Scope it properly, then find out how wrong you were

short · 50 min · Objective 3.3

Task

Take a single alert from your staged intrusion and scope outward from it, recording your estimate of the scope at three points. Then compare against what you actually did. The gap between first estimate and truth is the lesson.

Steps

  1. Pick one alert from the staged intrusion -- ideally not the first thing that happened, so you are starting mid-story as you would in reality.
  2. First estimate, after five minutes: how many hosts, how many accounts, what time range? Write it down.
  3. Scope systematically: search the whole estate for the indicator, not the host that alerted. Enumerate every account that touched every affected host, including service accounts. Push the time range earlier than the first evidence you found.
  4. Second estimate, after thirty minutes. Write it down beside the first.
  5. Keep going until the pivots stop producing new hosts or accounts. Third estimate.
  6. Open the sealed notes. Score all three estimates, and note specifically whether your time range ever reached the true start.
  7. Write the scope statement properly -- with its boundary: what you searched, and what limited the search.

Verify

grep -rl "the-indicator" /var/log/collected/ | wc -l
grep -rh "Accepted\|Logon" /var/log/collected/ | awk '{print $(NF-5)}' | sort -u | wc -l
head -1 /var/log/collected/conn.log | cut -c1-15
tail -1 /var/log/collected/conn.log | cut -c1-15

Hosts carrying the indicator, distinct accounts seen, and the bounds of your data. The last two are what turns a scope claim into a defensible one: "four hosts, searched the whole estate, retention limits the search to the 3rd onward" is a statement your evidence supports, and "four hosts affected" is not.

Notes

Almost everyone's first estimate is too small, and the direction is the point: you found the intrusion where it was noisy enough to detect, not where it started.

The accounts number is the one that usually grows most. Every credential that touched a compromised host is compromised, and that rule is what turns a three-host incident into an estate-wide credential reset.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.