{"id":10575,"date":"2021-10-22T19:55:02","date_gmt":"2021-10-22T19:55:02","guid":{"rendered":"https:\/\/assignmenttutors.net\/blog\/6-pages-report-as-per-the-instructions-no-plagiarism-in-the-report\/"},"modified":"2021-10-22T19:55:02","modified_gmt":"2021-10-22T19:55:02","slug":"6-pages-report-as-per-the-instructions-no-plagiarism-in-the-report","status":"publish","type":"post","link":"https:\/\/assignmenttutors.net\/blog\/6-pages-report-as-per-the-instructions-no-plagiarism-in-the-report\/","title":{"rendered":"6 pages report as per the instructions no plagiarism in the report"},"content":{"rendered":"
\n

Incident Response Report #2<\/p>\n

This assignment is similar to the last incident response report. You will take the framework you<\/p>\n

developed for your report, with corrections that I suggested as feedback, then develop a new<\/p>\n

report for this incident. The grading rubrics will be the same, but the grading will be stricter<\/p>\n

being this is your 2nd time developing an incident response report.<\/p>\n

The incident scenario this time is that an employee was installing a new computer. They were<\/p>\n

in the process of installing software when they noticed abnormal mouse activity on the<\/p>\n

computer. At that point, they walked away from the computer and called you for help. Treat<\/p>\n

this like an incident at a corporation, although the computer is not joined to a domain.<\/p>\n

I am expecting that at a minimum you are able to tell the story of what happened during the<\/p>\n

incident. What was the initial infection vector, what happened next? Are there any persistence<\/p>\n

mechanisms in play? Are there any IP addresses associated with the attacker? And if so, what<\/p>\n

are they?<\/p>\n

Instead of a 22 page document with evidence, you will be working with evidence that has been<\/p>\n

extracted from the computer in its raw form just like an incident responder would see if they<\/p>\n

were working on the workstation. The evidence totals about 7 gigs with the memory image.<\/p>\n

Some of the evidence collected may overlap evidence that was collected in another method.<\/p>\n

Some of the included evidence is from:<\/p>\n

\u2022 Netstat<\/p>\n

\u2022 Complete directory \/ file structure listing for the entire C drive<\/p>\n

\u2022 Services<\/p>\n

\u2022 Several Kape collections \u2013 These will provide a rich set of evidence but take a little bit to<\/p>\n

get used to the way Kape provides the collected evidence<\/p>\n

\u2022 Browser information<\/p>\n

\u2022 Prefetch<\/p>\n

\u2022 Scheduled Tasks<\/p>\n

\u2022 Users<\/p>\n

\u2022 Windows Event Logs<\/p>\n

\u2022 Forensic RAM image<\/p>\n

The evidence can be downloaded from a Google Drive link I\u2019ll post on D2L.<\/p>\n

Not every piece of evidence collected will yield results. It is your job to comb through the<\/p>\n

evidence to put together the pieces of what happened to develop your report. You can<\/p>\n

successfully respond to the incident without doing the memory forensics, but it may provide<\/p>\n

some easier insights if you want to give it a shot. The memory image is around 5.4 gigs in size.<\/p>\n

I split the evidence into different folders to make it easier to download and work with if you don\u2019t<\/p>\n

have the full 7 gigs of free space on your drive.<\/p>\n

Start by forming your investigative questions, then going searching for evidence that proves<\/p>\n

your questions. Your IOCs this time will be generated based on actual evidence you find that<\/p>\n

can be used to search other computers to determine if they are in scope of the incident as well.<\/p>\n

I will be providing the VM as an optional way to investigate the incident. The VM is provided as<\/p>\n

is without any additional support from me. It is a VMWare image. Some of the evidence will still<\/p>\n

be in the VM, but it will be provided post attack after that attacker is already gone.<\/p>\n

To produce your report, analyze the evidence, then summarize and present it using the<\/p>\n

guidelines from the chapter 16 lecture, chapter 16 from the textbook, and guidance from the<\/p>\n

\u201cICS-487 incident report what to include\u201d in the sticky section of D2L.<\/p>\n

The report should be at least 5 not counting any pictures utilized and the mandatory coverpage.<\/p>\n

There will be a point penalty if the report is less than 5 pages. Do not turn in a 50-page report<\/p>\n

for this assignment. The objective is to be concise as you tell the who what when where and<\/p>\n

how story.<\/p>\n

As previously stated, the raw evidence for this report has already been collected for you. You<\/p>\n

will need to comb through it to find useful artifacts to fill in the pieces for the report. This<\/p>\n

means making up a company that was hacked, the name of your company that is responding,<\/p>\n

etc. Basic remediation steps will also need to be described as partof this assignment. For the<\/p>\n

lessons learned section, describe in a paragraph or two items that you learned about incident<\/p>\n

response that you will apply to future investigations based on theevidence that was<\/p>\n

provided to you this time.<\/p>\n

You should list 5 Indicators of Compromise that you gleaned from the evidence that are worth<\/p>\n

searching for enterprise wide to make sure no other systems are infected. These will be best<\/p>\n

displayed in a table for the IOC section. These IOCs will be developed when you find<\/p>\n

artifacts related to the investigation. A timeline should also be put into the report like last<\/p>\n

time.<\/p>\n

You will also need to develop 10 investigative questions that you would ask during the course of<\/p>\n

this investigation.<\/p>\n

Keep in mind that for this project this evidence is manually collected from a single computer.<\/p>\n

This is a normal amount of evidence one would collect in the course of Incident Response. This<\/p>\n

is why we are teaching the method of developing investigative leads, turning those leads into<\/p>\n

IOCs, then searching for those IOCs. This type of manual collection does not scale across more<\/p>\n

than one or two systems in an incident. The next Incident Response report will involve you<\/p>\n

collecting the evidence, and then reporting on that evidence you collect.<\/p>\n

Make sure you start this assignment early. This is a 400-level class and will require some critical<\/p>\n

thought to complete this assignment along with utilizing the skills that have been taught up to<\/p>\n

this point. A quality report will take time to produce especially when it comes to selecting<\/p>\n

which pieces of evidence to use that will tell the story but not provide unnecessary detail.<\/p>\n

Also keep in mind the responses I provided to your previous report.<\/p>\n

A common mistake is making the executive summary and findings section too<\/p>\n

technical. This should be written in language that an 80 year old grandma who doesn\u2019t<\/p>\n

have an IT background can understand.<\/p>\n

Because this is an academic environment, anytime you use someone else\u2019s ideas you must cite<\/p>\n

it in IEEE format. It is assumed that most of your content will be coming from the provided<\/p>\n

evidence document. You don\u2019t have to cite general information you take from that document.<\/p>\n

Make sure that you are re-telling the story. It is ok to use a sentence or two once in a while.<\/p>\n

Do not just copy an entire paragraph from the evidence document and turn that in as your<\/p>\n

work.<\/p>\n

Grading Rubric<\/p>\n

Requirement Possible<\/p>\n

Score<\/p>\n

Coversheet meets specifications including affected organization, incident number<\/p>\n

or name, date published, name of the organization that performed the<\/p>\n

investigation, and “Privileged and Confidential”<\/p>\n

2<\/p>\n

Table of contents 2<\/p>\n

Report is at least 5 pages long not including cover sheet and any pictures used as<\/p>\n

part of the report 3<\/p>\n

Good grammar, style, and use of IEEE citations if applicable 10<\/p>\n

Formatted according to specifications and style suggestions in Chapter 16 and<\/p>\n

reporting lecture 10<\/p>\n

10 quality investigative questions based on evidence provided 10<\/p>\n

5 Indicators of Compromise based on evidence provided 5<\/p>\n

1 – 2 paragraphs of lessons learned describing items that you learned from this<\/p>\n

investigation that you will apply to future investigations 7<\/p>\n

Remediation describes exact steps taken to expel malicious actors from the<\/p>\n

network 5<\/p>\n

Who what where when why is told to the best of the author’s ability with the<\/p>\n

evidence provided throughout the documents without making the reader piece<\/p>\n

any parts of the puzzle together<\/p>\n

8<\/p>\n

Executive summary containing how the incident was discovered, the type of<\/p>\n

incident this is what the response was, the goal of the investigation, duration of<\/p>\n

the work, start and stop date, and who sponsored the work<\/p>\n

10<\/p>\n

Findings section addresses the goals of the investigation by summarizing the<\/p>\n

information found in the investigative questions, systems involved, IOC, evidence<\/p>\n

collected and remediation sections in a manner that is written with nontechnical<\/p>\n

executives in mind. No more than a page long.<\/p>\n

5<\/p>\n

Systems involved are described and information that is known based on the<\/p>\n

limited evidence provided is recorded.<\/p>\n

3<\/p>\n

Evidence collected section contains detailed account of the evidence that was<\/p>\n

utilized for the report, how it was collected, what facts it is providing to back up<\/p>\n

the rest of the report. Any procedures have to be documented in such a way that<\/p>\n

a third party could replicate the results of the analysis. You may have to do a little<\/p>\n

googling here to come up with any missing parts of the analysis and collection.<\/p>\n

15<\/p>\n

Recommendations section describes fixing the holes that caused this incident and<\/p>\n

any larger suggestions for the company as a whole to improve their overall<\/p>\n

security posture<\/p>\n

5<\/p>\n

This report has a total of 25 grading points available. Each individual item will be scored as a<\/p>\n

percentage adding to a total of 100% for the assignment. Your total percentage will be what<\/p>\n

percent of the 25 points you get on the assignment. For example, I produce a report that<\/p>\n

scores a total of 85 of the 100 available percentage points. 85% of 25 is 21.25 so I will get 21.25<\/p>\n

points on the assignment.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Incident Response Report #2 This assignment is similar to the last incident response report. You will take the framework you developed for your report, with corrections that I suggested as feedback, then develop a new report for this incident. The grading rubrics will be the same, but the grading will be stricter being this is […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-10575","post","type-post","status-publish","format-standard","hentry","category-homework-help"],"_links":{"self":[{"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/posts\/10575","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/comments?post=10575"}],"version-history":[{"count":0,"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/posts\/10575\/revisions"}],"wp:attachment":[{"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/media?parent=10575"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/categories?post=10575"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/tags?post=10575"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}