Incident › Module 6 › Lesson 3
Validation Checks
Validation checks literacy — re-scan, log review, credential test, user acceptance stub — post-eradication gates on YOUR `$IR_LAB` tabletop.
Visual · t34_validation_checks
Validation = named post-eradication gates. $IR_LAB. Original Cyberlium.
Opening
Go-live without validation re-invites the threat — name post-eradication checks on YOUR lab tabletop before declaring recovery complete.
Validation checks literacy names: endpoint re-scan category, auth log review for re-entry category, EDR alert quiet period stub category, credential test on rotated accounts category, and business user acceptance checkpoint category. Analyst documents validation gate checklist on `$IR_LAB` tabletop stub — ties each check to eradication rows from 6-1 and recovery plan from 6-2 — without disabling security controls to 'pass' validation, without fabricating clean scan results, without prod validation without RoE. Cyberlium teaches honest go/no-go gates — defender literacy on YOUR notes. Refused: security control disable, fake validation sign-off, unauthorized prod pen-test. Lab row: five validation checks with pass/fail criteria stub and UTC.
1. Named validation gates
Re-scan, log review, EDR quiet period, credential test, user acceptance — five literacy anchors.
Each gate has explicit pass/fail criteria stub — not subjective 'looks fine.'
Command guide
Try these commands — Named validation gates
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final ISO/IEC 27035 — https://www.iso.org/standard/78973.html SANS IR — https://www.sans.org/for-organizations/incident-response/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/eradication/validation-checklist.md" <<'EOF'
# Recovery Validation Checklist — YOUR org
- [ ] EDR/AV clean scan on restored hosts
- [ ] No attacker persistence: tasks, services, registry (YOUR checklist)
- [ ] Patches applied for root cause vulnerability
- [ ] Credentials rotated in compromise scope
- [ ] Network rules block known-bad IOCs from incident
- [ ] Monitoring alerts tuned for recurrence TTPs
- [ ] User acceptance / service owner sign-off
- [ ] Incident ticket documents validation evidence
Tabletop: mark items for LAB-IR-RANSOM-001 fictional recovery
EOFCommand — copy this
grep '\[ \]' "$IR_LAB/eradication/validation-checklist.md"
python3 -c "print('Validation: clean scan + persistence check + patch + cred rotation')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); ISO/IEC 27035 (https://www.iso.org/standard/78973.html); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Go/no-go discipline
Failed validation returns to eradication — document loop on lab stub.
UTC sign-off row states who approved go-live on tabletop scenario.
3. Refused
No security control disable to pass checks; no fabricated clean results.
Validation literacy supports safe recovery — not checkbox theater.
4. What you ship: validation gate checklist
Five validation checks + pass/fail criteria + go/no-go UTC + NEVER fake sign-off line.
5. What you record before the next lesson
Validation gate checklist path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Disable EDR on lab stub to 'pass' validation faster.
Right
Validation gate checklist from `$IR_LAB` tabletop stub. Next: Eradication Lab.
Mission: validation gate checklist
1) Name five validation checks. 2) Pass/fail criteria per check. 3) Go/no-go loop to eradication if fail. 4) Write NEVER fake validation sign-off line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “EDR quiet period — literacy default stub?”
Knowledge Check
APPLY: Validation checks literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Failed validation should loop back to eradication.
True or False
Knowledge Check
APPLY: Validation gates include:
Multiple choice