Incident Response Cheatsheet

IR Lifecycle: NIST vs SANS

Triage Checklist

Core Questions

1. What? True or false positive; what kind of activity.
2. When? First observed time (UTC); is it ongoing.
3. Scope? Hosts, accounts, and data affected.
4. Severity? Business impact and urgency.
5. Who/where? Owner, location, criticality of assets.
6. Evidence? What must be preserved before acting.

Severity Classification

Order of Volatility

1. CPU registers & cache
2. RAM, process table, ARP/routing, kernel stats
3. Temp filesystems & swap
4. Disk (persistent storage)
5. Remote logs & monitoring data
6. Physical config & topology
7. Archival media / backups

Live-Response Commands

Evidence Integrity

# Hash on acquisition
sha256sum evidence.dd > evidence.dd.sha256

# Verify later
sha256sum -c evidence.dd.sha256

# Image a disk (source -> file)
dd if=/dev/sdb of=disk.dd bs=4M conv=noerror,sync status=progress

# Memory capture then hash
avml mem.lime && sha256sum mem.lime

IOC Types

Playbook Quick Steps

Phishing

1. Preserve original email + full headers.
2. Identify recipients and who clicked/entered creds.
3. Purge the message org-wide; block sender & URL.
4. Reset exposed credentials; revoke sessions.

Ransomware

1. Isolate affected hosts immediately.
2. Preserve a sample; identify the variant.
3. Locate patient zero & entry vector.
4. Restore from clean, offline backups; don't rush to pay.

Account Compromise

1. Disable/lock account; revoke tokens & sessions.
2. Reset password and re-enroll MFA.
3. Review inbox rules and OAuth app grants.
4. Hunt for lateral movement from the account.

Notification / Breach Timelines

Useful Tools