<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# Incident Response Runbooks

## Ransomware Response

```
Triage (0-15 min):
  - Identify patient zero: which host encrypted first? check event 4688 (process create)
  - Identify ransomware variant: check ransom note, extension, submit sample to ID Ransomware
  - Determine encryption status: still encrypting vs. done? network still active?
  - Scope: how many shares/hosts affected? check SMB traffic to file servers

Immediate containment:
  - Network-isolate affected hosts via EDR (maintain EDR telemetry)
  - Disable VPN accounts for affected users
  - Block outbound to ransomware C2 IPs (check ransom note, Sysmon 3, firewall logs)
  - DO NOT reboot — ransomware may delete itself on reboot, hindering attribution

Evidence preservation:
  - Memory image before any eradication (encryption keys may be in memory)
  - Export event logs from all affected hosts
  - Preserve VSS (Volume Shadow Copies) before attacker deletes them: vssadmin list shadows

Pre-ransomware IOCs (hands-on-keyboard activity before detonation):
  - Cobalt Strike / Sliver beacon (anomalous outbound HTTPS, beacon traffic)
  - BloodHound collection (LDAP queries from unexpected hosts, Sysmon 3 to DC)
  - Credential dumping (Sysmon 10 on lsass.exe, 4103 PowerShell)
  - Living-off-the-land: wmic.exe, psexec, wscript, mshta with remote URIs
  - net use, robocopy, rclone (staging for exfil before encryption)
```

## Active Directory Compromise

```
Indicators:
  - DCSync: Sysmon Event 8 (remote thread injection on lsass), or 4662 with 1131f6aa GUID
  - Golden ticket: 4769 (TGS requests) with RC4 encryption when AES is enforced
  - Persistence via GPO: check SYSVOL changes, Event 5136 (directory service object modified)
  - AdminSDHolder modification: 4662 on AdminSDHolder object

Containment:
  - Rotate krbtgt password TWICE (invalidates all Kerberos tickets, 10-hour gap between resets)
  - Disable/reset all DA accounts
  - Force sign-out via: Invoke-Command -ComputerName DC01 -ScriptBlock {klist purge}
  - Audit and revoke all Tier 0 credential material (DSRM password, CA private key)
```

## Cloud Account Compromise (AWS)

```bash
# Enumerate what attacker did with compromised creds
aws cloudtrail lookup-events --lookup-attributes AttributeKey=Username,AttributeValue=<user> --start-time 2024-01-01 --end-time 2024-01-02

# Identify new IAM resources created
aws iam list-users --query 'Users[?CreateDate>`2024-01-01`]'
aws iam list-access-keys --user-name <suspect_user>

# Check for persistence via Lambda backdoor or EC2 instance profiles
aws lambda list-functions --region us-east-1
aws iam list-roles --query 'Roles[?contains(AssumeRolePolicyDocument,`lambda.amazonaws.com`)]'

# Contain: revoke all active sessions
aws iam delete-access-key --access-key-id <key_id> --user-name <username>
# Attach DenyAll policy immediately (before full investigation)
aws iam put-user-policy --user-name <username> --policy-name DenyAll --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*"}]}'
```

**Anti-pattern:** Eradicating before understanding scope — removing malware before timeline reconstruction leaves you unable to confirm clean bill of health and risks missing secondary persistence.

## Key Chains

### Initial Triage to Scoped Compromise (First 2 Hours)

1. Receive alert or report → confirm active/contained; assign severity (NIST tier)
2. Preserve volatile: memory image → network connections → process list → open files
3. Export event logs to write-protected share (block attacker from clearing them)
4. Network isolation via EDR while preserving telemetry channel
5. Hayabusa/Chainsaw fast EVTX scan: `hayabusa csv-timeline -d /evtx -o tl.csv` → open in Excel/Kibana, filter by EventID
6. Identify patient zero: earliest Sysmon 1 event for malware process, or Event 4624 for initial logon
7. Map initial access → execution → lateral movement via 4648+4624 type 3 chain

### Evidence Collection to Forensic Package

1. Chain of custody: document system (hostname, IP, OS, time/timezone) + investigator ID
2. Hash live disk MBR: `sha256sum /dev/sda`
3. Image disk (write-blocker recommended): `dd if=/dev/sda bs=4M | split -b 4G - /evidence/disk.img.` + final hash
4. Parse MFT from image: `MFTECmd.exe -f MFT --csv /evidence/mft/`
5. Export hive files: `reg.exe save HKLM\SYSTEM system.hiv` (live) or carve from image
6. Parse registry with RegRipper: `rip.pl -r NTUSER.DAT -f ntuser > ntuser_report.txt`
7. Correlate prefetch (execution evidence) + Amcache (install evidence) + event logs into Plaso timeline

### Containment-to-Eradication Pipeline

1. Scope confirmed → identify all affected hosts via IOC sweep (YARA + hash + network IOCs)
2. Build cleanup checklist per host: persistence mechanisms (registry, scheduled tasks, services, WMI), dropped files (prefetch tells you what ran), lateral movement accounts
3. Rotate credentials in order: compromised accounts → service accounts → krbtgt (if AD compromise) → privileged tokens
4. Remove persistence: delete reg keys, remove scheduled tasks, delete malicious services, clean WMI subscriptions
5. Patch initial access vector BEFORE bringing hosts back online
6. Rebuild if: rootkit suspected, attacker had SYSTEM > 24h, OS integrity questionable (hash mismatch on system binaries)
7. Verify clean: EDR clean scan + YARA sweep + Chainsaw on fresh event logs post-rebuild + network baseline comparison

---
v1.1 | Validated: 2026-03-13
