CNIT 152: Incident Response

Spring 2024 Sam Bowne

35294 Sat 1:10 - 4:00 pm MUB 250

Schedule · Lectures · Projects

Use Twitch

To attend class:

Free Textbook Access

  • Go here
  • Click "Institution not listed"
  • Enter your CCSF email address
  • Enter the book's title the "Find a Solution..." field


Incident Response & Computer Forensics, Third Edition by by Jason Luttgens, Matthew Pepe, and Kevin Mandia
Publisher: McGraw-Hill Education; 3 edition (August 1, 2014)
Sold by: Amazon Digital Services, LLC
ASIN: B00JFG7152
Kindle edition: $36, Paper edition: $16 (prices I saw on 4-10-16 at Amazon)
Buy from Amazon ($15 - $40)

Catalog Description

When computer networks are breached, incident response (IR) is required to assess the damage, eject the attackers, and improve security measures so they cannot return. This class covers the IR tools and techniques required to defend modern corporate networks. This class is part of the Advanced Cybersecurity Certificate.


The quizzes are multiple-choice, online, and open-book. However, you may not ask other people to help you during the quizzes. You will need to study the textbook chapter before the lecture covering it, and take the quiz before that class. Each quiz is due 30 min. before class. Each quiz has 5 questions, you have ten minutes to take it, and you can make two attempts. If you take the quiz twice, the higher score counts.

Don't use CCSF's Canvas system for this class. Instead, all students should use this Canvas server:

Enroll Here · View Course · Reset password

Discussion Board

Each CCSF student must contribute to the Discussion Board in Canvas. There are dates listed in the schedule with Discussion assignment due.

For the topics and requirements, see the Discussion board in Canvas.


For questions, please send a message inside Canvas or email


Sat 1-20  1 Real-World Incidents

Sat 1-27Quizzes: Ch 1 & 2 *
Proj Splunk 1 (20 pts of BoTS) due *
Discussion 1 *
2 IR Management Handbook

Sat 2-3Quiz: Ch 3
Proj Splunk 2 (20 pts of BoTS) due
Discussion 2
3 Pre-Incident Preparation

Sat 2-10Quiz: Ch 4-5
Proj Splunk 3 (20 pts of BoTS) due
Discussion 3
4 Getting the Investigation Started on the Right Foot
5 Initial Development of Leads

Sat 2-17 Holiday: No Class

Sat 2-24Quiz: Ch 6-7
Proj Splunk 4 (20 pts of BoTS) due
Discussion 4
6 Discovering the Scope of the Incident
7 Live Data Collection (Part 1)
Demos: ATT 1, ATT 2, BoTS Part 4

Sat 3-2Quiz: Ch 8
Proj ATT 1 & 2 due
Discussion 5
7 Live Data Collection (Part 2)
8 Forensic Duplication
Demos: ATT 3-6

Sat 3-9Quiz: Ch 9
Proj ATT 3 & 4 due
Discussion 6
9 Network Evidence
Demo: IR 371

Sat 3-16Quiz: Ch 10
Proj ATT 5 & 6 due
Discussion 7
10 Enterprise Services
Demo: IR 372

Sat 3-23Quiz: Ch 11
Proj IR 100 due
Discussion 8
11 Analysis Methodology
Demo: IR 373

Sat 3-30 Demos: IR 301, 330, 303, 304

Sat 4-6Quiz: Ch 12 (Part 1)
Discussion 9
12 Investigating Windows Systems (Part 1)

Sat 4-13 Holiday: No Class

Sat 4-20Quiz: Ch 12 (Part 2)
Proj IR 371 & 372 due
Discussion 10
12 Investigating Windows Systems (Part 2)

Sat 4-27Quiz: Ch 12 (Part 3)
Proj IR 350 due
Discussion 11
12 Investigating Windows Systems (Part 3)

Sat 5-4 Class Cancelled for BSidesSF

Sat 5-11No Quiz
All Extra Credit Due
Last Class: No new material

Wed 5-15
Wed 5-22
  Final Exam available online throughout the week.
You can only take it once.

All quizzes due 30 min. before class
* No late penalty until 2-10


Grading Policy (pdf)
Syllabus (pdf)

1 Real-World Incidents · KEY · PDF
2 IR Management Handbook · KEY · PDF
3 Pre-Incident Preparation · KEY · PDF
4 Getting the Investigation Started on the Right Foot &
5 Initial Development of Leads
6 Discovering the Scope of the Incident &
7 Live Data Collection
8 Forensic Duplication · KEY · PDF
9 Network Evidence · KEY · PDF
10 Enterprise Services · KEY · PDF
11 Analysis Methodology · KEY · PDF
12 Investigating Windows Systems (Part 1 of 3) · KEY · PDF
12 Investigating Windows Systems (Part 2 of 3) · KEY · PDF
12 Investigating Windows Systems (Part 3 of 3) · KEY · PDF
13 Investigating Mac OS X Systems · KEY · PDF
14 Investigating Applications · KEY · PDF
15 Malware Triage
16 Report Writing · KEY · PDF
17 Remediation Introduction (Part 1) · KEY · PDF


Links for Chapter Lectures

Ch 1a: Deconstructing a Credit Card's Data
Ch 1b: Mitigating Fraud Risk Through Card Data Verification
Ch 1c: What data is stored on a payment card's magnetic stripe?

Ch 2a: The OpenIOC Framework

Ch 3a: Free Email Certificate | Secure SSL Certificate from Comodo
Ch 3b: Digitally Sign & Encrypt Emails
Ch 3c: 3 Alternatives to the Now-Defunct TrueCrypt for Your Encryption Needs
Ch 3d: VeraCrypt - Home
Ch 3e: Security Onion
Ch 3f: Network Security Toolkit (NST 24)
Ch 3g: Skynet Solutions : EasyIDS
Ch 3h: NIST Computer Forensic Tool Testing Program
Ch 3i: Evidence Tags and Chain of Custody Forms
Ch 3j: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations
Ch 3k: Federal Rules of Evidence
Ch 3l: Security Technical Implementation Guides (STIGs) for host hardening
Ch 3k: Securing Windows Service Accounts (Part 1)
Ch 3l: Download Splunk Enterprise for free
Ch 3m: GitHub - mcholste/elsa: Enterprise Log Search and Archive
Ch 3n: Snare SIEM Software Products
Ch 3o: SIEM, Security Information Event Management, ArcSight | Hewlett Packard Enterprise
Ch 3p: RSA enVision SIEM | EMC RSA
Ch 3q: Building a DNS Blackhole with FreeBSD
Ch 3r: Windows DNS Server Sinkhole Domains Tool | SANS Institute

Ch 5a: Report Crimes Against Children | Department of Justice

Ch 7a: Redline User Guide
Ch 7b: LINReS | Network Intelligence India Pvt. Ltd.(NII Consulting), Mumbai
Ch 7c: LiME – Linux Memory Extractor
Ch 7d: Memoryze for Mac
Ch 7e: Use the Mandiant Redline memory analysis tool for threat assessments

Ch 8a: Host protected area - Wikipedia
Ch 8b: Device configuration overlay - Wikipedia

Ch 9a: Basic Snort Rules Syntax and Usage
Ch 9b: Snort: Re: Rule for detecting ssh
Ch 9c: OptiView XG Network Analysis Tablet
Ch 9c: Network TAPs
Ch 9d: Security Onion
Ch 9e: Chapter 9 Scenario PCAPs - Incident Response and Computer Forensics, 3rd Edition
Ch 9f: Download NetWitness Investigator
Ch 9g: Old NetWitness Project

Ch 10a: Analyze Microsoft DHCP Server Log Files
Ch 10b: More About Microsoft DHCP Audit and Event Logging
Ch 10c: DHCP | Internet Systems Consortium
Ch 10d: Linux How To/Tutorial: Checking DHCP Logs
Ch 10e: using the ISC DHCP log function for debugging
Ch 10f: BIND | Internet Systems Consortium
Ch 10g: DNSCAP - DNS traffic capture utility | DNS-OARC
Ch 10h: IT Information Systems Management Software | LANDESK
Ch 10i: Parsing Landesk Registry Entries FTW
Ch 10k: LANDesk SoftMon Monitoring Information
Ch 10l: How to browse Software License Monitoring data ... |LANDESK User Community
Ch 10m: RegRipper
Ch 10n: GitHub - keydet89/RegRipper2.8
Ch 10o: GitHub - jprosco/registry-tools: Registry Forensics Tools
Ch 10p: Client Management Suite | Symantec
Ch 10q: Altiris Inventory Solution™ 7.1 SP2 from Symantec™ User Guide
Ch 10r: Symantec Quarantined VBN file decoder
Ch 10s: John McAfee calls McAfee anti-virus "one of the worst products on the ... planet"
Ch 10t: Removing a PHP Redirector
Ch 10u: Understanding IIS 7 log files - Stack Overflow

Ch 11i: Filesystem Timestamps: What Makes Them Tick?
Ch 11j: File System Forensic Analysis: Brian Carrier
Ch 11k: Uuencoding - Wikipedia
Ch 11l: National Software Reference Library
Ch 11m: Nsrllookup
Ch 11n Security Firm Bit9 Hacked, Used to Spread Malware (2013)

Other Links

Yelp/osxcollector: A forensic evidence collection & analysis toolkit for OS X
SecureZeroMemory function (Windows)
Under My Thumbs -- Revisiting Windows thumbnail databases
Using Mandiant Redline to discover Meterpreter process injection - YouTube
Elcomsoft Advanced mobile forensics: iOS (iPhone and iPad), Windows Phone and BlackBerry 10
Aid4Mail Now (Free Trial)

New Unsorted Links

osquery | Easily ask questions about your Linux, Windows, and macOS infrastructure
GitHub - Yelp/osxcollector: A forensic evidence collection & analysis toolkit for OS X
OS X Incident Response: Scripting and Analysis--RECOMMENDED
GitHub - google/grr: GRR Rapid Response: remote live forensics for incident response
KnockKnock shows you what's persistently installed on your Mac! -- RECOMMENDED
GitHub - Yelp/amira: AMIRA: Automated Malware Incident Response & Analysis
Cyphort: Anti-SIEM reduces SIEM cost, noise, complexity, and wasted time
Collect NTFS forensic information with osquery
Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk)
Kit Hunter, a phishing kit detection script -- USEFUL FOR PROJECTS
Log-MD Tool Free Version
Threat Hunting Workshop--USE FOR PROJECTS
ATT&CK Matrix - ATT&CK for Enterprise
GitHub - redcanaryco/atomic-red-team: Small and highly portable detection tests based on MITRE's ATT&CK.
Log Management & Security Analytics, Continuous Intelligence: Sumo Logic
Rekall Forensics
Public PCAP files for download
Automated Malware Analysis - Joe Sandbox
Free Automated Malware Analysis Sandboxes and Services
Free Automated Malware Analysis Service - powered by Falcon Sandbox
Try AlienVault USM for Free
Ch 9h: Snort rule for fake SSL certificate
7 Sumo Logic Competitors in Cloud-Based Log Management and Anomaly Detection
Ch 12a: Shim Cache Parser Slides
Ch 13a: Apple File System - Wikipedia
Ch 13b: The MacPorts Project -- Download & Installation
Ch 13c: macos - OS X 10.9: where are password hashes stored - Ask Different
Ch 13d: macos - What type of hash are a Mac's password stored in? - Ask Different
Ch 13e: How to crack macbook admin password
Ch 13f: How to Convert plist Files to XML or Binary in Mac OS X
Ch 13g: Collecting password hashes from Mac OS Mojave
Security Analyst Workshop--VERY GOOD TOOLS
Splunk Cheat Sheet
Available Artifacts on Windows Versions - Evidence of Execution
NIST SPECIAL PUBLICATION 1800-26 Data Integrity Detecting and Responding to Ransomware and Other Destructive Events
Awesome-incident-response: A curated list of tools for incident response
2020-10-15: Recommended Mandiant and FireEye Blogs
Splunking with Sysmon Series Part 1: The Setup | Hurricane Labs
Splunking with Sysmon
Ch 7f: Comparison of Acquisition Software for Digital Forensics Purposes
Ch 12k: A simple way to access Shadow Copies in Vista | Microsoft Docs
Plaso: Super timeline all the things
Timesketch: Collaborative forensic timeline analysis
ydkhatri/mac_apt: macOS ( and ios) Artifact Parsing Tool
Free Training Courses | Splunk
Blue Team Labs Online -- EXTRA CREDIT

Last Updated: 5-11-24 1:53 pm