Playbooks #

Step-by-step playbooks, procedures and decision guides, grouped by the product or environment they cover. Pick the section for the platform you're working in; the last section applies to any engagement.

Windows & Active Directory

Playbooks for incidents centred on Windows estates and Active Directory.

• Playbook - ransomware, first six hours on site

AWS

Playbooks for incidents in Amazon Web Services accounts.

• Playbook - AWS compromise via leaked access keys
• Playbook - BEC / fraud mail sent through Amazon SES

Microsoft 365

Playbooks for Microsoft 365 and Entra ID incidents.

• Playbook - suspected BEC in M365
• Procedure - preserving M365 evidence for litigation

Google Workspace

Playbooks for Google Workspace (Gmail, Drive) incidents.

• Playbook - suspected BEC in Google Workspace (Gmail)

Any environment

Procedures, decision guides and references that apply whatever the platform.

• Procedure - working alongside the client's MDR provider
• Decision guide - contain now or observe first
• Template - privileged factual-findings report outline
• Adversary reference - SCATTERED SPIDER attack chain