Cyber Security Incident Response Guide

Executive Summary & IR Philosophy

In today's threat landscape, security incidents are not a matter of if, but when. Modern cyber adversaries deploy complex multi-stage attack vectors—ranging from Adversary-in-the-Middle (AiTM) phishing and zero-day exploitation to Living-off-the-Land (LotL) execution and Active Directory domain compromise. When an breach occurs, defenders cannot afford hesitation or disorganized triage. The Cyber Security Incident Response Guide provides a high-density, field-tested technical operational framework designed to equip defenders with clear, repeatable methodologies for rapidly detecting, containing, and eradicating cyber threats.

This handbook bridges the gap between high-level NIST governance guidelines and low-level command-line execution. It details how to structure a modern Computer Security Incident Response Team (CSIRT), configure granular endpoint telemetry, perform memory and disk artifact forensics, contain active threat actors, and conduct forensic evidence acquisition under strict legal chain-of-custody rules.

The PICERL Incident Response Lifecycle Deep Dive

The handbook structures enterprise triage into six interconnected phases following the SANS PICERL framework, enriched with MITRE ATT&CK mapping:

Phase 1: Preparation & Enterprise Readiness

Preparation forms the foundation of incident resilience. A team cannot respond effectively to an adversary if logging is misconfigured or centralized telemetry is absent. This section covers:

• Logging Baseline Configuration: Fine-tuning Windows Event Logs (enabling Audit Process Creation Event 4688 with command-line auditing enabled) and deploying Sysmon with SwiftOnSecurity configurations.
• Linux Telemetry: Configuring auditd rules for monitoring /etc/passwd, /etc/shadow, /etc/sudoers, and execution of binary paths.
• Centralized SIEM/EDR Deployment: Configuring agent heartbeat thresholds, establishing automated alert routing, and validating offline backup immutability.

Phase 2: Identification & Alert Triage

Distinguishing true positive security incidents from noisy false alarms requires systematic triage. Responders learn how to inspect initial Indicators of Compromise (IoCs) and Indicators of Attack (IoAs):

• Live Memory Forensics: Acquiring RAM using WinPmem or LiME and analyzing unbacked executable memory regions, code injection (`PAGE_EXECUTE_READWRITE`), and malicious process trees via Volatility 3.
• Windows Disk Artifact Analysis: Parsing Master File Table ($MFT), $LogFile, Volume Shadow Copies, Prefetch (.pf), Shimcache (AppCompatCache), and Amcache for evidence of binary execution.
• Network Telemetry: Analyzing PCAP traces for HTTP/HTTPS C2 beacons, DNS tunneling, Cobalt Strike Malleable C2 profile signatures, and abnormal outbound SMB/RDP traffic.

Field Cheatsheet: Command-Line Triage Snippets

Below is an extract of the practical command-line scripts included in Chapter 4 of the handbook for live endpoint investigation:

# 1. Check for Active Foreign TCP Connections and Process ID Mapping
Get-NetTCPConnection -State Established, Listen | 
  Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess, State | 
  Sort-Object OwningProcess

# 2. Inspect Recently Registered Windows Scheduled Tasks (Persistence Check)
Get-CimInstance Win32_ScheduledTask | 
  Where-Object { $_.State -ne "Disabled" } | 
  Select-Object TaskName, TaskPath, State

# 3. Query Security Log for Successful Logons (Event 4624) with Network Logon Type 3 or RDP Type 10
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 50 | 
  Select-Object TimeCreated, Message

# 1. Identify Listening Ports and Associated Executable Binary Paths
sudo lsof -i -P -n | grep LISTEN

# 2. Inspect Active Shell Sessions and Logged-in Users
w && last -n 20

# 3. Search for Recently Modified Executables in Web Roots or Temp Directories
find /var/www/ /tmp /var/tmp -type f -mtime -3 -ls

# 1. Print Process Tree to Spot Malicious Parent-Child Relationships (e.g. cmd.exe spawned by wmiprvse.exe)
python3 vol.py -f memory_dump.raw windows.pstree

# 2. Scan for Injected Code and Suspicious Executable Memory Regions
python3 vol.py -f memory_dump.raw windows.malfind

# 3. Extract Suspicious Process Binary to Disk for Antivirus/YARA Scanning
python3 vol.py -f memory_dump.raw windows.dumpfiles --pid 

Phase 3 & 4: Containment, Eradication & Persistence Removal

Once an adversary's presence is confirmed, responders must isolate the blast radius without alerting the threat actor prematurely. The handbook breaks down containment strategies into short-term (host-level network isolation, blocking C2 domain/IP at the perimeter firewall) and long-term phases (active directory trust isolation, Kerberos krbtgt double-password resets, global OAuth token revocation).

Eradication requires complete hunting for persistent backdoors. Threat actors frequently maintain access using:

• Windows Persistence: Registry Run keys (HKLM\Software\Microsoft\Windows\CurrentVersion\Run), WMI Event Subscriptions, Malicious Service Registrations (Event ID 7045), and DLL Search Order Hijacking.
• Linux Persistence: Malicious crontab entries, SSH authorized_keys backdoors, modified systemd service files, and LD_PRELOAD shared library hooks.
• Cloud Persistence: Malicious OAuth App registrations, backdoor service principals, and secondary MFA device registrations in Microsoft Entra ID or AWS IAM.

Complete Table of Contents & Module Syllabus

• Module 01 Foundational IR Frameworks & Enterprise Readiness

  Pages 1–12
  NIST SP 800-61 Rev 2 vs. SANS PICERL framework, CSIRT team roles, establishing logging baselines, Sysmon setup, Auditd rules, and immutable backup architecture.
• Module 02 Telemetry Aggregation, SIEM Triage & Detection Engineering

  Pages 13–24
  Configuring Windows Event Forwarding (WEF), Sigma rule creation, KQL queries for Sentinel/Elastic, alert prioritization, and initial IoC vs. IoA triage.
• Module 03 Live Host Response & Volatility 3 Memory Forensics

  Pages 25–38
  RAM acquisition (WinPmem, LiME), process tree inspection (`pstree`), DLL injection detection (`malfind`), driver scan (`driverscan`), and network connection extraction (`netscan`).
• Module 04 Windows & Linux File System Artifact Analysis

  Pages 39–52
  Parsing Master File Table (`$MFT`), Prefetch (`.pf`), Shimcache, Amcache, Registry hives (`NTUSER.DAT`), Linux `/var/log` analysis, and timeline reconstruction.
• Module 05 Enterprise Ransomware & BEC Response Playbooks

  Pages 53–64
  Step-by-step playbooks for LockBit/BlackCat ransomware, ESXi hypervisor attacks, Office 365 Business Email Compromise (BEC), and MFA fatigue bypass response.
• Module 06 Network Packet Forensics & C2 Beacon Hunting

  Pages 65–76
  Wireshark/Zeek PCAP analysis, detecting Cobalt Strike/Sliver C2 malleable profiles, DNS exfiltration detection, and TLS JA3/JA3S fingerprinting.
• Module 07 Persistence Hunting, Eradication & Remediation Engineering

  Pages 77–88
  WMI event subscription removal, scheduled task audits, Active Directory Kerberos ticket reset (`krbtgt`), Entra ID OAuth app cleanup, and clean restoration.
• Module 08 Root Cause Analysis (RCA), Reporting & Regulatory Compliance

  Pages 89–96
  Mapping incidents to MITRE ATT&CK enterprise matrix, drafting executive After-Action Reports (AAR), legal chain of custody, and CERT-In / GDPR regulatory compliance.

Who Should Read This Handbook?

This handbook is tailored specifically for technical cybersecurity professionals looking for clear, unambiguous operational guidance during high-pressure incident scenarios:

Verified Practitioner Reviews

Frequently Asked Questions