HackBlue

Tools · Workbench

Incident response playbooks

Step-by-step response tutorials for phishing, ransomware, account compromise, lost devices, and evidence handling.

  • 20 lessons
  • 3 h of reading
  • 4 topics
Start with lesson 1All workbenches

A playbook is the list you wish you had at 2 a.m. These tutorials walk through the first decisions of common incidents, the evidence to keep before it disappears, and the conversations that have to happen with people outside the security team.

Adapt each playbook to your own contacts, tools, and legal obligations, and rehearse it in a tabletop before you need it.

IR foundations

4 lessons

  1. 01The incident response lifecycle explained: NIST phases from preparation to lessons learnedWalk through preparation, detection and analysis, containment, eradication, recovery, and post-incident activity, and see how NIST SP 800-61 Revision 3 ties them to the CSF 2.0 functions.10 min
  2. 02Classifying incident severity: a simple matrix for impact and urgencyBuild a severity matrix that combines functional impact, information impact, and scope, so the team decides quickly how many people to involve and how fast to move.8 min
  3. 03Incident communication plans: who to tell, when, and through which channelDefine internal roles, update cadence, out-of-band channels, and approval paths for external statements, so communication helps the response instead of leaking or confusing it.9 min
  4. 04Running a blameless post-incident review that produces real improvementsHold a structured, blameless review after an incident, build a factual timeline, identify contributing factors, and track action items with owners and deadlines.8 min

Evidence handling

3 lessons

  1. 01Order of volatility: what evidence to collect first during an incidentUse the RFC 3227 order of volatility to decide what to capture first, from CPU state and memory to disk and backups, and balance it against containment urgency.9 min
  2. 02Chain of custody for digital evidence: forms, hashes, and handlingRecord who collected, transferred, and accessed each item of evidence, verify integrity with hashes, and store evidence so it remains trustworthy if the incident goes to court.8 min
  3. 03Building an incident timeline from logs and artifactsNormalize timestamps to UTC, merge events from endpoints, identity, network, and cloud logs into one timeline, and use it to find patient zero and the attacker’s path.10 min

Collection tools

3 lessons

  1. 01Velociraptor for live response: collecting triage artifacts from endpointsSet up a Velociraptor lab server, deploy a client to a test VM, run artifact collections for processes, autoruns, and event logs, and hunt across clients with VQL.11 min
  2. 02Linux live response triage: commands to capture state before containmentCollect processes, network connections, users, persistence, and recent file changes from a suspect Linux host with trusted binaries, writing output off the system with hashes.10 min
  3. 03Acquiring memory safely: WinPmem, DumpIt, AVML, and cloud VM optionsChoose a memory acquisition tool for Windows, Linux, or a cloud VM, capture RAM to external storage, verify the image, and avoid common mistakes that ruin the capture.9 min

Playbooks

10 lessons

  1. 01Playbook: responding to a reported phishing emailHandle a user-reported phish from intake to closure: analyze headers and links safely, find every recipient, purge the message, and check whether anyone clicked or entered credentials.10 min
  2. 02Playbook: business email compromise and mailbox takeover responseRespond to a compromised mailbox used for payment fraud: contain the account, find malicious inbox rules and OAuth apps, scope what was read or sent, and work with finance on recovery.11 min
  3. 03Playbook: the first 24 hours of a ransomware incidentA defensive sequence for ransomware: isolate without destroying evidence, protect backups and identity systems, scope encryption and exfiltration, and prepare recovery decisions.12 min
  4. 04Playbook: compromised user account in Entra ID or Google WorkspaceConfirm account compromise from sign-in evidence, contain it with session revocation and credential reset, remove attacker persistence, and scope access to data and apps.10 min
  5. 05Playbook: malware alert on a workstation, from triage to reimageHandle an EDR malware alert: decide whether it was blocked or ran, contain the host, collect evidence, check for spread, and decide between cleanup and reimaging.10 min
  6. 06Playbook: suspected web server or web application compromiseInvestigate signs of a web compromise such as unexpected files or outbound connections, preserve logs and disk state, find the entry point, and rebuild safely.11 min
  7. 07Playbook: lost or stolen laptop or phoneRespond to a missing device: confirm encryption status, lock or wipe remotely, revoke tokens and certificates, assess data exposure, and decide on notification.8 min
  8. 08Playbook: suspected insider data exfiltrationHandle suspected data theft by an employee with HR and legal from the start: preserve evidence quietly, review file, email, cloud, and USB activity, and keep the investigation fair and confidential.10 min
  9. 09Playbook: responding to a distributed denial of service against your siteIdentify whether an outage is a DDoS, engage your provider or CDN, apply rate limits and filtering, communicate status, and review capacity and protections afterward.9 min
  10. 10Playbook: a vendor or SaaS provider you use reports a breachWhen a supplier announces a security incident, inventory what you share with them, rotate integration credentials, hunt for misuse of their access, and track their disclosures.9 min