Editorial batch 01: clean seven DFIR runbook introductions

defensive-security/dfir/runbooks/business-email-compromise-bec-investigation-runbook.md

@@ -1,15 +1,11 @@
 # Business Email Compromise (BEC) Investigation Runbook
 
-> **Technical remediation status (20 October 2026): STATIC SAFETY REVIEW ONLY.** This legacy runbook includes investigation queries and operational procedures that have **not** been run or verified against a current tenant/lab. Verify query table/column schemas and all cmdlet permissions before use. State-changing steps need incident-command approval, target verification, preserved evidence and post-action confirmation. Follow the [Runbook Technical Safety and Validation Standard](runbook-technical-safety-standard.md).\n\n
-## SOC & DFIR Operations Guide
+Investigate suspected mailbox compromise, unauthorised access and payment fraud using identity, email and mailbox evidence.
 
-**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access
+**Validation:** Static safety reviewed; queries and commands require local testing  
+**Reviewed:** 20 October 2026
 
-***
-
-## Overview & Scope
-
-This runbook provides standardised procedures for investigating Business Email Compromise (BEC) attacks across the Microsoft 365 environment. BEC attacks are sophisticated social engineering schemes that exploit email to defraud organisations, often resulting in significant financial losses and data breaches.
+## Investigation scope
 
 ### What is Business Email Compromise?
 

defensive-security/dfir/runbooks/data-exfiltration-investigation-runbook.md

@@ -1,14 +1,11 @@
 # Data Exfiltration Investigation Runbook
 
-## SOC & DFIR Operations Guide
+Assess suspected data movement using endpoint, cloud and network evidence while preserving uncertainty.
 
-**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access.
+**Validation:** Not independently tested  
+**Reviewed:** 20 October 2026
 
-***
-
-## Overview & Scope
-
-This runbook provides standardised procedures for investigating data exfiltration attacks across the hybrid enterprise environment. Data exfiltration is a critical phase in the attack lifecycle where adversaries steal sensitive data from the organisation, often representing the primary objective of sophisticated attacks.
+## Investigation scope
 
 ### What is Data Exfiltration?
 

defensive-security/dfir/runbooks/identity-attack-investigation-runbook.md

@@ -1,15 +1,11 @@
 # Identity Attack Investigation Runbook
 
-> **Technical remediation status (20 October 2026): STATIC SAFETY REVIEW ONLY.** This legacy runbook includes investigation queries and operational procedures that have **not** been run or verified against a current tenant/lab. Verify query table/column schemas and all cmdlet permissions before use. State-changing steps need incident-command approval, target verification, preserved evidence and post-action confirmation. Follow the [Runbook Technical Safety and Validation Standard](runbook-technical-safety-standard.md).\n\n
-## SOC & DFIR Operations Guide
+Examine suspicious identity activity across Microsoft Entra ID and Active Directory, then assess access and persistence.
 
-**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access
+**Validation:** Static safety reviewed; queries and commands require local testing  
+**Reviewed:** 20 October 2026
 
-***
-
-## Overview & Scope
-
-This runbook provides standardised procedures for investigating identity-based attacks across the hybrid enterprise environment. It covers detection, investigation, containment, and remediation workflows for both on-premises Active Directory and cloud identity platforms.
+## Investigation scope
 
 ### Identity Attack Categories
 

defensive-security/dfir/runbooks/lateral-movement-investigation-runbook.md

@@ -1,15 +1,11 @@
 # Lateral Movement Investigation Runbook
 
-> **Technical remediation status (20 October 2026): STATIC SAFETY REVIEW ONLY.** This legacy runbook includes investigation queries and operational procedures that have **not** been run or verified against a current tenant/lab. Verify query table/column schemas and all cmdlet permissions before use. State-changing steps need incident-command approval, target verification, preserved evidence and post-action confirmation. Follow the [Runbook Technical Safety and Validation Standard](runbook-technical-safety-standard.md).\n\n
-## SOC & DFIR Operations Guide
+Trace suspicious authentication and remote administration across hosts, identities and network connections.
 
-**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access
+**Validation:** Static safety reviewed; queries and commands require local testing  
+**Reviewed:** 20 October 2026
 
-***
-
-## Overview & Scope
-
-This runbook provides standardised procedures for investigating lateral movement attacks across the hybrid enterprise environment. Lateral movement is a critical phase in the attack lifecycle where adversaries move through a network in search of key assets and data. Detecting and disrupting lateral movement is essential to preventing major breaches.
+## Investigation scope
 
 ### Lateral Movement Definition
 

defensive-security/dfir/runbooks/malware-attack-investigation-runbook.md

@@ -1,14 +1,11 @@
 # Malware Attack Investigation Runbook
 
-### SOC & DFIR Operations Guide
+Investigate suspicious endpoint execution, persistence and network activity before planning containment.
 
-**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access
+**Validation:** Not independently tested  
+**Reviewed:** 20 October 2026
 
-***
-
-## Overview & Scope
-
-This runbook provides standardised procedures for investigating malware-based attacks across the hybrid enterprise environment. It covers detection, triage, investigation, containment, eradication, and recovery workflows using Microsoft Defender XDR, Sentinel, and Palo Alto Prisma Access.
+## Investigation scope
 
 ### Malware Categories
 

defensive-security/dfir/runbooks/ransomware-investigation-and-response-runbook.md

@@ -1,15 +1,11 @@
 # Ransomware Investigation & Response Runbook
 
-> **Technical remediation status (20 October 2026): STATIC SAFETY REVIEW ONLY.** This legacy runbook includes investigation queries and operational procedures that have **not** been run or verified against a current tenant/lab. Verify query table/column schemas and all cmdlet permissions before use. State-changing steps need incident-command approval, target verification, preserved evidence and post-action confirmation. Follow the [Runbook Technical Safety and Validation Standard](runbook-technical-safety-standard.md).\n\n
-## SOC & DFIR Operations Guide
+Investigate suspected ransomware, establish affected systems and coordinate controlled containment and recovery.
 
-**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access
+**Validation:** Static safety reviewed; queries and commands require local testing  
+**Reviewed:** 20 October 2026
 
-***
-
-## Overview & Scope
-
-This runbook provides standardised procedures for investigating and responding to ransomware attacks across the hybrid enterprise environment. Ransomware incidents require rapid, coordinated response to minimise damage, preserve evidence, and enable recovery. Time is critical—every minute of delay can result in additional encrypted systems and data loss.
+## Investigation scope
 
 ### What is Ransomware?
 

defensive-security/dfir/runbooks/unauthorised-access-and-privilege-escalation-investigation-runbook.md

@@ -1,14 +1,11 @@
 # Unauthorised Access & Privilege Escalation Investigation Runbook
 
-## SOC & DFIR Operations Guide
+Investigate unusual account access and privilege changes across on-premises and cloud identity systems.
 
-**Environment:** Windows AD | Microsoft 365 | Defender XDR | Sentinel | Entra ID | Palo Alto Prisma Access
+**Validation:** Not independently tested  
+**Reviewed:** 20 October 2026
 
-***
-
-## Overview & Scope
-
-This runbook provides standardised procedures for investigating unauthorised access attempts and privilege escalation attacks across the hybrid enterprise environment. It covers detection, investigation, containment, and remediation workflows for both on-premises Active Directory and cloud identity platforms.
+## Investigation scope
 
 ### Attack Categories