled tasks, services and startup configuration
• Collecting evidence from a live Linux host
• Building a timeline from Linux sources

You build An examination report of a compromised Linux server with timeline and evidence.

Macs are common among developers and executives and are often missing from enterprise monitoring. You learn the basics of macOS, how it is secured and monitored, and how attackers work on it.

• macOS system structure and the APFS file system
• Built-in protections and their limits
• Managing and monitoring Macs in an enterprise
• Attack techniques on macOS across the lifecycle
• Persistence with launch agents and daemons
• Credential and keychain exposure

You build A macOS monitoring and response gap analysis for an enterprise fleet.

Mac evidence differs from Windows in format and location. You examine the file system, find the key logs and unified log data, and review the configuration files that show how an intruder gained and kept access.

• APFS metadata and snapshots
• Unified logging and other log sources
• Property lists and configuration files
• Quarantine records and download origins
• Application and execution artifacts on macOS
• Collecting evidence from a Mac under management

You build An examination report of a compromised Mac, with artifacts and a timeline.

Responders must understand the platform before they can investigate it. You learn the core cloud concepts, the common services an enterprise uses to run its business, and what is and is not visible to a customer.

• Cloud service and deployment models
• Identity, compute, storage and network services
• Logging and audit services at a basic level
• The shared responsibility line for incident response
• Multi-account and multi-region enterprise setups
• Evidence that only the provider holds

You build A cloud service inventory for an enterprise with the log and evidence sources for each service.

Cloud attacks move at the speed of an API. You learn the common attack scenarios, identify and extract artifacts by hand and with automation, and analyze them to understand what was accessed and changed.

• Common cloud attack scenarios
• Identity and access key abuse in audit logs
• Collecting snapshots, logs and configuration
• Automating collection and containment
• Analyzing storage, compute and identity events
• Preserving evidence in ephemeral environments

You build A cloud incident investigation with queries, extracted artifacts and a findings report.

Containers are short-lived and shared, which changes what evidence exists. You learn the basics of container technology, the common attacks against it, and a strategy for collecting and analyzing evidence from container incidents.

• How containers and images work
• Orchestration platforms and their logs
• Common attacks on containers and clusters
• Collecting from running and stopped containers
• Image layers and file system analysis
• A response strategy for container incidents

You build A container incident response procedure with collection steps and an analysis of one compromised container.

Run a complete incident across Windows, Linux, macOS and cloud. You scope with enterprise data, triage at scale, analyze across platforms and report what happened with the evidence behind each statement.

• Receiving the initial indicators
• Scoping with enterprise telemetry
• Triage and deep analysis across platforms
• Containment and eradication planning
• Writing the final report

You build An enterprise incident investigation report covering endpoints, servers and cloud.