Loading…
Incident response flows — step by step, aligned with NIST SP 800-61 and SANS PICERL phases. Structured, technique-driven guides from preparation to recovery.
25 playbooks
When PowerShell usage is detected in conjunction with a download cradle and external network connection correlation, C2 beacon suspicion, or a lateral movement chain — evidence collection in the correct order and controlled isolation take priority over speed.
Active Directory compromise response: domain admin access, Golden Ticket, DCSync, DC takeover. Systematic recovery to prevent attacker re-entry.
When DCSync, NTDS dump, DA/DC takeover, or Golden/Silver Ticket evidence indicates domain-compromise class; executes the destructive response encompassing krbtgt double rotation, persistence removal, and full domain recovery.
When DR-DELEG-1 (coercion active) or a completed RBCD chain, S4U activity, lateral movement, or DA privilege acquisition is confirmed; removes delegation abuse from the root, clears persistence, and bridges to the sibling playbook for the krbtgt procedure if domain-compromise is confirmed.
Responds to detected active NTLM relay, forced authentication (PetitPotam/PrinterBug/DFSCoerce), or Pass-the-Hash chains with evidence-first containment, dismantling of relay persistence, and structural relay countermeasures.
When trust key theft is suspected, SID History is actively abused, or a forged inter-realm TGT is confirmed, rotate the trust key, clear sIDHistory, and escalate to the krbtgt reset playbook if domain/forest compromise is verified.
When an active ESC attack is confirmed or an unauthorized certificate has been issued: revoke the unauthorized certificate, harden the source, and trigger the krbtgt reset playbook if domain compromise is present.
Incident response for nation-state / advanced persistent threat (APT) attacks; based on the Mandiant Attack Lifecycle model, SANS FOR508, and Microsoft DART practices.
Evidence-driven containment, persistence removal, and tenant recovery for scenarios where the Entra ID management plane is compromised via application secret/certificate addition, privileged role assignment, Golden SAML exploitation, or federated domain abuse.
Executes extended response covering triage, evidence acquisition, account isolation, credential rotation, and ACL hardening when credential dump, LSASS access, or lateral movement evidence is found in addition to an AD discovery alarm.
When an active C2 channel or data exfiltration indicator is detected, executes beacon/DNS tunnel identification, network isolation, C2 infrastructure blocking, affected data scoping, and implant eradication.
Response to data exfiltration (large outbound traffic, cloud storage, DNS tunnel) and breach notification process.
When a DLL persistence signal is combined with an active compromise, suspicious process behavior, wide lateral spread, or a compromised administrator credential, executes comprehensive forensic analysis, hard isolation, full persistence removal, and host recovery steps.
Emergency response steps for a domain-compromise scope when unauthorized replication ACEs are added to the domain object, unauthorized members are added to Domain Admins, or privilege escalation is detected via a GenericAll/WriteDACL chain over DA/Tier-0.
Response to an active spoofing campaign originating from your own domain; DMARC report anomaly detection, emergency policy escalation, affected user notification, and root cause analysis.
Scaled artifact collection, anomaly detection, and DFIR triage across dozens to thousands of endpoints with a deployed Velociraptor agent, using a wave-based hunt architecture (volatile → IOC-driven → deep triage).
Detection, isolation, and permanent remediation of lateral movement performed by PsExec-style tools creating transient services via remote SCM (T1569.002 + T1021.002).
When evidence of root access is found on a Linux system (new sudoers entry, SUID binary, kernel module, rootkit indicator), a disk image is acquired, deep forensic analysis is performed, and the system is rebuilt.
Response steps covering consent revocation, application shutdown, and tenant hardening for access-persistence attacks carried out via OAuth consent hijacking, credential addition, and Graph API permission escalation chains through a rogue Entra ID application or service principal.
Privilege escalation / Domain/Tenant admin compromise; focused on AD forest recovery.
When injection-based active C2 connectivity, lateral movement, or domain-level compromise is detected, executes comprehensive coordinated isolation, removal of injected components, systemic persistence scanning, and full system recovery.
Ransomware incident response based on CISA/FBI StopRansomware + Mandiant + NIST SP 800-184. Isolate first, then investigate.
Software supply chain takeover (malicious update, trojanized package, build system). SolarWinds, 3CX, XZ Utils examples. Source: SANS FOR610 + CISA AA23-144A.
When an EID 4 service-stopped alert or an EID 16 unexpected configuration change indicates active interference with telemetry infrastructure, restores visibility using an evidence-first approach and investigates the attacker's evasion motivation.
A WMI consumer is executing an active payload, a hidden root\Default subscription is present, or remote WMI/lateral movement is suspected; evidence-first isolation followed by full eradication in safe order.
