Table Description automatically generated

The analyst is in the detection and analysis phase of the incident response process according to NIST SP800-61. In this phase, events are detected and analyzed to determine whether they constitute incidents that require a response. It involves monitoring security events or data collection, correlation, and analysis of log entries and network flow data, among others. The goal is to identify incidents quickly so that appropriate actions can be taken. References := NIST SP800-61, Computer Security Incident Handling Guide, Section 3.2: Detection and Analysis

Port scanning is a technique that an attacker uses to discover which network ports are open, closed, or filtered on a target device. By sending packets to different ports and observing the responses, an attacker can identify the services and applications running on the device, as well as potential vulnerabilities that can be exploited. Port scanning is a common reconnaissance activity that precedes an attack. References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 2-6; 200-201 CBROPS - Cisco, exam topic 1.1.a

Traffic with a known TOR exit node is often associated with data exfiltration, where sensitive information is transferred from within the network to an external location. TOR networks are used to anonymize the traffic, making it difficult to trace back to the source. References := Cisco Cybersecurity Operations Fundamentals - Module 2: Security Monitoring

 During the negotiation phase of the TLS handshake, the client sends a “ClientHello” message to the server which includes information about TLS versions it supports, cipher-suites it supports and suggested compression methods. This initiates communication protocols for secure connection. References := Cisco Cybersecurity source documents or study guide

 Full packet capture provides the complete recording of all the packets that are transmitted over the network. This data is essential for in-depth analysis during an investigation, as it allows investigators to reconstruct the session, observe the content of the traffic, and determine if data exfiltration has occurred.

Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) study materials would typically cover the importance of full packet capture in network forensics and incident response.

 Event Code 4625 in Windows logs indicates a failed logon attempt. This could be a sign of someone trying to guess the credentials of a valid user account by repeatedly trying different passwords or usernames. This is known as a brute force attack and can be used to gain unauthorized access to a system or network. References: https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01110.html

A command and control server (C2 or C & C) is a server that is used by attackers to communicate with and control compromised systems, such as bots, zombies, or backdoors. The C2 server can send instructions to the compromised systems, such as executing commands, downloading files, uploading data, or launching attacks. The C2 server can alsoreceive information from the compromised systems, such as system information, keystrokes, screenshots, or credentials. References:

Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 3: Network Intrusion Analysis, Lesson 3.4: Malware

Cisco Certified CyberOps Associate Overview, Exam Topics, 3.4 Compare and contrast types of malware