IncidentResponsev2

4 - Eradication Phase

This section contains the following playbooks and procedures:

• 4.01_Synchronize_all_host_clocks
• 4.02_Enable_Account_Usage_Auditing
• 4.03_Deploy_network_intrusion_detection_system
• 4.04_Monitor_NIDS_and_Report_Threats
• 4.05_SIEM_Events_to_IDS_and_network_logs
• 4.06_Evaluate_Host_Kernel_to_Check_for_Rootkits
• 4.07_Use_Host_Log_Data_to_Evaluate_System_Processes
• 4.08_Deploy_or_evaluate_host_sensors
• 4.09.02_Configure_SO_Syslog_Server
• 4.09.1_Configure_Snort_Rules
• 4.09.3_Evaluate_Network_Baseline
• 4.09.4_Evaluate_Host_Baseline
• 4.09.5_Detect_Rouge_Wireless_AP
• 4.09.6_Detect_Remove_Rouge_Network_Devices
• 4.09_Install_and_Deploy_Security_Onion
• 4.10_PAN_Forward_Syslog_SO
• 4.11_Monitoring_account_creation_SO
• 4.12_Detect_network_vulnerability_scans_SO
• 4.13_Detect_SMB_using_SO
• 4.14_Monitor_AD_New_Account_Creation
• 4.15_Monitor_DHCP_for_new_reservations
• 4.16_Monitor_AD_for_new_DNS_names
• 4.17_Respond_to_alerts_about_unauthorized_users
• 4.18_Compare_hashes_of_suspected_malware
• 4.19_Perform_manual_host_analysis
• 4.19.1_Perform_Manual_Host_Analysis_Live_Physical_Host_Windows
• 4.19.2_Perform_Manual_Host_Analysis_Memory_Image_File
• 4.19.3_Create_Hard_Disk_Image
• 4.20_Investigate_Alerts_From_Host_Sensors
• 4.21_Find_and_contain_rogue_workstations
• 4.22_Block_unauthorized_software
• 4.23_Stop_Credential_reuse_attack
• 4.24_Stop_brute_force_attack
• 4.25_Stop_malware_rootkit
• 4.26_Stop_data_exfiltration
• 4.27_Stop_malware_backdoor
• 4.28_Stop_C2_Beaconing
• 4.30_Security_Onion_Hunting
• 4.41_Run_Vuln_Scan
• 4.43_Check_for_Rootkits
• 4.44_Remove_Unauthorized_User_Accounts
• 4.45_Check_for_Unauthorized_Scheduled_Tasks_Services
• 4.46_Check_for_Unauthorized_Software_Tools
• 4.47_Remove_Attacker_Persistence
• 4.48_Validate_Eradication_Completion
• 4.49_Coordinate_Transition_to_Recovery
• 4.50_Perform_Handoff_to_Recovery
• 4.51_Perform_Recovery_Monitoring_Validation
• 4.52_Finalize_Eradication_Documentation_Reporting
• 4.53_Evaluate_Physical_Security_Access
• 4.54_Verify_Wireless_Security
• 4.55_Verify_Network_Segmentation
• 4.56_Remove_Unauthorized_Users_AD_Cloud
• 4.57_Remove_Unauthorized_Devices
• 4.58_Remove_Unauthorized_Services
• 4.59_Remove_Unauthorized_Scheduled_Tasks_Automation
• 4.60_Remove_Unauthorized_DNS_Entries
• 4.61_Validate_All_Endpoint_Gaps
• 4.62_Validate_Persistence_Mechanisms_Removed
• 4.63_Validate_No_Unauthorized_Network_Traffic
• 4.64_Validate_Unsanctioned_Accounts_APIs
• 4.65_Validate_Malware_Removal
• 4.66_Validate_Critical_Security_Controls_Monitoring
• 4.67_Validate_Clean_Backups_Recovery

Select the links above to access the specific procedures and details for this phase.