ISC2 Threat Handling Foundations Certificate

Evidence that cannot be trusted cannot be used. You learn the order of volatility, acquisition methods, integrity hashing and chain of custody, and the legal ideas that decide whether what you collect will stand up.

• The forensic process from identification to reporting
• Order of volatility and what to collect first
• Acquisition: live, dead and logical
• Hashing, write protection and integrity
• Chain of custody and documentation
• Legal considerations and admissibility

You build An evidence handling procedure with a chain-of-custody form and acquisition checklist.

Each environment leaves different traces and imposes different limits. You compare what Windows, Linux, virtual, cloud and mobile systems retain, and adjust acquisition and analysis to what the platform allows.

• Windows host artifacts in overview
• Linux and server evidence sources
• Virtual machines and snapshots as evidence
• Cloud evidence and provider dependencies
• Mobile device acquisition basics
• Choosing a method when the system cannot be taken offline

You build A platform evidence matrix that lists artifacts, tools and limits for five environments.

Preparation decides how an incident goes. You set clear definitions of event, incident and breach, classify by severity, write response plans and playbooks, and rehearse them before anyone has to use them for real.

• Event, incident and breach: working definitions
• Severity classification and escalation
• Incident response plan structure and roles
• Playbooks for common incident types
• Contacts, tooling and communications readiness
• Tabletop exercises and what they reveal

You build An incident response plan with severity table, three playbooks and a tabletop scenario.

Response is a series of decisions under uncertainty. You triage, scope and contain an incident before it becomes a breach, eradicate and recover, and turn the review into changes that improve security posture.

• Triage and scoping from the first indicators
• Containment choices and their business cost
• Eradication and recovery without reinfection
• Communication and notification during response
• Documenting actions and decisions
• Post-incident review and corrective actions

You build An incident timeline and post-incident report for a simulated intrusion.

Attackers must cross the network, and that leaves traces. You learn the common network threats, such as scanning, command-and-control, tunneling and lateral movement, and the data sources that reveal them.

• Reconnaissance and scanning activity
• Command and control and beaconing patterns
• DNS and protocol tunneling
• Lateral movement and internal reconnaissance
• Data exfiltration over the network
• Evidence sources: flows, packet capture, DNS and proxy logs

You build A catalog of network threats, each with its signs and the data source that shows it.

Hunting looks for what alerts missed. You form hypotheses from threat intelligence and the MITRE ATT&CK framework, search network data to test them, record what you find, and convert successful hunts into lasting detections and mitigations.

• The hunt cycle: hypothesis, search, conclude
• Using MITRE ATT&CK to shape hunts
• Baselining normal network behavior
• Packet capture and sensors: Wireshark, Zeek and Suricata
• Documenting hunts and negative results
• Turning findings into detections and mitigations

You build Three documented hunts, each with hypothesis, queries, findings and a resulting detection.

Use every part of the toolkit on a single scenario. You investigate evidence, work the response process, hunt for further compromise on the network and write the report a program owner would need.

• Reviewing the scenario and the available evidence
• Preserving and analyzing evidence
• Working the response plan
• Hunting for related activity
• Reporting and improving the program

You build A complete investigation report for a simulated intrusion, with hunt findings and program improvements.