10.1 Specialized Incident Response Playbooks

Foundations of Attack-Specific Incident Response Playbooks

While standardized incident response lifecycles such as the organization’s incident-response framework and SANS PICERL establish strategic response phases, enterprise Security Operations Centers (SOCs) cannot rely on generalized guidelines during high-velocity cyberattacks. In active intrusions, seconds dictate whether an incident is contained locally or escalates into an enterprise-wide catastrophe. Attack-Specific Incident Response Playbooks are deterministic, repeatable standard operating procedures tailored to distinct threat archetypes. They define precise detection thresholds, automated and manual triage checklists, high-impact containment levers, forensic evidence preservation procedures, and post-remediation validation gates.

A mature SOC operationalizes specialized playbooks for four high-impact attack vectors:

1. Ransomware and Cyber Extortion
2. Phishing and Business Email Compromise (BEC)
3. Web Application Exploitation (SQL Injection / RCE)
4. Insider Threat and Unauthorized Data Exfiltration

---

Playbook: Network Security Incident Response

Network incidents include denial-of-service conditions, unauthorized scanning, command-and-control traffic, rogue devices, route or DNS manipulation, and lateral movement. Start by defining the affected service, address space, trust boundary, time window, and business or safety impact. Preserve the alert, packet or flow evidence, firewall and proxy records, DNS answers, DHCP/VPN mappings, network-device configuration changes, and synchronized time context. Validate direction and ownership: a source IP in one product may be a translated address, proxy, load balancer, or shared egress point rather than the originating host.

Select containment that matches the evidence and operational risk. For an internal compromised endpoint, approved options may include EDR isolation, switch-port or NAC quarantine, credential restriction, and narrowly scoped firewall blocks. For malicious external traffic, use time-bounded ACL, WAF, rate-limit, sinkhole, or DNS controls with the network or application owner. Volumetric denial of service may require the ISP, CDN, cloud provider, or scrubbing service because an on-premises block applied after a saturated link cannot restore upstream capacity. Route, DNS, and firewall changes should follow emergency-change authority, include rollback criteria, and preserve the prior configuration.

Investigate beyond the first blocked connection. Correlate the network indicator with endpoint processes, identities, authentication, asset role, threat intelligence, and subsequent destinations. Determine whether traffic was attempted or allowed, whether an application exchange occurred, and whether the activity indicates discovery, exploitation, command and control, lateral movement, or exfiltration. A threat-listed IP or unusual port is a lead, not proof of compromise; conversely, encrypted or approved-port traffic can still be malicious.

Eradication addresses the cause—such as compromised credentials, malware persistence, an exposed service, a poisoned resolver, or unauthorized device—not merely the observable connection. Recovery restores routes, services, and access in phases while monitoring error rates, flow patterns, authentication, endpoint telemetry, and recurrence. Close the incident only after documenting affected assets, confirmed impact, evidence and decisions, control changes, residual risk, owners, and detection improvements.

---

Playbook 1: Ransomware and Cyber Extortion Response

Ransomware attacks have evolved from opportunistic endpoint encryption into multi-extortion campaigns combining data exfiltration, shadow copy destruction, active directory subversion, and infrastructure encryption.

[Ransomware Attack Progression]
Initial Access --> Credential Harvesting --> Lateral Movement --> Shadow Copy Wipe --> Mass Encryption & Extortion
(Phishing/VPN)      (Mimikatz/LSASS)        (PsExec/WMI/RDP)     (vssadmin/bcdedit)   (Canary Alert / Sysmon ID 11)

1. Detection Telemetry & Indicator Validation

SOC analysts must recognize precursor indicators and execution telemetry before mass file encryption locks critical file systems:

• Shadow Copy & Boot Recovery Destruction: Adversaries routinely delete volume shadow copies and disable Windows recovery configurations to prevent victims from rolling back disk state. Analysts should alert on process creation events (Windows Security Event ID 4688, Sysmon Event ID 1) containing:
  • vssadmin.exe delete shadows /all /quiet
  • wmic.exe shadowcopy delete
  • wbadmin.exe delete catalog -quiet
  • bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  • bcdedit.exe /set {default} recoveryenabled No
• Mass File System Modifications: Spikes in Sysmon Event ID 11 (FileCreate) involving high-entropy files, unexpected file extension appendings (e.g., .lockbit, .blackcat, .crypto), and the dropping of ransom notes (e.g., README_RESTORE.txt).
• Canary File Alerts: File Integrity Monitoring (FIM) tripwires placed in network shares. If a canary file is modified, an automated critical alert triggers immediate response.

2. Immediate Triage & Containment Levers

• Host Network Isolation via EDR: When the evidence and business or safety impact justify it, an authorized responder can issue an EDR isolation command. Product behavior and configured exclusions vary, so confirm which management, monitoring, and remediation channels remain available and record a rollback path.
• Preserve Volatile Evidence Deliberately: Avoid a routine reboot because power loss destroys running processes, sockets, injected code, and possible in-memory keys. When safe and authorized, acquire relevant volatile evidence before disruptive action. The incident commander may still choose rapid shutdown, process termination, or isolation when ongoing encryption, destructive behavior, safety, or operational impact outweighs the evidentiary value; document the tradeoff.
• Control Cloud and Backup Synchronization: If evidence shows that synchronization could propagate encrypted or deleted content, use approved administrative controls or terminate the relevant sync process while preserving logs and recovery metadata. Coordinate with storage and backup owners because indiscriminate termination can interrupt evidence collection or business recovery.

  # Emergency termination of common cloud synchronization daemons
  Stop-Process -Name "OneDrive", "Dropbox", "GoogledriveFS" -Force -ErrorAction SilentlyContinue
  

• Preserve Ransomware Artifacts: Collect samples of the dropped ransom note, encrypted file samples, and any dropped executable binaries or scripts in a forensically sound container for hash calculation (Get-FileHash -Algorithm SHA256 <file>).

3. Scoping & Root Cause Investigation

• Identify Patient Zero: Correlate Windows Security Event ID 4624 (Successful Logon) and Event ID 4625 (Failed Logon). Focus on Logon Type 10 (RemoteInteractive / RDP), Logon Type 3 (Network logon / SMB), and external VPN authentication logs.
• Trace Lateral Movement: Inspect Windows Security Event ID 7045 (Service Creation) indicating PsExec or Cobalt Strike service execution (PSEXESVC.exe), alongside WMI process launches (Sysmon Event ID 1 where parent is WmiPrvSE.exe).
• Exfiltration Verification: Review perimeter firewall, proxy, and NDR logs for bulk outbound egress traffic to cloud storage providers (e.g., Mega.nz, Rclone, Dropbox) occurring prior to the encryption timestamp.

4. Post-Remediation & Recovery

• Restore from Protected, Verified Backups or Rebuild from a Trusted Baseline: Choose rebuild, restoration, or carefully validated remediation according to scope, evidence, operational constraints, and the incident-response plan. Rebuild from verified golden images and restore databases from air-gapped, immutable (WORM - Write Once, Read Many) offline backups.
• Evaluate Decryptors: Consult public repositories such as the No More Ransom initiative before entertaining ransom negotiations.
• Regulatory & Legal Notification: Coordinate promptly with privacy, legal, compliance, and regulatory specialists. Triggers, clocks, recipients, exceptions, and content differ—for example, GDPR’s supervisory-authority rule is generally 72 hours after awareness when the personal-data breach is likely to risk individuals; U.S. public-company Form 8-K timing is tied to a materiality determination and can involve authorized delay; HIPAA timing varies with breach size and circumstances. Treat examples as issue-spotters, not legal conclusions.

---

Playbook 2: Phishing and Business Email Compromise (BEC) Response

Phishing remains the predominant initial access vector. In Business Email Compromise (BEC), adversaries leverage compromised corporate accounts to redirect financial payments or initiate unauthorized wire transfers.

1. Mailbox Triage & Forensic Header Analysis

When triaging a reported suspicious email, the analyst must parse raw RFC 5322 message headers:

• Routing & Header Verification: Trace the Received: headers chronologically from bottom to top to identify the originating SMTP server IP.
• Authentication Alignment:
  • SPF (Sender Policy Framework): Validates if the sending mail server IP is authorized by the domain's DNS SPF record (v=spf1 ...).
  • DKIM (DomainKeys Identified Mail): Cryptographically verifies that the email body and headers were not altered in transit.
  • DMARC (Domain-based Message Authentication, Reporting, and Conformance): Verifies SPF and DKIM alignment against the sender's policy (p=none, p=quarantine, p=reject).
• URL Sandboxing & Attachment Detonation: Detonate URLs and attachments within isolated dynamic analysis sandboxes to evaluate payload execution, credential-harvesting landing pages, and secondary drop payloads.

2. Remediating Compromised User Accounts

If a user submitted credentials to a phishing landing page or executed an attachment:

1. Revoke and Restrict Identity Access: Revoke provider-controlled refresh tokens and sessions, disable or restrict sign-in when appropriate, and address application-controlled sessions separately. Revocation can take time and does not guarantee every issued access token stops immediately.

   # Invalidate all active refresh tokens and sessions for the compromised identity
   Revoke-MgUserSignOutSession -UserId "victim.user@enterprise.com"
   

2. Enforce Immediate Password Rotation & MFA Reset: Reset the user's directory password and revoke registered MFA devices if session hijacking or MFA fatigue occurred.
3. Audit and Eradicate Mailbox Forwarding Rules: Threat actors frequently establish hidden inbox rules to divert incoming financial discussions to external attacker-controlled mailboxes.

   # Enumerate all inbox rules looking for external forwarding or deletion actions
   Get-InboxRule -Mailbox "victim.user@enterprise.com" | Select-Object Name, Description, ForwardTo, RedirectTo, DeleteMessage
   # Remove unauthorized forwarding rules
   Remove-InboxRule -Mailbox "victim.user@enterprise.com" -Identity "MaliciousRuleName" -Confirm:$false
   

4. Audit Illicit OAuth Enterprise App Consents: Adversaries often trick users into authorizing malicious third-party OAuth enterprise applications that maintain persistent API access to mailbox contents (Mail.Read, Mail.ReadWrite) even after password resets. Inspect enterprise app permissions via Microsoft Graph / Entra admin center and revoke consent grants.

3. Enterprise-Wide Tenant Remediation

Execute an automated compliance search across the entire Microsoft 365 or Google Workspace tenant to identify and purge identical malicious emails from all recipient mailboxes:

# Create a compliance search across all mailboxes for the phishing message
New-ComplianceSearch -Name "PhishPurge_Campaign2026" -ExchangeLocation All -ContentMatchQuery '(Subject:"Urgent: Overdue Invoice") AND (From:"billing@spoofed-vendor.com")'
Start-ComplianceSearch -Identity "PhishPurge_Campaign2026"

# Purge the identified phishing messages enterprise-wide
New-ComplianceSearchAction -SearchName "PhishPurge_Campaign2026" -Purge -PurgeType HardDelete -Confirm:$false

---

Playbook 3: Web Application Attack and SQL Injection (SQLi) Response

Web-facing applications are subject to continuous exploitation attempts targeting databases, authentication bypasses, and remote code execution.

1. WAF Triage & Payload Verification

Correlate Web Application Firewall (WAF) alerts (AWS WAF, Cloudflare, ModSecurity) with origin web server access logs (Apache/Nginx/IIS):

• Payload Inspection: Identify common SQL injection patterns in HTTP GET/POST parameters:
  • ' OR '1'='1 or ' UNION SELECT null, username, password FROM users--
  • Time-based blind payloads: '; WAITFOR DELAY '0:0:15'-- or AND (SELECT * FROM (SELECT(SLEEP(10)))a)
  • Error-based payloads: CAST((SELECT table_name FROM information_schema.tables) AS INT)
• HTTP Status Code Analysis: Compare request payloads against origin web server response codes. An HTTP 500 (Internal Server Error) indicates unhandled database exceptions, while HTTP 200 responses accompanied by abnormal byte lengths indicate potential query execution and data leakage.

2. Database Audit Log Review & Exfiltration Scoping

• Database Engine Log Analysis: Inspect database transaction and query audit logs (e.g., MySQL general_log, Microsoft SQL Server Extended Events, PostgreSQL log_statement = 'all').
• Quantify Exfiltration Scope: Identify whether the attacker extracted schema metadata, customer records, or credentials. Match database query completion timestamps with outbound network traffic spikes from the database tier.

3. Immediate Containment & Virtual Patching

• Deploy WAF Virtual Patch: Do not wait for software developers to rewrite and regression-test application source code. Deploy immediate custom WAF regex filtering rules to drop matching payloads at the perimeter reverse proxy.
• Isolate Application Tier: If Remote Code Execution (RCE) via xp_cmdshell or web shell upload occurred, isolate the affected web server instance and rotate database service account credentials immediately.

4. Root Cause Eradication

• Enforce Parameterized Queries: Audit the vulnerable application code and replace dynamic string concatenation with Parameterized Queries / Prepared Statements (e.g., PreparedStatement in Java, parameterized SqlCommand in .NET).
• Principle of Least Privilege: Strip DROP, ALTER, xp_cmdshell, and LOAD_FILE permissions from the web application's database service account.

---

Playbook 4: Insider Threat and Data Theft Response

Insider incidents involve authenticated employees or contractors abusing authorized access privileges to exfiltrate proprietary source code, customer databases, or trade secrets.

1. Detection Telemetry & Indicator Validation

• Data Loss Prevention (DLP) Triggers: High-volume DLP endpoint alerts flagging credit card numbers, Social Security Numbers, or proprietary document tags being transferred to unapproved destinations.
• Cloud Storage Anomalies: Spikes in file uploads to personal cloud storage (e.g., Personal OneDrive, WeTransfer) or mass downloads from enterprise SharePoint repositories.
• Anomalous Off-Hours Activity: Large volume archive creation (.zip, .7z, .tar.gz) during non-business hours by employees who have recently submitted formal resignations.

2. Removable Media (USB) Forensics

SOC analysts must interrogate Windows forensic artifacts to prove unauthorized USB mass storage connectivity:

• Windows System Event Log:
  • Event ID 20001 (UserPnp): Successfully completed driver installation for a plug-and-play device.
  • Event ID 20003 (UserPnp): Bus driver service added for the device.
• Registry Analysis: Interrogate the SYSTEM hive under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR to extract vendor ID, product ID, and unique hardware serial numbers.
• SetupAPI Logs: Review C:\Windows\INF\setupapi.dev.log for the exact first and last connection timestamps of the USB device.
• Shellbags & LNK Files: Examine user profile Shellbag registry keys and shortcut (.lnk) files to demonstrate that the user actively navigated and opened files located on the external drive letter.

3. Inter-Departmental Coordination & Containment

• Chain of Custody & Legal Alignment: Insider threat investigations routinely culminate in civil litigation or criminal prosecution. Maintain strict RFC 3227 evidentiary chain of custody. Do not confront the suspect prior to consulting Human Resources (HR) and Corporate Legal Counsel.
• Coordinated Account Revocation: Coordinate with IT Identity teams to revoke Active Directory credentials, VPN access, and building badge physical access synchronously to prevent retaliatory data destruction.

---

Incident Playbook Execution Matrix

The following matrix summarizes the technical response lifecycle across the four specialized attack vectors: