Domain 3 of 4 · Chapter 3 of 6

Using Tools to Investigate Malicious Activity

Unlock the complete study guide.

Bundled into the existing CompTIA CySA+ premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Choosing a tool by the evidence it produces
  • Packet capture and protocol analysis
  • Network metadata from Zeek
  • IDS alerts from Snort and Suricata
  • What encryption hides from network tools
  • Log analysis with a SIEM
  • Endpoint security tools
  • User and entity behavior analytics
  • Static file triage
  • Sandboxing
  • Matching files against known detections
  • External context lookups: reputation, WHOIS and GEO-IP
  • Threat-intelligence platforms
  • Email analysis
  • Submitting artifacts to external services
  • Decoding and parsing
  • Regular expressions
  • Reading structured file formats
  • Interpreting scripts and suspicious commands
  • Exam patterns: matching the scenario to the tool

Investigation tools by evidence family: what each records, when to reach for it, and what it cannot show

Evidence familyToolsWhat it recordsReach for it whenWhat it cannot show
Network traffictcpdump, Wireshark, Zeek, Snort, SuricataPacket captures, network metadata, IDS alertsThe question is what crossed the network, and between whomEncrypted payloads without decryption, or traffic outside the sensor's view
Host and logSIEM, EDR, XDR, MDM, UEBACorrelated events, host process telemetry, device management records, behavior anomaliesThe question is who or what acted on a system, across one or many systemsSources that are not collected or integrated; intent behind an anomaly
FileStrings, YARA, VirusTotal, Joe Sandbox, Cuckoo SandboxFile structure and strings, rule matches, scanner verdicts, sandbox behaviorThe question is what a suspicious file is or doesBehavior the sandbox never triggered; proof that a match means identical files
External contextWHOIS, GEO-IP, OTX, MISP, OpenCTIReputation, registration records, location estimates, shared intelligenceThe question is what outsiders know about an address, domain, file or senderWhat happened inside your environment, for externally sourced records
Artifact readingCyberChef, regular expressions, JSON, XML, YAML, EVTX, Python, PowerShell, shell scriptDecoded values, pattern matches, structured fields, script data flowThe evidence is an encoded string, a structured file or a supplied scriptWhether an extracted value is valid or malicious without further checks

Decision tree

Need exactly what crossed the network?YesPacket capturedecoded in a protocol analyzer such as WiresharkNoNeed who talked to whom, at scale?YesNetwork metadatastructured logs such as Zeek producesNoNeed which process acted on a host?YesEDRhost process telemetryNoEvents spread across several systems?YesSIEMcorrelate on shared identifiersNoNeed what a file does when it runs?YesSandboxa quiet run is inconclusiveNoNeed what a file contains?YesStatic file triagestructure, metadata, strings; no executionNoAbout an address, domain or sender?YesExternal contextreputation, WHOIS, GEO-IP,threat-intelligence platformsNoEncoded string, structured fileor supplied script?YesArtifact readingdecode, parse, follow the data flowNoOther toolssee the comparison table
Cheat sheet

Cheat sheet

  • Packet analysis is appropriate when the deciding evidence is a captured exchange
  • Packet capture provides traffic evidence for later inspection
  • Network metadata supports broad investigation without replacing full packet detail
  • An IDS alert reports a detection condition that still needs investigation
  • Encrypted traffic limits what an ordinary packet capture reveals
  • Decoding and parsing tools make embedded indicators usable
  • Static file triage examines an artifact without running it
  • Sandbox analysis observes behavior in a controlled environment
  • A quiet sandbox run does not establish that a sample is harmless
  • File-pattern rules can identify related artifacts without an exact hash match
  • VirusTotal supports file triage with multiple antivirus engines
  • A SIEM supports investigation across multiple event sources
  • EDR provides host-level evidence for process-centered investigations
  • XDR extends detection and response across integrated security domains
  • UEBA highlights behavior that differs from an entity's expected activity
  • JSON fields must be interpreted within their nested structure
  • Structured configuration must be read with its hierarchy intact
  • EVTX artifacts should be parsed as event logs rather than arbitrary text
  • A script that executes retrieved content does more than download a file
  • Threat-intelligence platforms organize indicators and their relationships
  • External reputation is context rather than proof of local compromise
  • External artifact analysis can disclose the submitted information
  • A pattern match identifies candidate data rather than establishing its meaning
  • OTX is a source of external threat-intelligence feed information
  • MISP supports shared indicator repositories and correlation
  • WHOIS supplies registration context rather than a maliciousness verdict
  • GEO-IP locates an address approximately rather than verifying a person's position
  • OpenCTI brings different threat-intelligence sources into a common working environment

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-124r2.pdf
  2. https://pages.nist.gov/zero-trust-architecture/VolumeA/ProjectOverview.html
  3. https://attack.mitre.org/techniques/T1027/
  4. https://attack.mitre.org/techniques/T1059/
  5. https://attack.mitre.org/datacomponents/DC0085/
  6. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf
  7. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-94.pdf
  8. https://www.ncsc.gov.uk/files/CIR-Standard-Level-2-v1-5-April-2023.pdf
  9. https://attack.mitre.org/datacomponents/DC0011/
  10. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-83r1.pdf
  11. https://attack.mitre.org/techniques/T1497/001/
  12. https://www.cisa.gov/resources-tools/services/virustotal
  13. https://www.rfc-editor.org/rfc/rfc7485
  14. https://www.rfc-editor.org/rfc/rfc8805
  15. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-150.pdf
  16. https://www.first.org/global/sigs/information-sharing/misp
  17. https://www.enisa.europa.eu/sites/default/files/publications/ETL2020%20-%20CTI%20Overview%20A4.pdf
  18. https://www.rfc-editor.org/rfc/rfc9989
  19. https://www.rfc-editor.org/rfc/rfc5321
  20. https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
  21. https://kubernetes.io/blog/2026/08/11/how-to-pretty-print-kubernetes-yaml-as-kyaml/
  22. https://www.rfc-editor.org/rfc/rfc3470
  23. https://www.sans.org/blog/fileless-malware-get-clipboard
  24. https://attack.mitre.org/techniques/T1105/