CNIT 152: Incident Response

Summer 2018 Sam Bowne

Lectures · Projects · Links ·

New Scores

Archived Scores from WCIL May, 2018


Incident Response & Computer Forensics, Third Edition by by Jason Luttgens, Matthew Pepe, and Kevin Mandia
Publisher: McGraw-Hill Education; 3 edition (August 1, 2014)
Sold by: Amazon Digital Services, LLC
ASIN: B00JFG7152
Kindle edition: $36, Paper edition: $16 (prices I saw on 4-10-16 at Amazon)
Buy from Amazon ($15 - $40)

Catalog Description

When computer networks are breached, incident response (IR) is required to assess the damage, eject the attackers, and improve security measures so they cannot return. This class covers the IR tools and techniques required to defend modern corporate networks. This class is part of the Advanced Cybersecurity Certificate.


Download VMware Player

1: Preparing a Kali Virtual Machine (15 pts.)
2: Windows 2016 Server Virtual Machine (20 Points)
3: Capturing a RAM Image (15 Points)
4: Analyzing a RAM Image with Bulk Extractor (40 Points)
5: Analyzing a RAM Image with Volatility (15 Points)
6: Data Carving with Foremost (15 Points)
7: Capturing and Examining the Registry (15 pts.)
8: Photorec (10 Points)
9: Rebuilding an Image Header (10 Points)
10: Identifying File Types (25 pts)


1 Real-World Incidents · KEY · PDF
2 IR Management Handbook · KEY · PDF
6 Discovering the Scope of the Incident &
7 Live Data Collection
8 Forensic Duplication · KEY · PDF

Click a lecture name to see it on SlideShare.
If you want to use other formats, you may find this useful: Cloud Convert.

Additional Lectures

Student Agreement
3 Pre-Incident Preparation · KEY · PDF
4 Getting the Investigation Started on the Right Foot &
5 Initial Development of Leads
9 Network Evidence · KEY · PDF
10 Enterprise Services · KEY · PDF
11 Analysis Methodology · KEY · PDF
12 Investigating Windows Systems (Part 1 of 3) · KEY · PDF
12 Investigating Windows Systems (Part 2 of 3) · KEY · PDF
12 Investigating Windows Systems (Part 3 of 3) · KEY · PDF
13 Investigating Mac OS X Systems · KEY · PDF
14 Investigating Applications · KEY · PDF
15 Malware Triage
16 Report Writing · KEY · PDF
17 Remediation Introduction (Part 1) · KEY · PDF
18 Remediation Case Study

Click a lecture name to see it on SlideShare.
If you want to use other formats, you may find this useful: Cloud Convert.

Additional Projects

Downloading the Old Virtual Machines

Project 5: Prefetch (10 pts.)
Project 8: NTFS Data Runs (25 pts.) (Rev. 10-5-16)
      FILE1.TXT       FILE2.TXT
Project 9: Fixing the Partition Table with TestDisk (20 pts.)
Project 10: Static Acquisition with DEFT (20 Points) (rev. 1-26-15)
Project 14: Acquiring a Forensic Image of an Android Phone (25 pts.) (rev. 11-9-16)
Project 15: Live Response with Mandiant Redline (15 pts.)
Project 18: Shadow Copies and CCleaner (20 pts.) (Rev. 11-22-16)

      How to Increase the VMWare Boot Screen Delay

Extra Credit Projects

Project X2: Static Image (15 pts. extra credit)      Proj X2 Evidence File
Project X3: National Software Reference Library (10 pts.) (Updated 11-16-16)
Project X4: Acquiring an iPad image with iTunes (15 pts.) (rev. 5-6-15)
Project X5: Sleuthkit and Autopsy (15 pts. extra credit) (rev. 10-13-16)
Project X6: Analyzing an iTunes Backup with
     Magnet Forensics' Internet Evidence Finder (15 pts.) (rev. 11-29-16)

Project X7: Procdump (10 pts.)
Project X8: Thumbcache (10 pts.)

Independent Projects (points vary)


Links for Chapter Lectures

Ch 1a: Deconstructing a Credit Card's Data
Ch 1b: Mitigating Fraud Risk Through Card Data Verification
Ch 1c: What data is stored on a payment card's magnetic stripe?

Ch 2a: The OpenIOC Framework

Ch 3a: Free Email Certificate | Secure SSL Certificate from Comodo
Ch 3b: Digitally Sign & Encrypt Emails
Ch 3c: 3 Alternatives to the Now-Defunct TrueCrypt for Your Encryption Needs
Ch 3d: VeraCrypt - Home
Ch 3e: Security Onion
Ch 3f: Network Security Toolkit (NST 24)
Ch 3g: Skynet Solutions : EasyIDS
Ch 3h: NIST Computer Forensic Tool Testing Program
Ch 3i: Evidence Tags and Chain of Custody Forms
Ch 3j: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations
Ch 3k: Federal Rules of Evidence
Ch 3l: Security Technical Implementation Guides (STIGs) for host hardening
Ch 3k: Securing Windows Service Accounts (Part 1)
Ch 3l: Download Splunk Enterprise for free
Ch 3m: GitHub - mcholste/elsa: Enterprise Log Search and Archive
Ch 3n: Snare SIEM Software Products
Ch 3o: SIEM, Security Information Event Management, ArcSight | Hewlett Packard Enterprise
Ch 3p: RSA enVision SIEM | EMC RSA
Ch 3q: Building a DNS Blackhole with FreeBSD
Ch 3r: Windows DNS Server Sinkhole Domains Tool | SANS Institute

Ch 5a: Report Crimes Against Children | Department of Justice

Ch 7a: Redline User Guide
Ch 7b: LINReS | Network Intelligence India Pvt. Ltd.(NII Consulting), Mumbai
Ch 7c: LiME – Linux Memory Extractor
Ch 7d: Memoryze for Mac
Ch 7e: Use the Mandiant Redline memory analysis tool for threat assessments

Ch 8a: Host protected area - Wikipedia
Ch 8b: Device configuration overlay - Wikipedia

Ch 9a: Basic Snort Rules Syntax and Usage
Ch 9b: Snort: Re: Rule for detecting ssh
Ch 9c: OptiView XG Network Analysis Tablet
Ch 9c: Network TAPs
Ch 9d: Security Onion
Ch 9e: Chapter 9 Scenario PCAPs - Incident Response and Computer Forensics, 3rd Edition
Ch 9f: Download NetWitness Investigator
Ch 9g: Old NetWitness Project

Ch 10a: Analyze Microsoft DHCP Server Log Files
Ch 10b: More About Microsoft DHCP Audit and Event Logging
Ch 10c: DHCP | Internet Systems Consortium
Ch 10d: Linux How To/Tutorial: Checking DHCP Logs
Ch 10e: using the ISC DHCP log function for debugging
Ch 10f: BIND | Internet Systems Consortium
Ch 10g: DNSCAP - DNS traffic capture utility | DNS-OARC
Ch 10h: IT Information Systems Management Software | LANDESK
Ch 10i: Parsing Landesk Registry Entries FTW
Ch 10k: LANDesk SoftMon Monitoring Information
Ch 10l: How to browse Software License Monitoring data ... |LANDESK User Community
Ch 10m: RegRipper
Ch 10n: GitHub - keydet89/RegRipper2.8
Ch 10o: GitHub - jprosco/registry-tools: Registry Forensics Tools
Ch 10p: Client Management Suite | Symantec
Ch 10q: Altiris Inventory Solution™ 7.1 SP2 from Symantec™ User Guide
Ch 10r: Symantec Quarantined VBN file decoder
Ch 10s: John McAfee calls McAfee anti-virus "one of the worst products on the ... planet"
Ch 10t: Removing a PHP Redirector
Ch 10u: Understanding IIS 7 log files - Stack Overflow

Ch 11i: Filesystem Timestamps: What Makes Them Tick?
Ch 11j: File System Forensic Analysis: Brian Carrier
Ch 11k: Uuencoding - Wikipedia
Ch 11l: National Software Reference Library
Ch 11m: Nsrllookup
Ch 11n Security Firm Bit9 Hacked, Used to Spread Malware (2013)

Other Links

Yelp/osxcollector: A forensic evidence collection & analysis toolkit for OS X
SecureZeroMemory function (Windows)
Under My Thumbs -- Revisiting Windows thumbnail databases
Using Mandiant Redline to discover Meterpreter process injection - YouTube
Elcomsoft Advanced mobile forensics: iOS (iPhone and iPad), Windows Phone and BlackBerry 10
Aid4Mail Now (Free Trial)

New Unsorted Links

osquery | Easily ask questions about your Linux, Windows, and macOS infrastructure
GitHub - Yelp/osxcollector: A forensic evidence collection & analysis toolkit for OS X
OS X Incident Response: Scripting and Analysis--RECOMMENDED
GitHub - google/grr: GRR Rapid Response: remote live forensics for incident response
KnockKnock shows you what's persistently installed on your Mac! -- RECOMMENDED
GitHub - Yelp/amira: AMIRA: Automated Malware Incident Response & Analysis
Cyphort: Anti-SIEM reduces SIEM cost, noise, complexity, and wasted time
Collect NTFS forensic information with osquery
Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk)
Kit Hunter, a phishing kit detection script -- USEFUL FOR PROJECTS
Log-MD Tool Free Version
Threat Hunting Workshop--USE FOR PROJECTS
ATT&CK Matrix - ATT&CK for Enterprise
GitHub - redcanaryco/atomic-red-team: Small and highly portable detection tests based on MITRE's ATT&CK.
Log Management & Security Analytics, Continuous Intelligence: Sumo Logic
Rekall Forensics
Public PCAP files for download
Automated Malware Analysis - Joe Sandbox
Free Automated Malware Analysis Sandboxes and Services
Free Automated Malware Analysis Service - powered by Falcon Sandbox
Try AlienVault USM for Free
Ch 9h: Snort rule for fake SSL certificate
7 Sumo Logic Competitors in Cloud-Based Log Management and Anomaly Detection
Ch 12a: Shim Cache Parser Slides
Ch 13a: Apple File System - Wikipedia
Ch 13b: The MacPorts Project -- Download & Installation
Ch 13c: macos - OS X 10.9: where are password hashes stored - Ask Different
Ch 13d: macos - What type of hash are a Mac's password stored in? - Ask Different
Ch 13e: How to crack macbook admin password
Ch 13f: How to Convert plist Files to XML or Binary in Mac OS X
Ch 13g: Collecting password hashes from Mac OS Mojave
Security Analyst Workshop--VERY GOOD TOOLS
Splunk Cheat Sheet
Available Artifacts on Windows Versions - Evidence of Execution
NIST SPECIAL PUBLICATION 1800-26 Data Integrity Detecting and Responding to Ransomware and Other Destructive Events
Awesome-incident-response: A curated list of tools for incident response
2020-10-15: Recommended Mandiant and FireEye Blogs
Splunking with Sysmon Series Part 1: The Setup | Hurricane Labs
Splunking with Sysmon
Ch 7f: Comparison of Acquisition Software for Digital Forensics Purposes
Ch 12k: A simple way to access Shadow Copies in Vista | Microsoft Docs
Plaso: Super timeline all the things
Timesketch: Collaborative forensic timeline analysis
ydkhatri/mac_apt: macOS ( and ios) Artifact Parsing Tool
Free Training Courses | Splunk
Blue Team Labs Online -- EXTRA CREDIT

Last Updated: 5-22-18 8 am