Windows & Active Directory playbooks #

Playbooks for incidents centred on Windows estates and Active Directory. Expand a playbook for step-by-step actions; adapt the order to the environment and the rules of engagement, and record each step in your notes as you go. All playbooks.

Playbook - ransomware, first six hours on site
  1. Signed engagement letter / RoE acknowledged. Confirm breach coach involved + carrier approval.
  2. Containment posture: is encryption still spreading? If yes, isolate affected VLANs, kill lateral paths (disable SMB/WinRM at perimeter), revoke privileged creds, protect backups (air-gap or pull offline).
  3. Preserve: image a representative encrypted host; carve a sample of the ransomware binary from a staging folder; pull EDR console data to a durable store.
  4. Patient zero hunting in parallel: EDR console for earliest unusual process; AD for first anomalous logon; VPN/edge logs for initial access.
  5. Identify family + affiliate - negotiation posture; OFAC check.
  6. Protect what's left - DC/EDR/backup consoles get the top-tier scrutiny. Rotate domain admin / tier-0.
  7. Comms: executive brief at hour 6 - what we know, what we don't, next 24h plan, decisions needed (pay/no-pay posture, disclosure clock).