From 53ab5f948c3e0c512d52f86b4b9731ce15d21106 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:57:21 +0100 Subject: [PATCH 01/14] docs: simplify public runbook introductions while preserving procedures --- .../business-email-compromise-bec-investigation-runbook.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/defensive-security/dfir/runbooks/business-email-compromise-bec-investigation-runbook.md b/defensive-security/dfir/runbooks/business-email-compromise-bec-investigation-runbook.md index 4631649..ef2d0d5 100644 --- a/defensive-security/dfir/runbooks/business-email-compromise-bec-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/business-email-compromise-bec-investigation-runbook.md @@ -1,6 +1,11 @@ # Business Email Compromise (BEC) Investigation Runbook -> **Technical remediation status (20 October 2026): STATIC SAFETY REVIEW ONLY.** This legacy runbook includes investigation queries and operational procedures that have **not** been run or verified against a current tenant/lab. Verify query table/column schemas and all cmdlet permissions before use. State-changing steps need incident-command approval, target verification, preserved evidence and post-action confirmation. Follow the [Runbook Technical Safety and Validation Standard](runbook-technical-safety-standard.md).\n\n +Investigate suspected mailbox compromise, unauthorised access and payment fraud using identity, email and mailbox evidence. + +**Validation:** Static safety reviewed; queries and commands require local testing +**Reviewed:** 20 October 2026 + + ## SOC & DFIR Operations Guide **Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access From c296f67488d6edad4a5ea0cbbb91617038ee5e80 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:57:26 +0100 Subject: [PATCH 02/14] docs: simplify public runbook introductions while preserving procedures --- .../ransomware-investigation-and-response-runbook.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/defensive-security/dfir/runbooks/ransomware-investigation-and-response-runbook.md b/defensive-security/dfir/runbooks/ransomware-investigation-and-response-runbook.md index 9a86bc5..ee9ae94 100644 --- a/defensive-security/dfir/runbooks/ransomware-investigation-and-response-runbook.md +++ b/defensive-security/dfir/runbooks/ransomware-investigation-and-response-runbook.md @@ -1,6 +1,11 @@ # Ransomware Investigation & Response Runbook -> **Technical remediation status (20 October 2026): STATIC SAFETY REVIEW ONLY.** This legacy runbook includes investigation queries and operational procedures that have **not** been run or verified against a current tenant/lab. Verify query table/column schemas and all cmdlet permissions before use. State-changing steps need incident-command approval, target verification, preserved evidence and post-action confirmation. Follow the [Runbook Technical Safety and Validation Standard](runbook-technical-safety-standard.md).\n\n +Investigate suspected ransomware, establish affected systems and coordinate controlled containment and recovery. + +**Validation:** Static safety reviewed; queries and commands require local testing +**Reviewed:** 20 October 2026 + + ## SOC & DFIR Operations Guide **Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access From cf6f035cdf0e329f59f703d31c12709d6c089920 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:57:33 +0100 Subject: [PATCH 03/14] docs: simplify public runbook introductions while preserving procedures --- .../dfir/runbooks/identity-attack-investigation-runbook.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/defensive-security/dfir/runbooks/identity-attack-investigation-runbook.md b/defensive-security/dfir/runbooks/identity-attack-investigation-runbook.md index 736cada..5d582fe 100644 --- a/defensive-security/dfir/runbooks/identity-attack-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/identity-attack-investigation-runbook.md @@ -1,6 +1,11 @@ # Identity Attack Investigation Runbook -> **Technical remediation status (20 October 2026): STATIC SAFETY REVIEW ONLY.** This legacy runbook includes investigation queries and operational procedures that have **not** been run or verified against a current tenant/lab. Verify query table/column schemas and all cmdlet permissions before use. State-changing steps need incident-command approval, target verification, preserved evidence and post-action confirmation. Follow the [Runbook Technical Safety and Validation Standard](runbook-technical-safety-standard.md).\n\n +Examine suspicious identity activity across Microsoft Entra ID and Active Directory, then assess access and persistence. + +**Validation:** Static safety reviewed; queries and commands require local testing +**Reviewed:** 20 October 2026 + + ## SOC & DFIR Operations Guide **Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access From 6239985c2c91730008cc1eefd760d40d00f59a0c Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:57:38 +0100 Subject: [PATCH 04/14] docs: simplify public runbook introductions while preserving procedures --- .../runbooks/lateral-movement-investigation-runbook.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/defensive-security/dfir/runbooks/lateral-movement-investigation-runbook.md b/defensive-security/dfir/runbooks/lateral-movement-investigation-runbook.md index b18588d..ef07e64 100644 --- a/defensive-security/dfir/runbooks/lateral-movement-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/lateral-movement-investigation-runbook.md @@ -1,6 +1,11 @@ # Lateral Movement Investigation Runbook -> **Technical remediation status (20 October 2026): STATIC SAFETY REVIEW ONLY.** This legacy runbook includes investigation queries and operational procedures that have **not** been run or verified against a current tenant/lab. Verify query table/column schemas and all cmdlet permissions before use. State-changing steps need incident-command approval, target verification, preserved evidence and post-action confirmation. Follow the [Runbook Technical Safety and Validation Standard](runbook-technical-safety-standard.md).\n\n +Trace suspicious authentication and remote administration across hosts, identities and network connections. + +**Validation:** Static safety reviewed; queries and commands require local testing +**Reviewed:** 20 October 2026 + + ## SOC & DFIR Operations Guide **Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access From ba2efef170aec5b06d95223ea02326a2c4df5377 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:57:42 +0100 Subject: [PATCH 05/14] docs: simplify public runbook introductions while preserving procedures --- .../dfir/runbooks/malware-attack-investigation-runbook.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/defensive-security/dfir/runbooks/malware-attack-investigation-runbook.md b/defensive-security/dfir/runbooks/malware-attack-investigation-runbook.md index 5f4f02a..9241c99 100644 --- a/defensive-security/dfir/runbooks/malware-attack-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/malware-attack-investigation-runbook.md @@ -1,10 +1,9 @@ # Malware Attack Investigation Runbook -### SOC & DFIR Operations Guide +Investigate suspicious endpoint execution, persistence and network activity before planning containment. -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access - -*** +**Validation:** Not independently tested +**Reviewed:** 20 October 2026 ## Overview & Scope From 1f6a847a31e367454c78db74f9880adb5e76ea4d Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:57:46 +0100 Subject: [PATCH 06/14] docs: simplify public runbook introductions while preserving procedures --- .../runbooks/data-exfiltration-investigation-runbook.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/defensive-security/dfir/runbooks/data-exfiltration-investigation-runbook.md b/defensive-security/dfir/runbooks/data-exfiltration-investigation-runbook.md index 592f976..f626468 100644 --- a/defensive-security/dfir/runbooks/data-exfiltration-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/data-exfiltration-investigation-runbook.md @@ -1,10 +1,9 @@ # Data Exfiltration Investigation Runbook -## SOC & DFIR Operations Guide +Assess suspected data movement using endpoint, cloud and network evidence while preserving uncertainty. -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access. - -*** +**Validation:** Not independently tested +**Reviewed:** 20 October 2026 ## Overview & Scope From 2b5061784395a8bdcc7f9ab0e6f2a8e552af229f Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:57:50 +0100 Subject: [PATCH 07/14] docs: simplify public runbook introductions while preserving procedures --- ...ccess-and-privilege-escalation-investigation-runbook.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/defensive-security/dfir/runbooks/unauthorised-access-and-privilege-escalation-investigation-runbook.md b/defensive-security/dfir/runbooks/unauthorised-access-and-privilege-escalation-investigation-runbook.md index 6300921..141171e 100644 --- a/defensive-security/dfir/runbooks/unauthorised-access-and-privilege-escalation-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/unauthorised-access-and-privilege-escalation-investigation-runbook.md @@ -1,10 +1,9 @@ # Unauthorised Access & Privilege Escalation Investigation Runbook -## SOC & DFIR Operations Guide +Investigate unusual account access and privilege changes across on-premises and cloud identity systems. -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access - -*** +**Validation:** Not independently tested +**Reviewed:** 20 October 2026 ## Overview & Scope From 1cf0adf53b6f6a0b13dd49f07ead90f008cfb99f Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:58:19 +0100 Subject: [PATCH 08/14] docs: remove duplicated guide headings and generic introductory text --- ...ness-email-compromise-bec-investigation-runbook.md | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/defensive-security/dfir/runbooks/business-email-compromise-bec-investigation-runbook.md b/defensive-security/dfir/runbooks/business-email-compromise-bec-investigation-runbook.md index ef2d0d5..127573a 100644 --- a/defensive-security/dfir/runbooks/business-email-compromise-bec-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/business-email-compromise-bec-investigation-runbook.md @@ -5,16 +5,7 @@ Investigate suspected mailbox compromise, unauthorised access and payment fraud **Validation:** Static safety reviewed; queries and commands require local testing **Reviewed:** 20 October 2026 - -## SOC & DFIR Operations Guide - -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access - -*** - -## Overview & Scope - -This runbook provides standardised procedures for investigating Business Email Compromise (BEC) attacks across the Microsoft 365 environment. BEC attacks are sophisticated social engineering schemes that exploit email to defraud organisations, often resulting in significant financial losses and data breaches. +## Investigation scope ### What is Business Email Compromise? From bf33b32af122291cd656977621e3afbf4d994f3f Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:58:22 +0100 Subject: [PATCH 09/14] docs: remove duplicated guide headings and generic introductory text --- .../ransomware-investigation-and-response-runbook.md | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/defensive-security/dfir/runbooks/ransomware-investigation-and-response-runbook.md b/defensive-security/dfir/runbooks/ransomware-investigation-and-response-runbook.md index ee9ae94..ce0c037 100644 --- a/defensive-security/dfir/runbooks/ransomware-investigation-and-response-runbook.md +++ b/defensive-security/dfir/runbooks/ransomware-investigation-and-response-runbook.md @@ -5,16 +5,7 @@ Investigate suspected ransomware, establish affected systems and coordinate cont **Validation:** Static safety reviewed; queries and commands require local testing **Reviewed:** 20 October 2026 - -## SOC & DFIR Operations Guide - -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access - -*** - -## Overview & Scope - -This runbook provides standardised procedures for investigating and responding to ransomware attacks across the hybrid enterprise environment. Ransomware incidents require rapid, coordinated response to minimise damage, preserve evidence, and enable recovery. Time is critical—every minute of delay can result in additional encrypted systems and data loss. +## Investigation scope ### What is Ransomware? From 45ca4222220eb782c85a0c4178df0965d7188197 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:58:26 +0100 Subject: [PATCH 10/14] docs: remove duplicated guide headings and generic introductory text --- .../runbooks/identity-attack-investigation-runbook.md | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/defensive-security/dfir/runbooks/identity-attack-investigation-runbook.md b/defensive-security/dfir/runbooks/identity-attack-investigation-runbook.md index 5d582fe..e841c76 100644 --- a/defensive-security/dfir/runbooks/identity-attack-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/identity-attack-investigation-runbook.md @@ -5,16 +5,7 @@ Examine suspicious identity activity across Microsoft Entra ID and Active Direct **Validation:** Static safety reviewed; queries and commands require local testing **Reviewed:** 20 October 2026 - -## SOC & DFIR Operations Guide - -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access - -*** - -## Overview & Scope - -This runbook provides standardised procedures for investigating identity-based attacks across the hybrid enterprise environment. It covers detection, investigation, containment, and remediation workflows for both on-premises Active Directory and cloud identity platforms. +## Investigation scope ### Identity Attack Categories From 13fe78832629f179e3188b9a398473f3e66d7be9 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:58:31 +0100 Subject: [PATCH 11/14] docs: remove duplicated guide headings and generic introductory text --- .../lateral-movement-investigation-runbook.md | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/defensive-security/dfir/runbooks/lateral-movement-investigation-runbook.md b/defensive-security/dfir/runbooks/lateral-movement-investigation-runbook.md index ef07e64..87ef8c3 100644 --- a/defensive-security/dfir/runbooks/lateral-movement-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/lateral-movement-investigation-runbook.md @@ -5,16 +5,7 @@ Trace suspicious authentication and remote administration across hosts, identiti **Validation:** Static safety reviewed; queries and commands require local testing **Reviewed:** 20 October 2026 - -## SOC & DFIR Operations Guide - -**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access - -*** - -## Overview & Scope - -This runbook provides standardised procedures for investigating lateral movement attacks across the hybrid enterprise environment. Lateral movement is a critical phase in the attack lifecycle where adversaries move through a network in search of key assets and data. Detecting and disrupting lateral movement is essential to preventing major breaches. +## Investigation scope ### Lateral Movement Definition From 8969512363a58751c4179844319a2901d496ed2e Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:58:35 +0100 Subject: [PATCH 12/14] docs: remove duplicated guide headings and generic introductory text --- .../dfir/runbooks/malware-attack-investigation-runbook.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/defensive-security/dfir/runbooks/malware-attack-investigation-runbook.md b/defensive-security/dfir/runbooks/malware-attack-investigation-runbook.md index 9241c99..754685d 100644 --- a/defensive-security/dfir/runbooks/malware-attack-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/malware-attack-investigation-runbook.md @@ -5,9 +5,7 @@ Investigate suspicious endpoint execution, persistence and network activity befo **Validation:** Not independently tested **Reviewed:** 20 October 2026 -## Overview & Scope - -This runbook provides standardised procedures for investigating malware-based attacks across the hybrid enterprise environment. It covers detection, triage, investigation, containment, eradication, and recovery workflows using Microsoft Defender XDR, Sentinel, and Palo Alto Prisma Access. +## Investigation scope ### Malware Categories From 1f777b888dacaa5a47610f2505d68db727aa1c6e Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:58:42 +0100 Subject: [PATCH 13/14] docs: remove duplicated guide headings and generic introductory text --- .../dfir/runbooks/data-exfiltration-investigation-runbook.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/defensive-security/dfir/runbooks/data-exfiltration-investigation-runbook.md b/defensive-security/dfir/runbooks/data-exfiltration-investigation-runbook.md index f626468..44b8cf5 100644 --- a/defensive-security/dfir/runbooks/data-exfiltration-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/data-exfiltration-investigation-runbook.md @@ -5,9 +5,7 @@ Assess suspected data movement using endpoint, cloud and network evidence while **Validation:** Not independently tested **Reviewed:** 20 October 2026 -## Overview & Scope - -This runbook provides standardised procedures for investigating data exfiltration attacks across the hybrid enterprise environment. Data exfiltration is a critical phase in the attack lifecycle where adversaries steal sensitive data from the organisation, often representing the primary objective of sophisticated attacks. +## Investigation scope ### What is Data Exfiltration? From 5fc620b3b485fe2d91b80293e97ff04e45683f04 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:58:46 +0100 Subject: [PATCH 14/14] docs: remove duplicated guide headings and generic introductory text --- ...d-access-and-privilege-escalation-investigation-runbook.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/defensive-security/dfir/runbooks/unauthorised-access-and-privilege-escalation-investigation-runbook.md b/defensive-security/dfir/runbooks/unauthorised-access-and-privilege-escalation-investigation-runbook.md index 141171e..ac11bb9 100644 --- a/defensive-security/dfir/runbooks/unauthorised-access-and-privilege-escalation-investigation-runbook.md +++ b/defensive-security/dfir/runbooks/unauthorised-access-and-privilege-escalation-investigation-runbook.md @@ -5,9 +5,7 @@ Investigate unusual account access and privilege changes across on-premises and **Validation:** Not independently tested **Reviewed:** 20 October 2026 -## Overview & Scope - -This runbook provides standardised procedures for investigating unauthorised access attempts and privilege escalation attacks across the hybrid enterprise environment. It covers detection, investigation, containment, and remediation workflows for both on-premises Active Directory and cloud identity platforms. +## Investigation scope ### Attack Categories