CompTIA CySA+ (CS0-003) Fact Sheet¶

Quick Reference¶

Exam Code: CS0-003 Duration: 165 minutes Questions: Up to 85 (MCQ + performance-based) Passing Score: 750/900 Cost: $404 USD Validity: 3 years Delivery: Pearson VUE (testing center or online proctored)

Exam Domain Breakdown¶

Documentation: - CompTIA CySA+ Objectives - Official exam objectives - NIST SP 800-61r2 - Computer security incident handling - NIST SP 800-150 - Cyber threat information sharing

Attack Methodology Frameworks¶

MITRE ATT&CK Tactics (Enterprise Matrix)¶

High-Yield ATT&CK Techniques to Memorize¶

Cyber Kill Chain (Lockheed Martin)¶

1. Reconnaissance - target research, OSINT
2. Weaponization - couple exploit + payload
3. Delivery - email, web, USB
4. Exploitation - trigger code on victim
5. Installation - persistence (backdoor, rootkit)
6. Command and Control (C2) - remote channel
7. Actions on Objectives - exfiltration, encryption, destruction

Diamond Model¶

Four interconnected vertices on every intrusion event: - Adversary - threat actor, group, individual - Capability - malware, tools, exploits used - Infrastructure - C2 servers, domains, IPs - Victim - targeted person, system, organization Plus meta-features: timestamp, phase, result, direction, methodology, resources.

Other Frameworks¶

• OWASP Top 10 - web app risks (Broken Access Control #1, Crypto Failures #2, Injection #3)
• MITRE D3FEND - defensive countermeasures matched to ATT&CK
• MITRE CAPEC - attack pattern enumeration
• STRIDE - Spoofing, Tampering, Repudiation, Info disclosure, DoS, Elevation
• PASTA - Process for Attack Simulation and Threat Analysis (7 stages)

Indicators of Compromise (IoCs)¶

Network IoCs¶

Host IoCs¶

Behavioral IoCs / IoAs¶

• Login from impossible travel locations
• Privilege escalation attempts
• Mass file access by single user
• Data staged to compressed archive before exfil
• Lateral movement (SMB, WinRM, RDP across many hosts)
• Disabled security tools (AV, EDR, audit logging)

Log Analysis Cheatsheet¶

Windows Security Event IDs¶

Linux Log Locations¶

Useful Linux commands:

last -F                           # successful logins
lastb                             # failed logins
ausearch -k recon                 # search auditd by key
journalctl -u sshd --since today  # systemd journal
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort -u

SIEM Queries¶

Splunk SPL Examples¶

# Failed logon spike (brute force)
index=wineventlog EventCode=4625
| stats count by src_ip, user
| where count > 20

# Password spraying (many users, few attempts)
index=wineventlog EventCode=4625
| stats dc(user) as users, count by src_ip
| where users > 10

# Impossible travel
index=auth user=*
| iplocation src_ip
| stats values(Country) as countries, count by user
| where mvcount(countries) > 1

# PowerShell encoded command
index=sysmon EventCode=1 (CommandLine="*-enc*" OR CommandLine="*-EncodedCommand*")
| table _time, host, user, ParentImage, CommandLine

# Lateral movement via RDP
index=wineventlog EventCode=4624 LogonType=10
| stats values(host) as hosts, count by user
| where mvcount(hosts) > 3

# Suspicious LSASS access
index=sysmon EventCode=10 TargetImage="*lsass.exe"
| stats count by host, SourceImage, GrantedAccess

# DNS data exfiltration (high entropy)
index=dns | eval len=len(query) | where len > 50
| stats count, avg(len) by src_ip

Microsoft Sentinel KQL Examples¶

// Failed sign-ins
SigninLogs
| where ResultType != 0
| summarize FailedAttempts=count() by UserPrincipalName, IPAddress
| where FailedAttempts > 20

// New service installation
SecurityEvent
| where EventID == 7045
| project TimeGenerated, Computer, ServiceName, ServiceFileName, AccountName

// PowerShell with encoded command
SecurityEvent
| where EventID == 4688
| where CommandLine has_any ("-enc", "-EncodedCommand", "FromBase64String")

// Defender alerts by severity
SecurityAlert
| summarize count() by AlertName, AlertSeverity
| order by AlertSeverity desc

Sigma Rule Skeleton¶

title: Suspicious PowerShell Encoded Command
id: 4d7a1b8e-1234-5678-9abc-def012345678
status: stable
description: Detects use of base64-encoded PowerShell commands often used to evade detection
references:
    - https://attack.mitre.org/techniques/T1059/001/
author: SOC Team
date: 2025/01/15
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - '-enc '
            - '-EncodedCommand'
            - 'FromBase64String'
    condition: selection
falsepositives:
    - Legitimate admin scripts
level: high

Network Detection¶

Snort/Suricata Rule Format¶

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (
    msg:"ET EXPLOIT Possible EternalBlue MS17-010";
    flow:established,to_server;
    content:"|FF|SMB"; offset:4; depth:4;
    content:"|00 00 00 00|"; distance:1; within:4;
    classtype:attempted-admin;
    sid:2024218; rev:3;
)

Wireshark Display Filters¶

tcpdump Capture¶

sudo tcpdump -i eth0 -w capture.pcap port 80 or port 443
sudo tcpdump -i any -nn 'tcp port 22 and host 10.0.0.5'
sudo tcpdump -r capture.pcap -A 'tcp port 80'   # readable ASCII

Zeek Logs (Bro)¶

Vulnerability Scoring and Tools¶

CVSS v3.1 Severity¶

CVSS Base Metrics¶

• AV - Attack Vector (Network, Adjacent, Local, Physical)
• AC - Attack Complexity (Low, High)
• PR - Privileges Required (None, Low, High)
• UI - User Interaction (None, Required)
• S - Scope (Unchanged, Changed)
• C/I/A - Confidentiality, Integrity, Availability impact (None, Low, High)

Example string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical

CVSS v4.0 (Released Nov 2023)¶

• New supplemental metrics: Safety, Automatable, Recovery, Value Density
• Threat metric replaces "Temporal" group
• Environmental adjustments more granular

Other Scoring Systems¶

• EPSS - Exploit Prediction Scoring System (probability of exploitation in 30 days, 0-1)
• CISA KEV - Known Exploited Vulnerabilities catalog (must-patch list for federal)
• CWE - Common Weakness Enumeration (vulnerability category)
• CVE - Common Vulnerabilities and Exposures (specific instance)
• SSVC - Stakeholder-Specific Vulnerability Categorization (CISA decision tree)

Vulnerability Scanning Tools¶

Scan Types¶

• Unauthenticated - external attacker view, fewer findings
• Authenticated - logged-in scan, fuller picture, more accurate
• Agent-based - persistent agent reports findings
• Passive - sniff network traffic, no probes (Zeek, Suricata)
• Active - send probes (Nessus, Nmap)
• Web application - DAST (Burp, ZAP)
• Static (SAST) - source code analysis (Semgrep, SonarQube)
• Dynamic (DAST) - running app testing
• Interactive (IAST) - hybrid SAST + DAST inside running app
• Container - image scanning (Trivy, Grype, Clair)
• IaC - Terraform/CloudFormation static analysis (Checkov, tfsec)

Incident Response Quick Reference¶

NIST SP 800-61 Lifecycle¶

1. Preparation - policies, runbooks, tools, training, communication trees
2. Detection and Analysis - monitor, classify, scope, prioritize
3. Containment, Eradication, Recovery - isolate, remove, restore
4. Post-Incident Activity - lessons learned, report, improvements

SANS PICERL Lifecycle¶

Preparation -> Identification -> Containment -> Eradication -> Recovery -> Lessons Learned

Order of Volatility (RFC 3227)¶

1. CPU registers, cache (nanoseconds)
2. Routing table, ARP cache, process table, kernel statistics, RAM (microseconds-milliseconds)
3. Temporary file systems / swap (seconds-minutes)
4. Disk (minutes-hours)
5. Remote logging and monitoring data
6. Physical configuration, network topology
7. Archival media (offline backups)

Forensic Tools¶

Common Exam Scenarios¶

1. "Suspicious beacon traffic to external IP" - C2 detection, block at firewall, IR
2. "Multiple failed logins followed by success from new geo" - account compromise, force reset
3. "Vulnerability scan returned 500 findings" - prioritize by CVSS + KEV + asset value
4. "PowerShell -enc command observed" - T1059.001, hunt for parent process, decode payload
5. "Mass file rename to .locked" - ransomware T1486, isolate immediately
6. "LSASS process accessed by unsigned binary" - credential dumping T1003.001
7. "Outbound DNS queries with high entropy" - DNS tunneling T1071.004
8. "User in group X downloaded 50GB" - insider threat, data exfil T1041
9. "Public-facing web app exploited" - T1190, WAF logs, patch, scan
10. "Privilege escalation evidence found" - check ATT&CK TA0004 techniques
11. "Patch fails in test environment" - compensating control, document risk acceptance
12. "Auditor asks for evidence" - chain of custody, timestamps, hash verification

Key Acronyms¶

Operations¶

• SOC - Security Operations Center
• SIEM - Security Information and Event Management
• SOAR - Security Orchestration Automation and Response
• EDR/XDR - Endpoint / Extended Detection and Response
• MDR - Managed Detection and Response
• NDR - Network Detection and Response
• UEBA - User and Entity Behavior Analytics

Frameworks and Standards¶

• ATT&CK - Adversarial Tactics, Techniques, and Common Knowledge
• TTP - Tactics, Techniques, Procedures
• IoC / IoA - Indicator of Compromise / Attack
• STIX / TAXII - Structured Threat Info eXpression / Trusted Automated eXchange of Indicator Information
• OSINT - Open Source Intelligence
• ISAC / ISAO - Information Sharing and Analysis Center / Organization

Vulnerability¶

• CVE - Common Vulnerabilities and Exposures
• CWE - Common Weakness Enumeration
• CVSS - Common Vulnerability Scoring System
• EPSS - Exploit Prediction Scoring System
• KEV - Known Exploited Vulnerabilities
• SSVC - Stakeholder-Specific Vulnerability Categorization
• SBOM - Software Bill of Materials

Metrics¶

• MTTD - Mean Time to Detect
• MTTR - Mean Time to Respond / Resolve
• MTTA - Mean Time to Acknowledge
• MTBF - Mean Time Between Failures
• SLA / SLO / SLI - Service Level Agreement / Objective / Indicator

Use this fact sheet for last-week revision. Memorize ATT&CK technique IDs, Windows EventIDs, CVSS thresholds, and the NIST IR phases.