Cyber Incident Center
Structure containment, evidence, the timeline and incident-response actions without performing offensive actions.
Timeline
Incident information
Containment
Reduce impact without destroying useful evidence.
Evidence
Preserve timestamps, logs, headers and IOCs.
Accounts
Revoke compromised sessions and secrets.
Backups
Protect backup copies before the attacker can reach them.
Timeline
Record every action and decision.
Lessons learned
Fix root causes after recovery.
Center mission
8 playbooksContain and document an incident without destroying evidence: scope it, isolate when needed, protect identities, preserve logs and prepare escalation.
Quick triage
- Record time, alert source and initial indicators before deleting anything.
- Scope impact: account, endpoint, server, tenant or network.
- If dangerous activity is active, isolate asset according to procedure.
- Preserve logs, headers, hashes, screenshots and alert IDs.
- Use a clean endpoint for password/admin changes.
Decision tree
Preserve email, block IOC and search for received copies.
Revoke sessions, secure identity then hunt for persistence.
Network-isolate, preserve evidence and use approved EDR/AV.
Prioritize containment, identity, backups and incident command.
Intervention playbooks
Start read-only, collect evidence, then change one variable at a time.
01Reported phishingRead-only
User receives suspicious email with link, attachment or urgent request.
Checks
- Preserve original message and full headers.
- Determine whether link opened, attachment executed or credentials entered.
- Search sender, domain, URL and hash across scope.
Commands / evidence
Get-FileHash <attachment> -Algorithm SHA256Resolve-DnsName <domain>Get-MpThreatDetectionExpected result
User exposure level is known and IOCs are preserved.
Corrective actions
- Block IOCs via approved tools and remove copies after evidence preservation.
- If credentials entered, immediately switch to compromised-account playbook.
Escalate when
Attachment executed, token stolen or campaign affects multiple users.
02Compromised accountIntrusive / escalation
Abnormal sign-ins, fraudulent MFA, mailbox rules or unauthorized sends.
Checks
- Collect sign-in logs, IP, device and time.
- Look for mailbox rules, forwarding, OAuth apps and added MFA methods.
- Determine whether admin privileges or lateral access exist.
Commands / evidence
Get-MgUserAuthenticationMethod -UserId <UPN>Get-InboxRule -Mailbox <UPN>Get-MgUser -UserId <UPN>Expected result
Sessions and persistence mechanisms are identified before remediation.
Corrective actions
- Revoke sessions/tokens and change secret from clean endpoint.
- Remove unauthorized rules/apps/MFA after evidence collection.
Escalate when
Admin account, sensitive-data access or multiple correlated accounts.
03Malware detected on endpointIntrusive / escalation
EDR/Defender alerts on malicious executable, script or behavior.
Checks
- Preserve name, path, hash, parent process and user.
- Check network connections and other detections.
- Assess propagation or presence on other endpoints.
Commands / evidence
Get-MpThreatDetectionGet-Process | Sort-Object StartTime -Descending | Select -First 30Get-NetTCPConnection -State EstablishedExpected result
Asset and behavior are identified, endpoint contained and sufficient evidence preserved.
Corrective actions
- Isolate via EDR or network if activity is active.
- Use approved EDR/AV remediation after initial collection.
Escalate when
Persistence, privilege escalation, C2 or lateral movement suspected.
04Suspicious PowerShellRead-only
Alert on powershell.exe, encoded command, download or unusual execution.
Checks
- Identify command line, parent, user and context.
- Read PowerShell Operational/ScriptBlock logs if enabled.
- Correlate URL, created file and network connections.
Commands / evidence
Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational -MaxEvents 100Get-CimInstance Win32_Process | ? Name -eq "powershell.exe" | Select ProcessId,ParentProcessId,CommandLineGet-NetTCPConnection -State EstablishedExpected result
Command and parent chain explain whether activity is administrative or malicious.
Corrective actions
- Preserve script/command line and hashes of associated files.
- Isolate if malicious behavior or unauthorized download/execution is present.
Escalate when
Obfuscated command, credential theft, C2 or execution on multiple hosts.
05Ransomware / active encryptionIntrusive / escalation
Files renamed/encrypted, ransom note or mass activity.
Checks
- Identify first hosts and start time.
- Check shares, accounts and propagation paths.
- Immediately protect backups/immutability.
Commands / evidence
Get-SmbSessionGet-SmbOpenFileGet-WinEvent -LogName Security -MaxEvents 200Expected result
Propagation is contained and at least one healthy data copy remains isolated.
Corrective actions
- Isolate active hosts and compromised accounts per incident procedure.
- Do not restore before eradication and validation of a clean copy.
Escalate when
Still active, servers/AD affected, backups threatened or possible regulatory obligation.
06Suspected data exfiltrationIntrusive / escalation
Unusual upload, large outbound volume, suspicious archive or mass data access.
Checks
- Define user, machine, destination and volume.
- Preserve proxy/firewall/EDR/cloud audit logs.
- Identify files or spaces accessed.
Commands / evidence
Get-NetTCPConnection -State EstablishedGet-WinEvent -LogName Security -MaxEvents 200Get-Process | Sort-Object CPU -Descending | Select -First 30Expected result
Suspicious flow is bounded by time, volume, destination and identity.
Corrective actions
- Contain account/endpoint based on confidence without erasing logs.
- Preserve evidence for legal/security analysis.
Escalate when
Sensitive data, confirmed external destination or contractual/regulatory impact.
07Lost or stolen endpointIntrusive / escalation
Corporate endpoint is physically uncontrolled with potential data access.
Checks
- Confirm BitLocker/FileVault encryption and last check-in.
- Identify accounts/tokens present and privilege level.
- Check MDM capability to lock/retire data.
Commands / evidence
Get-MgDevice -Filter "displayName eq '<PC>'"Get-BitLockerVolumedsregcmd /statusExpected result
Risk is qualified by encryption, MDM management and identity exposure.
Corrective actions
- Revoke sensitive sessions and apply MDM action per policy.
- Keep hardware ID and loss/theft report.
Escalate when
Unencrypted disk, sensitive admin/local account or regulated data.
08Exposed service / leaked credentialIntrusive / escalation
Unexpected public port, published secret or external exposure alert.
Checks
- Confirm exposure from an authorized external source.
- Identify service/secret owner and exposure duration.
- Search authentications or access during exposure window.
Commands / evidence
Test-NetConnection <public-host> -Port <port>Get-NetTCPConnection -State ListenGet-WinEvent -LogName Security -MaxEvents 200Expected result
Real exposure, window and potential use are documented before closure/rotation.
Corrective actions
- Close unnecessary exposure and rotate secret from clean environment.
- Search for secret reuse across systems.
Escalate when
Unauthorized access observed, privileged secret or critical Internet-facing service.
End-of-intervention checklist
- Preserve timeline and evidence before closure.
- Verify containment left no known persistence.
- Confirm required identity rotation/revocation.
- Validate backups and post-incident monitoring.
- Document actions and return-to-normal criteria.