Respond to an intrusion end to end

applied · 120 min · Objective 3.3

Task

Run a complete response against a staged intrusion in your lab: detect, triage, scope, preserve, contain, eradicate, recover, and review. Objective 3.3 is implementing response techniques, and this is all of them in sequence, under the constraints that make each one hard.

Steps

  1. Stage a multi-step intrusion: initial access, discovery, credential use, lateral movement to the second host, two persistence mechanisms on different hosts, and a beacon. Seal the notes and leave it at least a day.
  2. Detect from your own alerting, not from the notes. Record what alerted and what you had to find by hand.
  3. Triage and scope per the triage lab, recording your estimate at three points.
  4. Preserve before you contain: memory from one host, volatile state from both, hashed into a manifest.
  5. Decide the containment moment explicitly. Write down the reasoning -- including whether partial containment would have burned surprise -- and then contain the full known scope at once.
  6. Eradicate: enumerate persistence by category on both hosts, reset every credential that touched either, revoke sessions, and remove what you find.
  7. Recover by rebuilding one host from the clean snapshot and cleaning the other, and write down why each choice was right for that host.
  8. Monitor for an agreed period afterwards, watching for authentication attempts on the reset accounts and any new persistence.
  9. Review: timeline, root causes, actions with owners, and the score against your sealed notes.

Verify

sha256sum -c /tmp/evidence/manifest.sha256 2>&1 | grep -c ": OK$"
grep -c "^" /tmp/timeline.tsv
awk -F'\t' '$5==""' /tmp/timeline.tsv | wc -l
crontab -l 2>/dev/null | grep -vc "^#"
powershell -c "(Get-ScheduledTask | Where-Object {$_.Author -notmatch 'Microsoft'}).TaskName" | wc -l
grep -c "Failed password" /var/log/auth.log

Evidence verifying against its manifest, a timeline whose every row carries a confidence value, and persistence counts back to their clean baseline. The last is the monitoring result: authentication attempts on reset accounts after containment mean the attacker still holds a credential you have not found, and it is the single most informative number in the days after.

Notes

Score the response, not just the investigation. How long from first attacker action to detection, from detection to containment, from containment to verified eradication? Those three numbers are the ones a post-incident review reports, and you now have them from an incident you can repeat.

If step 8 was quiet, say so with its bounds: "no authentication attempts on the reset accounts over 72 hours of monitoring." That is a finding. "The attacker is gone" is not.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.