What to do between a high-severity alert landing and the playbook opening. Three windows, a handful of lines each, written to be read standing up.
These sit before the first-hour playbooks, not instead of them. A checklist has three windows and a few lines in each, names the instinct to resist, and ends by handing you to the playbook that takes it from minute sixteen.
EDR or Sysmon event 10 reports LSASS opened with memory-read access by a process that is not a security product, or a rule fires on rundll32 with comsvcs.dll.
