Cheatsheets

Four short sheets. Each one is a reminder of a lesson or a lab already on this site, not a replacement for it. Practice only on a system you own or a range whose rules allow the work.

Looking for a question instead of a sheet? Open Topics.

Wireshark display filters

Display filters lesson

A display filter hides rows in a file you already saved. It does not decide what gets recorded. A green box means the expression parsed.

ip.addr == 10.8.0.40: That address is the source or the destination. Use it when you do not care which side spoke first.
ip.src == 10.8.0.40: That address is the source only. ip.dst is the other one-sided test.
tcp.port == 443: TCP port 443 on either side. This is the usual way to keep one host’s HTTPS and drop the rest.
udp.port == 53: UDP port 53 on either side. Pair it with an address when you want one client’s DNS questions.
!(ip.addr == 10.8.0.40): Hide that host. A bare not-equals changed meaning between Wireshark versions. The negated test reads the same on each of them.

Windows event IDs

Windows security and Event Logs

Five IDs that answer who signed in, what started, and whether the log itself was touched. Open the lesson for the fields.

4624: A logon succeeded. The type says whether it was the console, the network, a service, or Remote Desktop.
4625: A logon failed. Read the account, the type, and the source before you decide it is an incident.
4688: A process started. The useful event includes the command line and the parent process.
7045: A service was installed. Read the file path and the account it runs as.
1102: The Security log was cleared. The new log still records that the clear happened.

Email authentication

Phishing header analyzer

Read the header before you call a message phishing. These three results are the ones the lab asks you to explain.

SPF: The domain on the envelope says this server is allowed to send for it. A pass does not prove who wrote the From line you see.
DKIM: A signature on the message matches a key the signing domain published. A pass means those signed parts were not changed after signing.
DMARC: It passes only when SPF or DKIM passes for a domain that lines up with the visible From address. The domain’s policy says what to do when it does not.

SOC first hour

Ransomware first-hour decision drill

A ransom note is already on a file server. Do these in order. The lab shows what each choice costs if you skip one.

Take the host off the network and leave it powered on, so the spread stops and the memory is still there.
Disable the account that is reaching new machines, and isolate those machines too.
Check a copy the attacker could not change before you restore anything.
Call the incident lead and legal before you post a public update.
Bring systems back from a known-good image, then restore from the copy you already checked.