Any environment playbooks #

Procedures, decision guides and references that apply whatever the platform. Expand a playbook for step-by-step actions; adapt the order to the environment and the rules of engagement, and record each step in your notes as you go. All playbooks.

Procedure - working alongside the client's MDR provider

An MDR provider monitors and responds to alerts as an ongoing service; an IR team runs a time-boxed investigation. Early on, get the MDR's alert history, response actions and any containment already done - they often saw the first signal. Agree in the RoE who isolates hosts, who resets credentials and who talks to the client, so actions aren't duplicated or contradictory. Use their telemetry access, but keep your own evidence copies and chain of custody.

Decision guide - contain now or observe first

It depends on tempo of harm and intel value. Ransomware pre-encryption: contain fast. Nation-state in long-dwell data theft: observe briefly for scope - what else they touch, staging paths, egress patterns - then coordinated take-down. In every case, protect crown jewels first (IdP, DC, backups, EDR console). Align with client risk tolerance and counsel. Document your reasoning so the decision survives post-incident scrutiny.

Template - privileged factual-findings report outline
  1. Preamble marking privilege (prepared at direction of counsel in anticipation of litigation).
  2. Executive summary.
  3. Engagement scope & methodology.
  4. Timeline of adversary activity.
  5. Initial access & patient zero.
  6. Lateral movement & escalation.
  7. Persistence.
  8. Collection & exfiltration - data at risk, data confirmed exfiltrated (volume, type, individuals).
  9. Impact - what the adversary did, what they touched but didn't take, destructive actions.
  10. Remediation taken during engagement.
  11. Residual risk + recommendations.
  12. Appendices: IOCs, ATT&CK mapping, host-level triage summaries, query library.
Adversary reference - SCATTERED SPIDER attack chain
  1. Reconnaissance of target orgs via LinkedIn, data brokers, infostealer logs.
  2. Social engineering - SMS phish w/ 0ktapus kit, vishing the help desk impersonating an employee for MFA factor reset.
  3. Account takeover, register attacker device for primary refresh token.
  4. Enumerate SSO landscape - Okta/Entra → downstream apps (AWS, Snowflake, Salesforce, VPN, Citrix, VDI).
  5. Pivot via RMM tools (ScreenConnect, AnyDesk) and tunneling (ngrok, Tailscale).
  6. Exfil (cloud storage, dev data warehouses) + ransomware deployment on-prem (ALPHV → RansomHub → DragonForce affiliate rotation).
  7. Extortion with threat of leak + public pressure.