ir-playbooks

Incident Response Playbooks

Playbook templates for common security incident types, providing step-by-step response procedures for each phase of incident handling.

Knowledge Base

Playbook Structure

Every playbook follows the same four-phase structure from NIST SP 800-61:

1. Detection & Validation -- Confirm the incident is real, classify it
2. Containment -- Stop the spread, limit damage
3. Eradication & Recovery -- Remove the threat, restore operations
4. Post-Incident -- Document, learn, improve

Playbook 1: Malware Infection

Indicators:

• Antivirus/EDR alert on malicious file or behavior
• Unusual process execution (PowerShell encoding, living-off-the-land binaries)
• Unexpected network connections to known bad IPs/domains
• System performance degradation, unexpected file encryption
• User reports of unusual system behavior

Detection & Validation:

1. Verify the alert is not a false positive (check file hash against VirusTotal, check process lineage)
2. Identify the malware type: dropper, RAT, ransomware, cryptominer, wiper, worm
3. Determine the infection vector: email attachment, drive-by download, USB, lateral movement
4. Assess scope: single system or multiple systems?
5. Check for lateral movement indicators (SMB connections, RDP sessions, credential dumping artifacts)

Containment:

1. Immediate: Isolate the infected system from the network (disable network adapter or move to quarantine VLAN). Do NOT power off -- preserve memory evidence.
2. Collect volatile evidence: memory dump, process list, network connections, logged-in sessions
3. Block known IOCs at network perimeter (firewall rules for C2 IPs/domains)
4. Block file hashes in EDR/antivirus across the organization
5. Identify and isolate other potentially infected systems
6. Disable affected user accounts if credential compromise is suspected
7. Block lateral movement: disable admin shares, restrict RDP, enable enhanced authentication logging

Eradication & Recovery:

1. Identify and remove all malware artifacts: files, registry keys, scheduled tasks, services, startup items
2. If rootkit suspected, reimage from known-good media rather than attempting cleanup
3. Reset credentials for all accounts that were active on compromised systems
4. Patch the vulnerability that allowed initial infection
5. Restore data from clean backups if needed (verify backup integrity first)
6. Rebuild or reimage affected systems from gold images
7. Monitor recovered systems closely for 30 days