Security Event Triage

  1. Core Triage Analysis Techniques
    1. Analyzing Network Traffic
      1. Source and Destination IP Addresses
        1. Internal vs. External Traffic
          1. Known Malicious IPs
            1. Geographic Analysis
            2. Port and Protocol Usage
              1. Unusual Port Activity
                1. Protocol Anomalies
                  1. Service Identification
                  2. Payload Analysis (Superficial)
                    1. Suspicious Content Patterns
                      1. File Type Identification
                        1. Encoding Detection
                        2. User-Agent Strings
                          1. Unusual or Malicious User-Agents
                            1. Application Identification
                            2. Connection Patterns
                              1. Frequency and Duration
                                1. Data Volume Analysis
                              2. Analyzing Endpoint Activity
                                1. Process Execution and Parent-Child Relationships
                                  1. Suspicious Process Trees
                                    1. Unusual Parent-Child Combinations
                                      1. Process Injection Detection
                                      2. File Modifications and Hashes
                                        1. Unexpected File Changes
                                          1. Hash Comparison with Known Malware
                                            1. File Creation and Deletion Patterns
                                            2. Registry Changes
                                              1. Persistence Mechanisms
                                                1. Unauthorized Modifications
                                                  1. Startup Program Changes
                                                  2. Command Line Arguments
                                                    1. Malicious Command Patterns
                                                      1. Obfuscation Techniques
                                                        1. Parameter Analysis
                                                        2. PowerShell and Shell Script Analysis
                                                          1. Script Content Review
                                                            1. Execution Context
                                                              1. Encoded Command Detection
                                                              2. Network Connections from Endpoints
                                                                1. Outbound Connection Analysis
                                                                  1. Unusual Communication Patterns
                                                                2. Analyzing User Behavior
                                                                  1. Login Patterns
                                                                    1. Time-Based Analysis
                                                                      1. Location-Based Analysis
                                                                        1. Frequency Analysis
                                                                        2. Privilege Escalation Attempts
                                                                          1. Unauthorized Access Attempts
                                                                            1. Lateral Movement Indicators
                                                                              1. Administrative Action Monitoring
                                                                              2. Unusual Access Patterns
                                                                                1. Access to Sensitive Data
                                                                                  1. Data Download or Exfiltration
                                                                                    1. Off-Hours Activity
                                                                                    2. Account Activity Anomalies
                                                                                      1. Multiple Concurrent Sessions
                                                                                        1. Impossible Travel Scenarios
                                                                                      2. Threat Intelligence Correlation
                                                                                        1. Matching IOCs against Feeds
                                                                                          1. Automated IOC Matching
                                                                                            1. Manual Verification
                                                                                              1. IOC Aging and Relevance
                                                                                              2. Understanding Attacker TTPs
                                                                                                1. Tactics, Techniques, and Procedures Analysis
                                                                                                  1. Mapping to MITRE ATT&CK Framework
                                                                                                  2. Leveraging Open-Source Intelligence (OSINT)
                                                                                                    1. Public Threat Reports
                                                                                                      1. Community Intelligence Sharing
                                                                                                        1. Social Media Intelligence

                                                                                                    Previous

                                                                                                    3. Key Data Sources for Triage

                                                                                                    Go to top

                                                                                                    Next

                                                                                                    5. Tools of the Triage Analyst