Defensive methodology

Incident response

When an alert is confirmed, you must act fast without breaking anything: limit the damage, preserve the evidence, drive the attacker out and restore the system. The NIST lifecycle provides the structure.

DefensiveNIST SP 800-61SANS PICERL

The NIST SP 800-61 lifecycle

  1. PreparationPlan, team, tools, contacts, logging enabled, exercises.
  2. Detection and analysisConfirm the incident, scope it, qualify it.
  3. Containment, eradication, recoveryIsolate, remove the threat, restore safely.
  4. Post-incident activityLessons learned, improving defences and the plan.
SANS variantThe PICERL model splits the same approach into six steps: Preparation, Identification, Containment, Eradication, Recovery, Lessons learned.

Revision 3 of SP 800-61 (2025) realigns these steps with the NIST CSF 2.0 functions. The four-phase lifecycle remains the reference for HTB exams.

Detection and analysis

  • Confirm that it really is an incident (and not a false positive).
  • Determine the scope: affected hosts, accounts and data.
  • Assess the severity: business impact, sensitive data, spread.
  • Open a timestamped incident log from the very first minute.
  • Notify the right people according to the plan (management, legal, DPO if personal data is involved).

Containment

Short term

  • Isolate the machine from the network (EDR isolation, VLAN, switch port).
  • Disable compromised accounts, revoke sessions and tokens.
  • Block malicious IPs and domains.

Before acting

  • Capture memory before shutting down: it disappears when the machine stops.
  • Copy the useful logs before they roll over.
  • Avoid tipping off the attacker too early if they are still active.

Eradication and recovery

  • Remove malware, the accounts created and the persistence mechanisms.
  • Fix the root cause (vulnerability, weak password, misconfiguration).
  • Reset exposed credentials; if the domain was compromised, reset the krbtgt account twice.
  • Restore from clean, verified backups.
  • Return to production gradually, under heightened monitoring.

After the incident

  • A blameless lessons-learned meeting within a few days.
  • Full timeline: initial access, discovery, actions taken.
  • What worked, what was missing (visibility, delays, tools).
  • New detection rules, updated plan, actions tracked until closed.

First responder checklist

  • Open the incident log (time, source, initial finding)
  • Qualify: incident confirmed, estimated severity
  • Notify the person in charge according to the response plan
  • Preserve the evidence: memory, disks, logs
  • Contain the affected hosts and accounts
  • List the indicators (IPs, domains, hashes, accounts)
  • Search for these indicators across the rest of the estate
  • Plan eradication and recovery
  • Schedule the lessons-learned review