Digital › Module 7 › Lesson 2
Correlation
Correlation literacy — join PCAP, logs, disk, and memory rows on UTC and entity keys from $DFIR_LAB practice cases.
Visual · t26_correlation
Correlation = join keys across artifacts. $DFIR_LAB. Original Cyberlium.
Opening
Correlation is where scattered artifacts become a story — join with keys and skepticism, not with unauthorized data.
Correlation literacy joins artifacts via UTC window, hostname, username, IP:port, file hash, process name, and session ID — document join key per row on $DFIR_LAB practice evidence. Example literacy: DNS query in PCAP within ±60s of 4688 process start in log and file write MAC on disk image — three-source row with confidence note (strong/medium/weak). Cyberlium teaches join methodology — NOT assuming causation from coincidence, NOT correlating employer prod logs with lab fiction, NOT 'hacking back' to validate IPs. Purple analyst marks conflicting rows instead of deleting them. Output: correlation matrix or three cross-source rows with join keys explicit.
1. Join keys
UTC ± window, IP, user, host, hash, PID — pick key per pair; document in column.
Weak joins labeled weak — do not upgrade to 'confirmed attacker' without evidence class.
Command guide
Try these commands — Join keys
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: grep, python3. Reference sites: Event correlation (https://www.sans.org/cyber-security-skills/digital-forensics/); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response); NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Multi-source rows
Minimum literacy: two sources correlated; stretch: three (net + log + disk).
Module 4 disk and Module 5 memory rows may enter joins when brief provides images.
3. Refused
No correlation using unauthorized evidence, no deletion of contradicting rows.
Correlation supports hypotheses — does not replace legal reporting standards Module 8.
4. What you ship: correlation row template
Join key glossary + three cross-source example rows + confidence column + scope line.
5. What you record before the next lesson
Correlation row template path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Delete log row that contradicts your theory before submitting timeline.
Right
Correlation template with explicit join keys on $DFIR_LAB. Next: Hypotheses.
Mission: correlation row template
1) List five join keys. 2) Define confidence weak/medium/strong. 3) Write two cross-source rows from practice case. 4) Write NEVER delete contradicting rows.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “±60s window — when too wide?”
Knowledge Check
APPLY: Correlation uses:
Multiple choice
Knowledge Check
APPLY: True or False: Delete contradicting rows to fit theory.
True or False
Knowledge Check
APPLY: Weak correlation should:
Multiple choice