GIAC GCIH Course Notes

Verify what happened, build defensible scope from multiple evidence sources, contain proportionately, preserve evidence, eradicate the actual foothold, and validate recovery. GCIH expects responders to move between response and investigation as new evidence changes the picture.

Know what the scanner or exploitation tool is proving, what it is not proving, and how the same behavior appears to defenders. GCIH blends attacker-tool literacy with defensive interpretation.

Separate password storage, online authentication abuse, offline cracking, alternate authentication material, and cloud-session abuse. The exam frequently gives clues that distinguish one attack economy or evidence source from another.

GCIH web questions are usually root-cause questions. Decide whether the failure is object authorization, injection/data-vs-code separation, unsafe browser output handling, API inventory/governance, resource abuse, or business-flow abuse.

After initial compromise, identify what the attacker is doing now: executing, maintaining persistence, obtaining credentials, moving laterally, evading defenses, communicating with C2, or manipulating AI-integrated systems. Map the observed behavior, not the tool name.