Incident Types
IR Phases
DFIR Tools
Detection
Pot Pourri
200

This type of malware encrypts a victim's data and demands a ransom for the decryption key.

What is Ransomware?

200

The initial phase of the Incident Response life cycle where plans and preparations are made.

What is Preparation?

200

Cellebrite and Oxygen are types of these that extract data from Android and iOS devices.

What are mobile forensic tools?

200

The process of continuously monitoring systems and networks for unusual activity that could indicate a security incident.

What is Event Monitoring?

200

A strategy used to prevent the spread of an infection by isolating affected systems.

What is Quarantine?

400

The installation of malicious software on a system without consent, which can lead to data theft or system disruption.

What is Malware Infection?

400

The phase where potential security incidents are identified and reported.

What is Detection?

400

An open-source digital forensic tool used for data analysis and recovery.

What is Autopsy?

400

This process of effectively responding to security breaches by determining the breach's extent and prioritizing response activities like containment and system restoration.

What is Incident Scoping?

400

The person who disseminates information about an incident to staff, stakeholders, or the public.

Who is the Communications or PR Specialist?
600

Unauthorized access to sensitive information leading to its exposure or theft.

What is a Data Breach?

600

Activities conducted after an incident to improve future response efforts and prevent recurrence.

What is Post-Incident Activity?

600

Software used for packet analysis and network troubleshooting

What is Wireshark?

600

A method to confirm that an event or series of events constitutes a security incident and not a false positive.

What is Incident Validation?

600

This refers to indicators that warn an incident has occurred or is currently occurring, such as unscheduled login attempts.

What are Indicators of Compromise (IoCs)?

800

Manipulating individuals into divulging confidential information through tactics like impersonation.

What is Social Engineering?

800

The process of removing the threat and restoring systems to normal operation.

What is Eradication and Recovery?

800

A freely available hex editor used for manually carving data from files and images.

What is HxD?

800

In this step of the Incident Response process, teams aim to preserve evidence, assess the breach's extent, and identify IOCs by gathering logs, network traffic, system images, process memory, and configuration files.

What is Data Collection?
800

The role identified as the first to detect the SolarWinds Hack, showcasing the importance of external threat intelligence.

Who is FireEye?

1000

This attack overwhelms a system with excessive traffic, rendering it inaccessible to legitimate users.

What is a Denial of Service (DoS) or Distributed Denial of Service (DDoS) attack?

1000

This phase involves stopping the spread of the incident and isolating affected systems.

What is Containment?

1000

This freely available tool is used for creating forensic images of digital media.

What is FTK Imager?

1000

This component of the IR detection process utilizes tools like SIEM systems, and techniques such as log, traffic, and endpoint analysis, to identify security incidents that event monitoring might miss.

What is Event Correlation?

1000

A type of exercise used to simulate incident response scenarios to test and refine the IR plan.

What are tabletop exercises?

M
e
n
u