CNIT 152: Incident Response

Fall 2019 Sam Bowne

Newer Version Available

This is an old class. For the newer version go here

CRN 78482 501 Thu 6:10 - 9 pm SCIE 200

Schedule · Lectures · Projects · Links · Home Page


Incident Response & Computer Forensics, Third Edition by by Jason Luttgens, Matthew Pepe, and Kevin Mandia
Publisher: McGraw-Hill Education; 3 edition (August 1, 2014)
Sold by: Amazon Digital Services, LLC
ASIN: B00JFG7152
Kindle edition: $36, Paper edition: $16 (prices I saw on 4-10-16 at Amazon)
Buy from Amazon ($15 - $40)

Catalog Description

When computer networks are breached, incident response (IR) is required to assess the damage, eject the attackers, and improve security measures so they cannot return. This class covers the IR tools and techniques required to defend modern corporate networks. This class is part of the Advanced Cybersecurity Certificate.


The quizzes are multiple-choice, online, and open-book. However, you may not ask other people to help you during the quizzes. You will need to study the textbook chapter before the lecture covering it, and take the quiz before that class. Each quiz is due 30 min. before class. Each quiz has 5 questions, you have ten minutes to take it, and you can make two attempts. If you take the quiz twice, the higher score counts.

To take quizzes, log in to Canvas here:

To reset your password, go to

Live Streaming

Live stream will be at:


For class-related questions, please email


Thu 8-22  1 Real-World Incidents

Thu 8-29Quizzes: Ch 1 *
Proj ED 200 due *
Guests: Alex Levinson & Lucas Morris

Thu 9-5No Quiz due
Proj IR 201 due *
Guest: Alex Levinson: "Incident Response"
Twitter: @alexlevinson

Fri 9-6 Last Day to Add

Thu 9-12Quiz: Ch 2
Proj IR 202 due *
2 IR Management Handbook

Thu 9-19Quiz: Ch 3
Proj ED 300 due
3 Pre-Incident Preparation

Thu 9-26Quiz: Ch 4-5
Proj IR 301 & 302 due
4 Getting the Investigation Started on the Right Foot
5 Initial Development of Leads

Thu 10-3Quiz: Ch 6-7
Proj IR 303 due
6 Discovering the Scope of the Incident
7 Live Data Collection


Thu 10-10Quiz: Ch 8
8 Forensic Duplication

Thu 10-17Quiz: Ch 9
Proj IR 304 & 305 due
9 Network Evidence

Thu 10-24Quiz: Ch 10
Proj IR 306 due
10 Enterprise Services

Thu 10-31Quiz: Ch 11
No Proj due
11 Analysis Methodology

Thu 11-7Quiz: Ch 12 (Part 1)
Proj IR 310 & IR 311 due
12 Investigating Windows Systems (Part 1)

Thu 11-14Quiz: Ch 12 (Part 2)
Proj IR 320 due
12 Investigating Windows Systems (Part 2)

Thu 11-21Quiz: Ch 12 (Part 3)
Proj IR 307 due
12 Investigating Windows Systems (Part 3)

Thu 11-28 Holiday: No Class

Thu 12-5No Quiz due
Proj IR 308 due
12 Investigating Windows Systems (Part 4)

Thu 12-12Quiz Ch 13 (Extra Credit)
All Extra Credit due
Last Class: No Lecture, Open Lab

Thu 12-13 -
Thu 12-20
Final Exam available online throughout the week.
You can only take it once.

All quizzes due 30 min. before class
* No late penalty until 9-19


Note: the Slideshare lectures are for CNIT 152
even if they start with a page saying "CNIT 121".

Projects (Being Revised)

CCSF Project Submission

Each project has "flags". To get credit, capture a full-desktop image with the flag visible and highlighted, including a clock showing the date and time. Email the images to

To capture a screenshot on a PC, press Shift+PrntScrn, open Paint, and press Ctrl+V

To capture a screenshot on a Mac, press Shift+Cmd+3

ED 200: Google Cloud Linux Server (15 pts)
IR  201: Splunk & Suricata (45 pts)
IR  202: Metasploit & Drupalgeddon (30 pts + 55 extra)
ED 300: Windows 2016 Server Cloud Server (15 pts)
IR  301: Installing Splunk on a Windows Cloud Server (15 pts)
IR  302: Detecting Ransomware with Splunk and Sysmon (15 pts + 15 extra)
IR  303: Capturing a RAM from a Process (15 pts)
IR  304: VirusTotal & Wireshark (15 pts + 20 extra)
IR  305: PacketTotal (15 pts + 30 extra)
IR  306: Yara (10 pts + 30 extra)
IR  307: Prefetch Forensics (15 pts)
IR  308: osquery (15 pts)
IR  310: Making a Domain Controller (10 pts)
IR  311: Making a Member Server (10 pts)
IR  320: Ivanti Endpoint Manager (formerly LANDesk) (20 pts)

Extra Credit

Boss of the SOC Project Submission

These two projects have their own scoreboards. To get credit, capture a full-desktop image with your score on the scoreboard visible and highlighted, including a clock showing the date and time. Email the image to

Boss of the SOC v1: Threat Hunting with Splunk (325 pts)
Boss of the SOC v2: Threat Hunting with Splunk (650 pts)

Download VMware Player


Links for Chapter Lectures

Ch 1a: Deconstructing a Credit Card's Data
Ch 1b: Mitigating Fraud Risk Through Card Data Verification
Ch 1c: What data is stored on a payment card's magnetic stripe?

Ch 2a: The OpenIOC Framework

Ch 3a: Free Email Certificate | Secure SSL Certificate from Comodo
Ch 3b: Digitally Sign & Encrypt Emails
Ch 3c: 3 Alternatives to the Now-Defunct TrueCrypt for Your Encryption Needs
Ch 3d: VeraCrypt - Home
Ch 3e: Security Onion
Ch 3f: Network Security Toolkit (NST 24)
Ch 3g: Skynet Solutions : EasyIDS
Ch 3h: NIST Computer Forensic Tool Testing Program
Ch 3i: Evidence Tags and Chain of Custody Forms
Ch 3j: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations
Ch 3k: Federal Rules of Evidence
Ch 3l: Security Technical Implementation Guides (STIGs) for host hardening
Ch 3k: Securing Windows Service Accounts (Part 1)
Ch 3l: Download Splunk Enterprise for free
Ch 3m: GitHub - mcholste/elsa: Enterprise Log Search and Archive
Ch 3n: Snare SIEM Software Products
Ch 3o: SIEM, Security Information Event Management, ArcSight | Hewlett Packard Enterprise
Ch 3p: RSA enVision SIEM | EMC RSA
Ch 3q: Building a DNS Blackhole with FreeBSD
Ch 3r: Windows DNS Server Sinkhole Domains Tool | SANS Institute

Ch 5a: Report Crimes Against Children | Department of Justice

Ch 7a: Redline User Guide
Ch 7b: LINReS | Network Intelligence India Pvt. Ltd.(NII Consulting), Mumbai
Ch 7c: LiME – Linux Memory Extractor
Ch 7d: Memoryze for Mac
Ch 7e: Use the Mandiant Redline memory analysis tool for threat assessments

Ch 8a: Host protected area - Wikipedia
Ch 8b: Device configuration overlay - Wikipedia

Ch 9a: Basic Snort Rules Syntax and Usage
Ch 9b: Snort: Re: Rule for detecting ssh
Ch 9c: OptiView XG Network Analysis Tablet
Ch 9c: Network TAPs
Ch 9d: Security Onion
Ch 9e: Chapter 9 Scenario PCAPs - Incident Response and Computer Forensics, 3rd Edition
Ch 9f: Download NetWitness Investigator
Ch 9g: Old NetWitness Project

Ch 10a: Analyze Microsoft DHCP Server Log Files
Ch 10b: More About Microsoft DHCP Audit and Event Logging
Ch 10c: DHCP | Internet Systems Consortium
Ch 10d: Linux How To/Tutorial: Checking DHCP Logs
Ch 10e: using the ISC DHCP log function for debugging
Ch 10f: BIND | Internet Systems Consortium
Ch 10g: DNSCAP - DNS traffic capture utility | DNS-OARC
Ch 10h: IT Information Systems Management Software | LANDESK
Ch 10i: Parsing Landesk Registry Entries FTW
Ch 10k: LANDesk SoftMon Monitoring Information
Ch 10l: How to browse Software License Monitoring data ... |LANDESK User Community
Ch 10m: RegRipper
Ch 10n: GitHub - keydet89/RegRipper2.8
Ch 10o: GitHub - jprosco/registry-tools: Registry Forensics Tools
Ch 10p: Client Management Suite | Symantec
Ch 10q: Altiris Inventory Solution™ 7.1 SP2 from Symantec™ User Guide
Ch 10r: Symantec Quarantined VBN file decoder
Ch 10s: John McAfee calls McAfee anti-virus "one of the worst products on the ... planet"
Ch 10t: Removing a PHP Redirector
Ch 10u: Understanding IIS 7 log files - Stack Overflow

Ch 11i: Filesystem Timestamps: What Makes Them Tick?
Ch 11j: File System Forensic Analysis: Brian Carrier
Ch 11k: Uuencoding - Wikipedia
Ch 11l: National Software Reference Library
Ch 11m: Nsrllookup
Ch 11n Security Firm Bit9 Hacked, Used to Spread Malware (2013)

Other Links

Yelp/osxcollector: A forensic evidence collection & analysis toolkit for OS X
SecureZeroMemory function (Windows)
Under My Thumbs -- Revisiting Windows thumbnail databases
Using Mandiant Redline to discover Meterpreter process injection - YouTube
Elcomsoft Advanced mobile forensics: iOS (iPhone and iPad), Windows Phone and BlackBerry 10
Aid4Mail Now (Free Trial)

New Unsorted Links

osquery | Easily ask questions about your Linux, Windows, and macOS infrastructure
GitHub - Yelp/osxcollector: A forensic evidence collection & analysis toolkit for OS X
OS X Incident Response: Scripting and Analysis--RECOMMENDED
GitHub - google/grr: GRR Rapid Response: remote live forensics for incident response
KnockKnock shows you what's persistently installed on your Mac! -- RECOMMENDED
GitHub - Yelp/amira: AMIRA: Automated Malware Incident Response & Analysis
Cyphort: Anti-SIEM reduces SIEM cost, noise, complexity, and wasted time
Collect NTFS forensic information with osquery
Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk)
Kit Hunter, a phishing kit detection script -- USEFUL FOR PROJECTS
Log-MD Tool Free Version
Threat Hunting Workshop--USE FOR PROJECTS
ATT&CK Matrix - ATT&CK for Enterprise
GitHub - redcanaryco/atomic-red-team: Small and highly portable detection tests based on MITRE's ATT&CK.
Log Management & Security Analytics, Continuous Intelligence: Sumo Logic
Rekall Forensics
Public PCAP files for download
Automated Malware Analysis - Joe Sandbox
Free Automated Malware Analysis Sandboxes and Services
Free Automated Malware Analysis Service - powered by Falcon Sandbox
Try AlienVault USM for Free
Ch 9h: Snort rule for fake SSL certificate
7 Sumo Logic Competitors in Cloud-Based Log Management and Anomaly Detection
Ch 12a: Shim Cache Parser Slides
Ch 13a: Apple File System - Wikipedia
Ch 13b: The MacPorts Project -- Download & Installation
Ch 13c: macos - OS X 10.9: where are password hashes stored - Ask Different
Ch 13d: macos - What type of hash are a Mac's password stored in? - Ask Different
Ch 13e: How to crack macbook admin password
Ch 13f: How to Convert plist Files to XML or Binary in Mac OS X
Ch 13g: Collecting password hashes from Mac OS Mojave
Security Analyst Workshop--VERY GOOD TOOLS
Splunk Cheat Sheet
Available Artifacts on Windows Versions - Evidence of Execution
NIST SPECIAL PUBLICATION 1800-26 Data Integrity Detecting and Responding to Ransomware and Other Destructive Events
Awesome-incident-response: A curated list of tools for incident response
2020-10-15: Recommended Mandiant and FireEye Blogs
Splunking with Sysmon Series Part 1: The Setup | Hurricane Labs
Splunking with Sysmon
Ch 7f: Comparison of Acquisition Software for Digital Forensics Purposes
Ch 12k: A simple way to access Shadow Copies in Vista | Microsoft Docs
Plaso: Super timeline all the things
Timesketch: Collaborative forensic timeline analysis
ydkhatri/mac_apt: macOS ( and ios) Artifact Parsing Tool
Free Training Courses | Splunk
Blue Team Labs Online -- EXTRA CREDIT

Last Updated: 10-12-20