GIAC Certified Incident Handler (GCIH) Exam Guide

1. Incident response and cyber investigation: understand the PICERL and DAIR incident handling processes and incident response challenges
2. Network and log investigations: understand the steps necessary to perform effective investigations of network and log data
3. Malware and AI assisted investigations: understand the steps necessary to perform basic malware analysis and understand how AI can be used to augment investigative efforts

Example scenario: A user reports a pop-up and the EDR shows an unknown process calling out every 60 seconds. What would you collect before isolating the host?

1. Scanning and mapping: understand how to discover and map networks and hosts, reveal services and vulnerabilities, and identify and defend against scanning
2. SMB security: understand SMB features, vulnerabilities, how to discover and access shares, and how to secure the service

Example scenario: Firewall logs show one internal host touching port 445 on every subnet address. What does that suggest, and what would you check next?

1. Understanding passwords: identify password hashes, understand password weaknesses, and secure passwords
2. Attacking passwords: understand in detail how to conduct password attacks
3. Securing credentials and data in the cloud: understand how to identify, defend against, and mitigate password attacks and insecure storage in cloud-based environments

Example scenario: A storage bucket containing a configuration file with access keys was public for a week. Which logs would show whether the keys were used?

1. Detecting exploitation and covert communications tools: understand how to identify and defend against the use of exploitation tools such as Metasploit and covert communications tools such as netcat
2. Endpoint attack and pivoting: understand how to identify and defend against endpoint specific attacks and pivoting in an environment
3. Detecting evasive and post-exploitation techniques: identify and defend against an attacker already in an environment, discover methods used to establish persistence, hide their presence, and achieve actions on objectives

Example scenario: A new scheduled task on a server runs an encoded PowerShell command at logon. How would you decide whether it is persistence?

1. Exploiting insecure web application references: understand common methods for exploiting insecure web application references
2. Web application injection attacks: understand common web application injection attacks
3. Web application API attacks: understand the basics of interacting with and abusing access to web APIs
4. Integrating LLMs with offensive operations: understand LLM prompt processing, risks, common attack methods, and defend against AI specific attacks in modern environments

Example scenario: Web logs show requests where an order ID in the URL increases by one each time and every request succeeds. What weakness is being tested?