Preface

• Who this book is for
• What this book covers
• To get the most out of this book
• Download the color images
• Conventions used
• Get in touch
• Share your thoughts

1. Part 1: Foundations of Incident Response and Digital Forensics

2. Chapter 1: Understanding Incident Response FREE CHAPTER

• The IR process
• The IR framework
• The IR plan
• The IR playbook/handbook
• Testing the IR framework
• Summary
• Questions
• Further reading

3. Chapter 2: Managing Cyber Incidents

• Engaging the incident response team
• SOAR
• Incorporating crisis communications
• Incorporating containment strategies
• Getting back to normal – eradication, recovery, and post-incident activity
• Summary
• Questions
• Further reading

4. Chapter 3: Fundamentals of Digital Forensics

• An overview of forensic science
• Locard’s exchange principle
• Legal issues in digital forensics
• Forensic procedures in incident response
• Summary
• Questions
• Further reading

5. Chapter 4: Investigation Methodology

• An intrusion analysis case study: The Cuckoo’s Egg
• Types of incident investigation analysis
• Functional digital forensic investigation methodology
• The cyber kill chain
• The diamond model of intrusion analysis
• Summary
• Questions

6. Part 2: Evidence Acquisition

7. Chapter 5: Collecting Network Evidence

• An overview of network evidence
• Firewalls and proxy logs
• NetFlow
• Packet capture
• Wireshark
• Evidence collection
• Summary
• Questions
• Further reading

8. Chapter 6: Acquiring Host-Based Evidence

• Preparation
• Order of volatility
• Evidence acquisition
• Acquiring volatile memory
• Acquiring non-volatile evidence
• Summary
• Questions
• Further reading

9. Chapter 7: Remote Evidence Collection

• Enterprise incident response challenges
• Endpoint detection and response
• Velociraptor overview and deployment
• Velociraptor scenarios
• Summary
• Questions

10. Chapter 8: Forensic Imaging

• Understanding forensic imaging
• Tools for imaging
• Preparing a staging drive
• Using write blockers
• Imaging techniques
• Summary
• Questions
• Further reading

11. Part 3: Evidence Analysis

12. Chapter 9: Analyzing Network Evidence

• Network evidence overview
• Analyzing firewall and proxy logs
• Analyzing NetFlow
• Analyzing packet captures
• Summary
• Questions
• Further reading

13. Chapter 10: Analyzing System Memory

• Memory analysis overview
• Memory analysis methodology
• Memory analysis tools
• Memory analysis with Strings
• Summary
• Questions
• Further reading

14. Chapter 11: Analyzing System Storage

• Forensic platforms
• Autopsy
• Master File Table analysis
• Prefetch analysis
• Registry analysis
• Summary
• Questions
• Further reading

15. Chapter 12: Analyzing Log Files

• Logs and log management
• Working with SIEMs
• Windows Logs
• Analyzing Windows Event Logs
• Summary
• Questions
• Further reading

16. Chapter 13: Writing the Incident Report

• Documentation overview
• Executive summary
• Incident investigation report
• Forensic report
• Preparing the incident and forensic report
• Summary
• Questions
• Further reading

17. Part 4: Ransomware Incident Response

18. Chapter 14: Ransomware Preparation and Response

• History of ransomware
• Conti ransomware case study
• Proper ransomware preparation
• Eradication and recovery
• Summary
• Questions
• Further reading

19. Chapter 15: Ransomware Investigations

• Ransomware initial access and execution
• Discovering credential access and theft
• Investigating post-exploitation frameworks
• Command and Control
• Investigating lateral movement techniques
• Summary
• Questions
• Further reading

20. Part 5: Threat Intelligence and Hunting

21. Chapter 16: Malware Analysis for Incident Response

• Malware analysis overview
• Setting up a malware sandbox
• Static analysis
• Dynamic analysis
• ClamAV
• YARA
• Summary
• Questions
• Further reading

22. Chapter 17: Leveraging Threat Intelligence

• Threat intelligence overview
• Sourcing threat intelligence
• The MITRE ATT&CK framework
• Working with IOCs and IOAs
• Threat intelligence and incident response
• Summary
• Questions
• Further reading

23. Chapter 18: Threat Hunting

• Threat hunting overview
• Crafting a hypothesis
• Planning a hunt
• Digital forensic techniques for threat hunting
• EDR for threat hunting
• Summary
• Questions
• Further reading

24. Assessments

• Chapter 2
• Chapter 3
• Chapter 4
• Chapter 5
• Chapter 6
• Chapter 7
• Chapter 8
• Chapter 9
• Chapter 10
• Chapter 11
• Chapter 12
• Chapter 13
• Chapter 14
• Chapter 15
• Chapter 16
• Chapter 17
• Chapter 18

25. Index

• Why subscribe?

26. Other Books You May Enjoy

• Packt is searching for authors like you
• Share your thoughts
• Download a free PDF copy of this book

Appendix