diff --git a/defensive-security/dfir/runbooks/business-email-compromise-bec-investigation-runbook.md b/defensive-security/dfir/runbooks/business-email-compromise-bec-investigation-runbook.md index 4631649..127573a 100644 --- a/defensive-security/dfir/runbooks/business-email-compromise-bec-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/business-email-compromise-bec-investigation-runbook.md @@ -1,15 +1,11 @@ # Business Email Compromise (BEC) Investigation Runbook -> **Technical remediation status (20 October 2026): STATIC SAFETY REVIEW ONLY.** This legacy runbook includes investigation queries and operational procedures that have **not** been run or verified against a current tenant/lab. Verify query table/column schemas and all cmdlet permissions before use. State-changing steps need incident-command approval, target verification, preserved evidence and post-action confirmation. Follow the [Runbook Technical Safety and Validation Standard](runbook-technical-safety-standard.md).\n\n -## SOC & DFIR Operations Guide +Investigate suspected mailbox compromise, unauthorised access and payment fraud using identity, email and mailbox evidence. -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access +**Validation:** Static safety reviewed; queries and commands require local testing +**Reviewed:** 20 October 2026 -*** - -## Overview & Scope - -This runbook provides standardised procedures for investigating Business Email Compromise (BEC) attacks across the Microsoft 365 environment. BEC attacks are sophisticated social engineering schemes that exploit email to defraud organisations, often resulting in significant financial losses and data breaches. +## Investigation scope ### What is Business Email Compromise? diff --git a/defensive-security/dfir/runbooks/data-exfiltration-investigation-runbook.md b/defensive-security/dfir/runbooks/data-exfiltration-investigation-runbook.md index 592f976..44b8cf5 100644 --- a/defensive-security/dfir/runbooks/data-exfiltration-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/data-exfiltration-investigation-runbook.md @@ -1,14 +1,11 @@ # Data Exfiltration Investigation Runbook -## SOC & DFIR Operations Guide +Assess suspected data movement using endpoint, cloud and network evidence while preserving uncertainty. -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access. +**Validation:** Not independently tested +**Reviewed:** 20 October 2026 -*** - -## Overview & Scope - -This runbook provides standardised procedures for investigating data exfiltration attacks across the hybrid enterprise environment. Data exfiltration is a critical phase in the attack lifecycle where adversaries steal sensitive data from the organisation, often representing the primary objective of sophisticated attacks. +## Investigation scope ### What is Data Exfiltration? diff --git a/defensive-security/dfir/runbooks/identity-attack-investigation-runbook.md b/defensive-security/dfir/runbooks/identity-attack-investigation-runbook.md index 736cada..e841c76 100644 --- a/defensive-security/dfir/runbooks/identity-attack-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/identity-attack-investigation-runbook.md @@ -1,15 +1,11 @@ # Identity Attack Investigation Runbook -> **Technical remediation status (20 October 2026): STATIC SAFETY REVIEW ONLY.** This legacy runbook includes investigation queries and operational procedures that have **not** been run or verified against a current tenant/lab. Verify query table/column schemas and all cmdlet permissions before use. State-changing steps need incident-command approval, target verification, preserved evidence and post-action confirmation. Follow the [Runbook Technical Safety and Validation Standard](runbook-technical-safety-standard.md).\n\n -## SOC & DFIR Operations Guide +Examine suspicious identity activity across Microsoft Entra ID and Active Directory, then assess access and persistence. -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access +**Validation:** Static safety reviewed; queries and commands require local testing +**Reviewed:** 20 October 2026 -*** - -## Overview & Scope - -This runbook provides standardised procedures for investigating identity-based attacks across the hybrid enterprise environment. It covers detection, investigation, containment, and remediation workflows for both on-premises Active Directory and cloud identity platforms. +## Investigation scope ### Identity Attack Categories diff --git a/defensive-security/dfir/runbooks/lateral-movement-investigation-runbook.md b/defensive-security/dfir/runbooks/lateral-movement-investigation-runbook.md index b18588d..87ef8c3 100644 --- a/defensive-security/dfir/runbooks/lateral-movement-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/lateral-movement-investigation-runbook.md @@ -1,15 +1,11 @@ # Lateral Movement Investigation Runbook -> **Technical remediation status (20 October 2026): STATIC SAFETY REVIEW ONLY.** This legacy runbook includes investigation queries and operational procedures that have **not** been run or verified against a current tenant/lab. Verify query table/column schemas and all cmdlet permissions before use. State-changing steps need incident-command approval, target verification, preserved evidence and post-action confirmation. Follow the [Runbook Technical Safety and Validation Standard](runbook-technical-safety-standard.md).\n\n -## SOC & DFIR Operations Guide +Trace suspicious authentication and remote administration across hosts, identities and network connections. -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access +**Validation:** Static safety reviewed; queries and commands require local testing +**Reviewed:** 20 October 2026 -*** - -## Overview & Scope - -This runbook provides standardised procedures for investigating lateral movement attacks across the hybrid enterprise environment. Lateral movement is a critical phase in the attack lifecycle where adversaries move through a network in search of key assets and data. Detecting and disrupting lateral movement is essential to preventing major breaches. +## Investigation scope ### Lateral Movement Definition diff --git a/defensive-security/dfir/runbooks/malware-attack-investigation-runbook.md b/defensive-security/dfir/runbooks/malware-attack-investigation-runbook.md index 5f4f02a..754685d 100644 --- a/defensive-security/dfir/runbooks/malware-attack-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/malware-attack-investigation-runbook.md @@ -1,14 +1,11 @@ # Malware Attack Investigation Runbook -### SOC & DFIR Operations Guide +Investigate suspicious endpoint execution, persistence and network activity before planning containment. -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access +**Validation:** Not independently tested +**Reviewed:** 20 October 2026 -*** - -## Overview & Scope - -This runbook provides standardised procedures for investigating malware-based attacks across the hybrid enterprise environment. It covers detection, triage, investigation, containment, eradication, and recovery workflows using Microsoft Defender XDR, Sentinel, and Palo Alto Prisma Access. +## Investigation scope ### Malware Categories diff --git a/defensive-security/dfir/runbooks/ransomware-investigation-and-response-runbook.md b/defensive-security/dfir/runbooks/ransomware-investigation-and-response-runbook.md index 9a86bc5..ce0c037 100644 --- a/defensive-security/dfir/runbooks/ransomware-investigation-and-response-runbook.md +++ b/defensive-security/dfir/runbooks/ransomware-investigation-and-response-runbook.md @@ -1,15 +1,11 @@ # Ransomware Investigation & Response Runbook -> **Technical remediation status (20 October 2026): STATIC SAFETY REVIEW ONLY.** This legacy runbook includes investigation queries and operational procedures that have **not** been run or verified against a current tenant/lab. Verify query table/column schemas and all cmdlet permissions before use. State-changing steps need incident-command approval, target verification, preserved evidence and post-action confirmation. Follow the [Runbook Technical Safety and Validation Standard](runbook-technical-safety-standard.md).\n\n -## SOC & DFIR Operations Guide +Investigate suspected ransomware, establish affected systems and coordinate controlled containment and recovery. -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access +**Validation:** Static safety reviewed; queries and commands require local testing +**Reviewed:** 20 October 2026 -*** - -## Overview & Scope - -This runbook provides standardised procedures for investigating and responding to ransomware attacks across the hybrid enterprise environment. Ransomware incidents require rapid, coordinated response to minimise damage, preserve evidence, and enable recovery. Time is critical—every minute of delay can result in additional encrypted systems and data loss. +## Investigation scope ### What is Ransomware? diff --git a/defensive-security/dfir/runbooks/unauthorised-access-and-privilege-escalation-investigation-runbook.md b/defensive-security/dfir/runbooks/unauthorised-access-and-privilege-escalation-investigation-runbook.md index 6300921..ac11bb9 100644 --- a/defensive-security/dfir/runbooks/unauthorised-access-and-privilege-escalation-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/unauthorised-access-and-privilege-escalation-investigation-runbook.md @@ -1,14 +1,11 @@ # Unauthorised Access & Privilege Escalation Investigation Runbook -## SOC & DFIR Operations Guide +Investigate unusual account access and privilege changes across on-premises and cloud identity systems. -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access +**Validation:** Not independently tested +**Reviewed:** 20 October 2026 -*** - -## Overview & Scope - -This runbook provides standardised procedures for investigating unauthorised access attempts and privilege escalation attacks across the hybrid enterprise environment. It covers detection, investigation, containment, and remediation workflows for both on-premises Active Directory and cloud identity platforms. +## Investigation scope ### Attack Categories