Description

This curriculum spans the design and execution of compromise assessments with the granularity of a multi-phase advisory engagement, covering scoping, detection engineering, investigation, and governance across hybrid environments.

Module 1: Defining the Scope and Objectives of Compromise Assessment

Determine whether the compromise assessment will focus on specific threat vectors (e.g., credential theft, lateral movement) or adopt a broad-spectrum approach.
Select assessment boundaries based on critical assets, user populations, and network segments, balancing depth with operational disruption.
Decide whether to include cloud environments, third-party systems, or only on-premises infrastructure in the assessment scope.
Establish clear success criteria for identifying active threats versus historical indicators of compromise.
Coordinate with legal and compliance teams to define data handling protocols for sensitive forensic artifacts.
Choose between point-in-time assessments versus continuous monitoring models based on organizational risk tolerance.
Define stakeholder reporting requirements, including technical detail levels for IT teams versus executive summaries for leadership.
Assess whether to conduct the assessment internally, with existing tools, or engage external specialists for impartiality and expertise.

Module 2: Integrating Threat Intelligence into Assessment Design

Select threat intelligence feeds based on relevance to industry-specific adversaries (e.g., FIN8 for financial services, APT41 for tech).
Map known adversary TTPs (MITRE ATT&CK) to existing detection capabilities to identify coverage gaps.
Decide when to prioritize IOCs from recent breaches over long-term behavioral patterns in intelligence analysis.
Implement automated ingestion of STIX/TAXII feeds while validating signal accuracy to reduce false positives.
Balance reliance on open-source intelligence (OSINT) with proprietary intelligence sources based on budget and threat landscape.
Establish processes for updating detection rules when new threat intelligence contradicts existing assumptions.
Integrate threat actor attribution cautiously, ensuring conclusions support actionable decisions rather than speculation.
Validate intelligence applicability across hybrid environments where endpoint visibility varies.

Module 4: Endpoint and Network Data Collection Strategies

Configure EDR agents to collect process execution, network connections, and registry changes without degrading system performance.
Decide which network segments require full packet capture versus flow data (NetFlow, IPFIX) based on risk and storage constraints.
Implement selective memory dumps on high-risk systems while managing impact on availability and response time.
Establish data retention policies for forensic artifacts that comply with legal requirements and investigative needs.
Address gaps in visibility for BYOD or contractor devices by defining acceptable monitoring boundaries.
Use network taps or SPAN ports strategically to avoid blind spots in encrypted traffic analysis.
Coordinate data collection timing to minimize interference with business-critical operations or batch processing.
Validate data integrity and chain-of-custody procedures for potential legal or audit use.

Module 5: Detection Engineering for Compromise Indicators

Develop YARA rules to detect malware artifacts in memory and file systems based on observed adversary tooling.
Write Sigma rules for SIEM platforms to identify suspicious PowerShell or WMI usage patterns.
Adjust detection thresholds for lateral movement alerts to reduce noise while maintaining sensitivity to real threats.
Implement anomaly baselines for user and entity behavior analytics (UEBA) using historical login and access data.
Design correlation rules that link endpoint process creation with DNS tunneling patterns.
Test detection logic in staging environments to prevent performance degradation in production.
Document false positive rates for each detection rule to inform tuning and escalation protocols.
Integrate custom scripts to parse unstructured logs (e.g., application logs) for hidden compromise signals.

Module 6: Investigating Active and Dormant Threats

Triaging alerts based on potential impact, such as domain admin compromise versus low-privilege account anomalies.
Use memory analysis tools like Volatility to detect process hollowing or reflective DLL injection.
Trace lateral movement paths by correlating authentication logs across domain controllers and workstations.
Determine whether detected persistence mechanisms (e.g., scheduled tasks, WMI event filters) are legitimate or malicious.
Assess the risk of triggering attacker countermeasures (e.g., data destruction) during active investigation.
Reconstruct attacker timelines using file timestamps, prefetch data, and PowerShell transcript logs.
Validate whether dormant backdoors are still operational by analyzing beaconing behavior over time.
Decide when to isolate systems versus allowing controlled observation to gather more intelligence.

Module 7: Managing False Positives and Operational Overhead

Implement feedback loops from SOC analysts to refine detection rules based on real-world alert fatigue.
Classify false positives by root cause (e.g., legitimate admin tools, misconfigured rules) to prioritize fixes.
Adjust detection logic for environments with high rates of authorized privileged activity (e.g., DevOps).
Use machine learning models cautiously, ensuring they do not obscure root causes of alerts.
Document known benign behaviors in a whitelist to reduce repeated false alarms.
Allocate investigation time based on risk scoring rather than alert volume to maintain focus.
Balance automation of triage tasks with the need for human judgment in ambiguous cases.
Measure mean time to acknowledge and resolve false positives to assess process efficiency.

Module 8: Coordinating Response and Escalation Protocols

Define thresholds for immediate containment (e.g., ransomware execution) versus forensic preservation.
Activate incident response playbooks only after validating compromise to avoid unnecessary disruption.
Coordinate with network operations to implement temporary blocks without affecting critical services.
Escalate findings to executive leadership when business continuity or regulatory compliance is at risk.
Engage legal counsel before taking actions that may affect evidence admissibility.
Notify external parties (e.g., law enforcement, regulators) based on breach severity and jurisdictional requirements.
Document all response actions taken during the assessment for post-incident review and audit.
Deconflict actions between internal teams and third-party responders to prevent duplication or interference.

Module 9: Post-Assessment Remediation and Capability Gaps

Rank remediation tasks by exploitability, asset criticality, and likelihood of recurrence.
Update firewall rules to block C2 infrastructure identified during the assessment.
Enforce credential rotation for accounts associated with suspicious authentication events.
Deploy host-based controls to disable or monitor high-risk tools (e.g., PsExec, Mimikatz).
Revise endpoint detection rules to close identified visibility gaps in privilege escalation paths.
Implement network segmentation to limit lateral movement in previously flat architectures.
Conduct tabletop exercises to test improvements in detection and response workflows.
Update asset inventory systems to include previously unmanaged devices discovered during the assessment.

Module 10: Governance and Continuous Improvement Frameworks

Establish a review cadence for compromise assessment findings with the cybersecurity steering committee.
Integrate assessment outcomes into the organization’s risk register with updated threat likelihood and impact scores.
Measure improvement in mean time to detect (MTTD) and mean time to respond (MTTR) after each assessment cycle.
Require periodic revalidation of detection rules to ensure alignment with evolving infrastructure.
Assign ownership for remediation tasks and track completion through GRC platforms.
Update third-party risk assessments based on compromise findings related to vendor access.
Conduct peer reviews of assessment methodologies to reduce bias and improve rigor.
Align compromise assessment frequency with changes in business operations, such as M&A activity or cloud migration.