CTCH 660: Cybersecurity Attack Incident and Artifact Gathering

CTCH 660 at the University of Maryland Global Campus develops the skills needed to run incident response investigations against evolving threats.

UMGC describes the objective as applying a dynamic incident response process and developing threat intelligence to mount effective defenses. Students evaluate how attackers scan, exploit, pivot and establish persistence in cloud and conventional systems.

Topics include what happens at each phase of incident response, plus memory, network and host analysis and forensics, through hands-on labs and projects. The hardest part for most students is turning scattered artifacts into one coherent story of the attack.

What CTCH 660 Covers

• Incident response phases: what responders do from preparation to lessons learned.
• Attacker behavior: scanning, exploitation, pivoting (moving between systems) and persistence.
• Cloud and conventional systems: how investigations differ when assets live in the cloud.
• Memory analysis: finding running processes and artifacts that exist only in RAM.
• Network and host analysis: traffic records, logs and file system evidence.
• Threat intelligence: turning what you learn into better defenses.

Key Concepts Explained

The Incident Response Lifecycle

NIST SP 800-61 has long described four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Its 2025 revision maps response to the NIST Cybersecurity Framework 2.0 functions instead. Check which model your course materials use and stay consistent.

Building a Timeline

A timeline places every artifact in order and is the backbone of an investigation report. Each entry needs a time, source, event and interpretation.

Indicators and Threat Intelligence

Indicators of compromise (file hashes, IP addresses, domains) help find the same attack elsewhere. Behavioral intelligence, such as the techniques an attacker favors, lasts longer because attackers change infrastructure more easily than habits.

Typical Assignments and How to Approach Them

Investigating in the Cloud

UMGC's description singles out cloud systems alongside conventional ones, and cloud investigations change several habits. You often cannot image a physical disk or pull memory from a server you do not own.

Instead, investigators rely heavily on the provider's logs and controls:

• Control plane logs record who changed what in the cloud account, such as new access keys or altered permissions.
• Identity logs show sign-ins and token use, which matter because stolen credentials are a common way in.
• Snapshots of virtual disks can preserve evidence quickly before an instance is terminated.

The shared responsibility model also matters. The provider secures the underlying infrastructure; the customer is responsible for configuration, identities and data. A good report says which side of that line the failure sat on.

Persistence looks different too. Rather than a hidden service on one host, an attacker may create a new administrative user or access key, so check identity changes early.

Where Students Get Stuck

• Time zone confusion. Normalize all timestamps to one zone, usually UTC, before building the timeline.
• Conclusions without evidence. Every claim in the report should point to an artifact.
• Skipping containment trade-offs. Explain why you isolate a host now or watch it longer.
• No lessons learned. Close with concrete improvements, not just a summary.

Study Tips for CTCH 660

• Practice reading process lists and network connection records until anomalies stand out.
• Keep a glossary of attacker behaviors using MITRE ATT&CK names.
• Use a standard timeline table in every lab.
• Write the executive summary last, once the full story is clear.

How We Help with CTCH 660

Send the assignment prompt, scenario, artifact list or your notes, the rubric and feedback. A writer with incident response knowledge can explain the evidence, prepare a custom report or timeline for reference, or edit your own draft.

GradeEssays is independent of the University of Maryland Global Campus. We never access your course or lab environment. Use our work to learn the method, then submit your own under UMGC's academic integrity policy. Orders are written from scratch and refunded in full if late.