The manipulation of file times in order to obfuscate weaponized code is called ___________

The alias for Get-WmiObject is 

You need to hire 1st responders.  There are many attributes that you will look for in a colleague as well as instructions that you will impart when 1st engaging in a response action.  Some of these instructions include (choose all that apply) 

Software patching, configuration changes, and compensating controls are examples of  ____________ (2 words) 

One effective way of visualizing what is going on during response is 

When Svchost.exe is initiated, it is almost always started without the -k flag. 

Customer knowledge is super critical to the success of you IR.  What demographics about the customer do you need conversant in. 

One of the first steps in a response is to determine if you actually have a breach versus some non-malicious cause of the situation.  

Knowledge of the current solution space is another critical aspect of IR.  Vaporware is a sought after technology. 

For attackers, changing IP addresses used by them in their weaponized code  is a fairly __________ to do.