## Analyze Evidence

* Prioritize based on the investigative plan
* Analyze and triage live response data
* Analyze memory and disk images (_i.e._, conduct forensics)
* Analyze malware
* _OPTIONAL:_ Enrich with research and intelligence
* Document new indicators of compromise (IOCs)
* Update the case file

### Example Useful Indicators

`TODO: Customize and prioritize useful indicators.`

* Unusual authentication behavior (_e.g._, frequency, systems, time of day, remote location)
* Non-Standard formatted usernames
* Unsigned binaries connecting to the network
* Beaconing or significant data transfers
* PowerShell command line requests with Base64-encoded commands
* Excessive RAR, 7zip, or WinZip activity, especially with suspicious file names
* Connections on previously unused ports.
* Traffic patterns related to time, frequency, and byte count
* Changes to routing tables, such as weighting, static entries, gateways, and peer relationships
