Use analysis tools to evaluate suspicious evidence

Correlation joins events only after normalizing time, identity, and field meaning. Preserve original timestamps, time zones, event IDs, and raw records. A shared IP can represent NAT, a shared account can represent automation, and a hostname can be reassigned, so correlation keys should match the question being asked.

Clock skew changes apparent order. Compare authoritative time sources or known request identifiers before concluding causality. Aggregation is useful for pattern detection, but retain the events behind a count so an analyst can inspect failures, successes, and collection gaps.

Packet capture shows what crossed a collection point: addresses, ports, flags, timing, sizes, and any visible protocol fields. It does not reveal activity that never reached that point or decrypted content it cannot see. Host process records can connect a socket to an executable and user but may omit traffic details.

Use the narrowest tool that can resolve the unknown. A connection-state table answers whether a host has a live session; DNS logs answer name resolution; process telemetry answers program ancestry; a capture answers retransmission or protocol sequence. Collecting everything can delay containment and increase sensitive-data exposure.

Decoding changes representation, not trust. Preserve the original value, record each transformation, and validate whether the output is text, binary, compressed, or another encoding. JSON, XML, YAML, and EVTX carry structure differently; flattening them too early can discard types, namespaces, nesting, event IDs, or provenance.

A regex finds text patterns and can produce false matches. Command analysis needs the interpreter, escaping rules, decoded arguments, parent, user, and host. Defensive scripts should default to read-only inputs, bounded files, explicit encodings, predictable error handling, and a reviewable output record before any response action is considered.

Wireshark and tcpdump capture or inspect packets at an observation point. Snort and Suricata evaluate traffic against rules and can produce alerts; deployment mode determines whether they only detect or also block. Zeek commonly creates protocol-oriented logs and supports network-security monitoring. None sees traffic that misses its sensor or plaintext hidden by encryption.

A SIEM centralizes and searches records, but normalization can merge unlike meanings and ingestion can be delayed. Keep the raw timestamp, normalized timestamp, source, sensor placement, query, exclusions, and retention window. Correlate on identifiers supported by the protocol or application rather than proximity alone.

OTX, MISP, and OpenCTI can distribute indicators and relationships, but a platform name does not confer truth. Retain producer, collection time, markings, confidence, relationship direction, and local sightings. Shared infrastructure and recycled addresses require local corroboration before blocking or attribution.

WHOIS or RDAP describes registration records, AbuseIPDB aggregates reports, and Geo-IP estimates location. Privacy services, cloud hosting, carrier NAT, reassignment, VPNs, and stale databases limit inference. Query time matters: an address's present owner or location may differ from the incident window.

EDR observes and can respond on endpoints, XDR correlates across multiple security domains, and MDM manages device posture; their coverage and authority differ. Strings reveal readable content, VirusTotal-style services provide multi-source reputation, and YARA matches defined byte/text conditions. A sandbox observes one sample in one environment, so environment-aware malware can behave differently.

Static analysis preserves a file hash, strings, metadata, and exact YARA rule and condition so another analyst can reproduce the lead without executing the sample. Joe Sandbox or Cuckoo-style dynamic analysis also needs the image, network mode, duration, inputs, observed process/file/network behavior, and cleanup record. A quiet run is bounded negative evidence, not proof that the file is safe.

Mail-analysis services can validate DNS, sending infrastructure, and authentication configuration, but a display name or one lookup cannot authenticate a message. Preserve full headers and compare relay order, envelope identities, SPF/DKIM/DMARC results, and the expected business workflow before concluding spoofing or compromise.

UEBA compares an entity with its own history, peers, or a learned population. The model features and time window matter: shared accounts, sparse history, job changes, and seasonal work can create deviations. Treat a score as a triage lead, then corroborate it with identity, endpoint, and resource evidence before tuning or response.

CyberChef: Read the recipe from top to bottom and compare Input with Output. 'From Base64' is a reversible decoding operation; it supplies neither a key nor an authenticity check. Wireshark: The display filter retains initial SYN packets and excludes SYN-ACK packets. Clear the filter or follow the TCP stream before deciding that replies are absent from the capture. tcpdump: Flags [S] is an initial TCP SYN. The footer's 'dropped by kernel' count describes capture loss, not packets blocked by a firewall. Snort: The bracketed values are generator ID, signature ID, and revision; the classification labels the rule. An alert line does not say that inline blocking occurred.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.

Suricata: In EVE JSON, event_type says this is an alert and alert.action records the enforcement result. action=allowed means the matching flow was not blocked by this event. Zeek: conn_state summarizes the TCP exchange Zeek saw: S0 is a connection attempt with no reply, REJ is an attempt that was rejected, and SF is normal establishment and termination. A retransmitted SYN gives an S0 row a duration of seconds. orig_bytes and resp_bytes count payload bytes in each direction and say nothing about maliciousness. SIEM: Treat the rule window, event count, and entities as a correlation summary. Open the six underlying events before attributing the successful sign-in. OTX: pulses counts community collections containing the indicator; validation and modified carry different meanings. Neither field counts attacks against this organization.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.

MISP: to_ids marks an attribute as suitable for detection-system export; it does not deploy a block. Correlations are linked attributes/events, and TLP governs sharing. OpenCTI: An observable stores a fact such as an IP value. An indicator adds a detection pattern, confidence expresses producer confidence, and valid_until bounds intended use. EDR: Read FileName with InitiatingProcessFileName to reconstruct parent-child lineage. ProcessCommandLine records the launch string; AccountName is execution context, not proof of who typed it. XDR: An incident groups alerts using shared entities and logic across security domains. status=Active is workflow state; it does not report host isolation or validate every alert.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.

MDM: compliance, reason, and lastCheckIn belong together. The record says which policy failed at the last evaluation, not whether malware exists now. WHOIS: Created is registration time, Registrar is the registration provider, and privacy-redacted registrant data is simply unavailable. None identifies hosting or first abuse. AbuseIPDB: abuseConfidenceScore is AbuseIPDB's confidence measure and totalReports counts submitted reports. These are community reputation fields rather than a malware percentage or breach count. Geo-IP: country and city are estimates; accuracy_radius communicates geographic uncertainty. The record locates an IP allocation approximately, not a person or device precisely.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.

strings: strings extracts printable byte sequences from a file. A printed URL is a triage lead; only execution or network evidence can show that the program used it. VirusTotal: last_analysis_stats counts vendor classifications at last_analysis_date. 'undetected' means no detection from those engines at that time, not a clean-file proof. YARA: The output names the matching rule, string identifiers, and offsets. The condition explains why the rule matched; it does not record execution or authorship. Joe Sandbox: Start with concrete Behavior and Network observations, then use the verdict score as a summary. A single sandbox environment may miss gated or evasive behavior.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.

Cuckoo Sandbox: behavior.processes, network.dns, and signatures are observations from this run. info.score summarizes them but is neither CVSS nor proof of successful compromise. Regular expressions: The word boundaries constrain tokens and the alternation matches two encoded-command flags. A regex selects text; it neither decodes the payload nor decides intent. Suspicious commands: Combine parent process, command switches, and child network behavior. -NoP and -EncodedCommand are suspicious context, while the sequence provides the useful lead. MXToolbox: Read each authentication result and every Received hop from the original header. SPF checks the sending server, DKIM checks a signature, and DMARC passes only when one of them passes and aligns with the From domain. None of them reports attachment execution.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.

UEBA: entity, anomaly feature, peer group, and score explain why activity differs from a learned baseline. The score ranks deviation and is not a compromise probability. OpenUBA: model identifies the analytic, observed_hour is the event feature, and baseline_hours is learned history. anomaly_score measures model deviation rather than exploit likelihood. JSON: Braces contain an object, brackets an array, and unquoted false is Boolean. Syntax validity says nothing about source authenticity. XML: The root event element has a source attribute and user/result child elements. Well-formed XML obeys syntax but may still lack schema validation or trust.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.

YAML: Indentation nests values, hyphens introduce sequence items, and false is a Boolean scalar here. Parsing structure does not verify provenance. EVTX: Channel and EventID identify the event class: 4625 is a failed logon and 4624 a successful one. LogonType gives the method, such as 2 interactive, 3 network, and 10 RemoteInteractive (Remote Desktop). On a 4625 for a wrong password, Status is 0xC000006D and SubStatus 0xC000006A refines it; SubStatus 0xC0000064 means the account name does not exist. Correlate with host, time, and account before calling one event an attack pattern. Python: json parsing preserves number types and should surface exceptions. A rejected line is a visibility gap to quarantine and inspect, not evidence to discard silently. PowerShell: ConvertFrom-Json turns JSON members into object properties and Select-Object chooses displayed properties. Neither cmdlet authenticates the source or contacts the IP.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.

Shell script: grep prints matching lines and returns exit status 0 when at least one line was selected, 1 when none was, and 2 on an error. It filters a file; it does not block logins or count attackers.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.