Incident › Module 6 › Lesson 3
Validation Checks
Validation checks literacy — re-scan, log review, credential test, user acceptance stub — post-eradication gates on YOUR `$IR_LAB` tabletop.
Visual · t34_validation_checks
Validation = named post-eradication gates. $IR_LAB. Original Cyberlium.
Opening
Go-live without validation re-invites the threat — name post-eradication checks on YOUR lab tabletop before declaring recovery complete.
Validation checks literacy names: endpoint re-scan category, auth log review for re-entry category, EDR alert quiet period stub category, credential test on rotated accounts category, and business user acceptance checkpoint category. Analyst documents validation gate checklist on `$IR_LAB` tabletop stub — ties each check to eradication rows from 6-1 and recovery plan from 6-2 — without disabling security controls to 'pass' validation, without fabricating clean scan results, without prod validation without RoE. Cyberlium teaches honest go/no-go gates — defender literacy on YOUR notes. Refused: security control disable, fake validation sign-off, unauthorized prod pen-test. Lab row: five validation checks with pass/fail criteria stub and UTC.
1. Named validation gates
Re-scan, log review, EDR quiet period, credential test, user acceptance — five literacy anchors.
Each gate has explicit pass/fail criteria stub — not subjective 'looks fine.'
Command guide
Try these commands — Named validation gates
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); ISO/IEC 27035 (https://www.iso.org/standard/78973.html); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Go/no-go discipline
Failed validation returns to eradication — document loop on lab stub.
UTC sign-off row states who approved go-live on tabletop scenario.
3. Refused
No security control disable to pass checks; no fabricated clean results.
Validation literacy supports safe recovery — not checkbox theater.
4. What you ship: validation gate checklist
Five validation checks + pass/fail criteria + go/no-go UTC + NEVER fake sign-off line.
5. What you record before the next lesson
Validation gate checklist path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Disable EDR on lab stub to 'pass' validation faster.
Right
Validation gate checklist from `$IR_LAB` tabletop stub. Next: Eradication Lab.
Mission: validation gate checklist
1) Name five validation checks. 2) Pass/fail criteria per check. 3) Go/no-go loop to eradication if fail. 4) Write NEVER fake validation sign-off line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “EDR quiet period — literacy default stub?”
Knowledge Check
APPLY: Validation checks literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Failed validation should loop back to eradication.
True or False
Knowledge Check
APPLY: Validation gates include:
Multiple choice