Defensive methodology

Incident response playbooks

Four common scenarios, each with its warning signs and a checklist to follow. They apply the Incident response lifecycle; adapt them to the organisation's plan.

CDSADefensiveNIST SP 800-61

Before you start

  • Open a timestamped log (UTC) from the very first minute: every finding, every action, who did it.
  • Capture memory and copy the logs before shutting down or reinstalling anything.
  • Plan a communication channel outside the compromised system (the attacker may be reading email).

Ransomware

Signs: files renamed with a new extension, ransom note, spike in disk writes, shadow copies deleted (vssadmin delete shadows), backup or antivirus services stopped.

  • Isolate the affected machines from the network without shutting them down
  • Identify the strain (note, extension; ID Ransomware, No More Ransom)
  • Measure the scope: encrypted shares, accounts used, first host hit
  • Protect the backups: disconnect them and check they are intact
  • Disable compromised accounts, reset privileged accounts
  • Find the initial access and persistence (exposed RDP, VPN, phishing, tasks, GPOs)
  • Check for exfiltration before encryption (double extortion)
  • Inform management, legal and the insurer; file a complaint, notify if personal data is involved
  • Restore from clean backups onto rebuilt systems
  • Lessons learned and new detections
Pay the ransom?Never without legal advice: nothing guarantees a working key or that stolen data is deleted, and payment may be illegal if the group is under sanctions.

Phishing

Signs: a user report, sender domain close to a known one, SPF/DKIM/DMARC failure, link to a fake login page, attachment with a macro or a password-protected archive.

  • Retrieve the full email with its headers (.eml file)
  • Analyse the sender, the path (Received), SPF, DKIM and DMARC
  • Extract the indicators: URLs, domains, attachment hashes
  • Analyse links and attachments in a sandbox, never on a workstation
  • Find every recipient of the same message
  • Identify who clicked or entered credentials (proxy, DNS, mail logs)
  • Purge the message from mailboxes, block the sender, domains and URLs
  • Reset exposed passwords, revoke sessions, check MFA
  • Check forwarding rules created in the affected mailboxes
  • Warn and brief the targeted users

Compromised account

Signs: logons from an unusual country or address, “impossible travel”, a burst of rejected MFA prompts, logons outside working hours (4624), new mailbox rules, addition to a privileged group.

  • Confirm by comparing with usual activity (hours, sources, devices)
  • Revoke sessions and tokens, reset the password
  • Check and reset MFA (registered devices)
  • List the account's actions since the first suspicious logon
  • Look for persistence: mailbox rules, OAuth apps, accounts created (4720), group additions (4728, 4732, 4756)
  • Look for other affected accounts (same source, same password)
  • Understand how the credentials leaked (phishing, reuse, malware)
  • Monitor the account closely for several weeks

Data exfiltration

Signs: unusual outbound volume, connections to online storage or an unknown host, archives (7z, rar) created just before, DNS tunnelling, tools such as rclone, transfers at night.

  • Measure volume and destination (Zeek conn.log, proxy, firewall, NetFlow)
  • Identify the source host and account
  • Block the destination and isolate the host
  • Identify the data involved (shares accessed, archives, access logs)
  • Find the tool used and the persistence (rclone, scripts, scheduled tasks)
  • Assess the impact: personal data, secrets, customers
  • Inform legal and the DPO: notify the supervisory authority within 72 hours if personal data is involved
  • Rotate exposed secrets (keys, passwords, tokens)
Which sources?Network: Zeek logs, proxy, DNS. Host: archive creation (Sysmon 1 and 11), tools run (Prefetch, Amcache). See also Windows artefacts.