What to do between a high-severity alert landing and the playbook opening. Three windows, a handful of lines each, written to be read standing up.
These sit before the first-hour playbooks, not instead of them. A checklist has three windows and a few lines in each, names the instinct to resist, and ends by handing you to the playbook that takes it from minute sixteen.
Event 4769 shows one account requesting service tickets with encryption type 0x17 (RC4) for several user-backed service accounts within a short window.
Proxy, firewall or EDR telemetry shows a host sending an unusual volume of data to cloud storage or a file-sharing service it does not normally use.
An alert or a user reports a new inbox rule that forwards mail outside, deletes it, or moves it to an obscure folder such as RSS Feeds, Archive or Conversation History.
A ransom note appears, files across a share change extension or will not open, or shadow copies and backup catalogues are deleted.
Secret scanning, a researcher, a colleague or a vendor reports an API key, password, token or private key in a public repository, gist, paste site or published package.
Identity protection, a SIEM rule or the user reports a successful sign-in to a work account from an IP address, country, network or device that does not match how they normally sign in.
A user reports MFA push notifications or calls they did not start, or logs show repeated MFA challenges for one account, often late at night.
A user reports that they entered their password, or approved an MFA prompt, on a page they reached from a link in an email or message.
A web server process (w3wp.exe, httpd, nginx, java or tomcat) starts a shell or a reconnaissance tool, or a new script file appears in a web root.
Event 4728, 4732 or 4756 shows an account added to Domain Admins, Enterprise Admins, Administrators or another tier-zero group, and there is no approved change for it.
GuardDuty or a CloudTrail-based alert shows an access key used from an unfamiliar address, country or user agent, or used for API calls it does not normally make.
EDR reports a sensor going offline unexpectedly, an exclusion being added, a policy being changed, a security service being stopped, or tamper protection blocking any of these.
A user or an administrator granted consent to an application nobody recognises, particularly one asking for mail, files, or offline access.
EDR or Sysmon event 10 reports LSASS opened with memory-read access by a process that is not a security product, or a rule fires on rundll32 with comsvcs.dll.
