فهرست مطالب

• Cover
• Title Page
• Copyright
• Contributors
• Table of Contents
• Preface
• Part 1: Foundations of Incident Response and Digital Forensics
• Chapter 1: Understanding Incident Response
• The IR process
• The IR framework
• The IR plan
• The IR playbook/handbook
• Testing the IR framework
• Summary
• Questions
• Further reading
• Chapter 2: Managing Cyber Incidents
• Engaging the incident response team
• SOAR
• Incorporating crisis communications
• Incorporating containment strategies
• Getting back to normal – eradication, recovery, and post-incident activity
• Summary
• Questions
• Further reading
• Chapter 3: Fundamentals of Digital Forensics
• An overview of forensic science
• Locard’s exchange principle
• Legal issues in digital forensics
• Forensic procedures in incident response
• Summary
• Questions
• Further reading
• Chapter 4: Investigation Methodology
• An intrusion analysis case study: The Cuckoo’s Egg
• Types of incident investigation analysis
• Functional digital forensic investigation methodology
• The cyber kill chain
• The diamond model of intrusion analysis
• Summary
• Questions
• Part 2: Evidence Acquisition
• Chapter 5: Collecting Network Evidence
• An overview of network evidence
• Firewalls and proxy logs
• NetFlow
• Packet capture
• Wireshark
• Evidence collection
• Summary
• Questions
• Further reading
• Chapter 6: Acquiring Host-Based Evidence
• Preparation
• Order of volatility
• Evidence acquisition
• Acquiring volatile memory
• Acquiring non-volatile evidence
• Summary
• Questions
• Further reading
• Chapter 7: Remote Evidence Collection
• Enterprise incident response challenges
• Endpoint detection and response
• Velociraptor overview and deployment
• Velociraptor scenarios
• Summary
• Questions
• Chapter 8: Forensic Imaging
• Understanding forensic imaging
• Tools for imaging
• Preparing a staging drive
• Using write blockers
• Imaging techniques
• Summary
• Questions
• Further reading
• Part 3: Evidence Analysis
• Chapter 9: Analyzing Network Evidence
• Network evidence overview
• Analyzing firewall and proxy logs
• Analyzing NetFlow
• Analyzing packet captures
• Summary
• Questions
• Further reading
• Chapter 10: Analyzing System Memory
• Memory analysis overview
• Memory analysis methodology
• Memory analysis tools
• Memory analysis with Strings
• Summary
• Questions
• Further reading
• Chapter 11: Analyzing System Storage
• Forensic platforms
• Autopsy
• Master File Table analysis
• Prefetch analysis
• Registry analysis
• Summary
• Questions
• Further reading
• Chapter 12: Analyzing Log Files
• Logs and log management
• Working with SIEMs
• Windows Logs
• Analyzing Windows Event Logs
• Summary
• Questions
• Further reading
• Chapter 13: Writing the Incident Report
• Documentation overview
• Executive summary
• Incident investigation report
• Forensic report
• Preparing the incident and forensic report
• Summary
• Questions
• Further reading
• Part 4: Ransomware Incident Response
• Chapter 14: Ransomware Preparation and Response
• History of ransomware
• Conti ransomware case study
• Proper ransomware preparation
• Eradication and recovery
• Summary
• Questions
• Further reading
• Chapter 15: Ransomware Investigations
• Ransomware initial access and execution
• Discovering credential access and theft
• Investigating post-exploitation frameworks
• Command and Control
• Investigating lateral movement techniques
• Summary
• Questions
• Further reading
• Part 5: Threat Intelligence and Hunting
• Chapter 16: Malware Analysis for Incident Response
• Malware analysis overview
• Setting up a malware sandbox
• Static analysis
• Dynamic analysis
• ClamAV
• YARA
• Summary
• Questions
• Further reading
• Chapter 17: Leveraging Threat Intelligence
• Threat intelligence overview
• Sourcing threat intelligence
• The MITRE ATT&CK framework
• Working with IOCs and IOAs
• Threat intelligence and incident response
• Summary
• Questions
• Further reading
• Chapter 18: Threat Hunting
• Threat hunting overview
• Crafting a hypothesis
• Planning a hunt
• Digital forensic techniques for threat hunting
• EDR for threat hunting
• Summary
• Questions
• Further reading
• Appendix
• Assessments
• Index
• About Packt
• Other Books You May Enjoy