Incident Detection Response and Handling

Describe the differences between the SANS and NIST IR frameworks|Recognize and identify a Phishing incident|Perform disk analysis and preserve evidence|Create a timeline of events for analysis|Protect traffic from protocol analysis|Determine status of affected resources|Build an incident response playbook|Compare endpoint detection with forensic imaging|Determine the incident root cause|Reimage workstations with proper precautions|Perform RTO within MTD|Reconstitute crucial functions|Perform password auditing|Demonstrate Windows share abuse|Establish primary and secondary incident logs|Analyze common injection attacks|Identify malicious C2 traffic|Detect log tampering|Demonstrate network scanning fundamentals|Facilitate a lessons-learned team discussion|Map contributing factors to attacker tradecraft|Clearly document findings