Incident Response Lifecycle

Trust turns on two questions: was the copy written before they got in, and could they have altered or deleted it afterwards. Domain-level privilege reached the backup platform, so offline or immutable copies and its own audit records decide it.

Active Directory keeps the current and the previous krbtgt key, so one reset leaves the old key valid and forged tickets minted with it still work. Reset twice, allowing the first change to replicate to every domain controller in between.

Conclude they know. The flow records prove bytes left to that destination, not what those bytes were, and the rule deletion is a dated act of evidence removal. Cut now, and reopen the scope question.

Separate detection from response: leave the rule firing and collecting, and disable only its quarantine action. Disabling the rule itself blinds the case. Time-box the suppression to the planned cut and staff a human for the hits.

A tight observable trigger, a bounded scope with explicit never-touch systems, an isolation method that preserves evidence, a notify-within deadline, who may reconnect and on what proof, and contractual cover so the delegate actually acts.

Because severity is graded on what was reached, not on what was broken. A directory-wide, warehouse-wide reader reaches regulated records, secrets left in resource metadata, and a complete map of the estate. Confidentiality loss requires no write at all.

Counsel engages the firm so its work informs legal advice and may be shielded from later disclosure. Notes then carry observed artefacts, sources and timestamps, never speculation about fault. The underlying logs and evidence are never protected.

The named behaviours that trigger immediate containment, a time box with a review point, the specific scope questions the watch is meant to answer, the person who authorised it, and who is on the keyboard with the cut pre-staged and rehearsed.

The decision is about the directory's contents, not the servers. Restore controllers from a pre-compromise system state when you can bound what changed; rebuild the forest when the privileged object graph can no longer be vouched for.

Scope by the access, not by your alerts. Enumerate everything that identity could reach and every secret it could read, then reconstruct what it actually did from records you hold, and remediate the access whether or not misuse is proven.

Upgrading rests on positive evidence: new reach you can point at. Downgrading requires proving the earlier reach never existed, and a missing log record is not that proof — the logging may have been off, expired, or blind to the technique.

One authorisation check before the word, time-boxed. Windows 4724 proves a privileged reset happened, never who authorised it, so the bar must require the change record and a call to the named system owner, declaring anyway if nobody answers.

Give the executive the decisions they actually need rather than the name they asked for, and state what the evidence supports and what it does not. Assessments of who is responsible belong in a separate owned product, not a status briefing.

Neither the SOC nor the desk head owns that call alone. Price both outcomes, escalate to the executive accountable for the firm's risk, offer a bounded watch with tripwires or a move to a spare workstation, and record who decided what and when.

Stop claiming proof and state criteria instead: what was swept, what could not be, what compensates for the gap, and which named business owner accepts the remainder. Then run a time-boxed re-entry watch with specific tripwires and conditions that reopen the incident.

Rank the population by privilege and evidence of adversary use rather than resetting everyone equally, verify identity out-of-band, apply compensating controls to the un-reset tail, and have a named executive accept the residual exposure.

Commit to what the evidence supports: earliest observed activity with its date and citation, plus an explicit statement that the window before the retention edge cannot be assessed. Never convert an absence of records into a start date.

Neither function outranks the other, so the tie goes to the accountable executive the plan names, with HR present because cutting an employee's access is an employment act. Take the reversible option, time-box it, record the rationale.

Because the access path is the remote-management tenant, not the machine. The console can open a session on any enrolled host, and blocking the vendor's cloud at the perimeter cuts your own IT operations everywhere at once.

Supplement the original filing with the new figure and the analytic step that produced it. Growth explained by a widened search reads as diligence; growth contradicting an earlier assurance does not.

Send a short instruction that changes behaviour, carries no findings, and can be verified without clicking anything, through a path the adversary does not control. Write it assuming the intruder and the press both read it.

Treat it as a hypothesis, not a finding. Test for positive linkage — shared unique artefacts, credentials, infrastructure — check continuity across the gap, and reconcile it against records of authorised activity before re-dating anything.

It proves the actor published a claim and, if a sample is posted, possesses at least what is in that sample. The volume figure is unverified, the timer is a negotiating lever they set, and absence from the site would prove nothing.

Examining a named employee's records needs HR as data owner, the privacy office for a documented lawful basis, counsel for the legal posture, and in several European jurisdictions consultation with the works council before behaviour-monitoring data is analysed.

Record the requirement as raised, the refusal, who decided it and when, the exposure that remains in operational terms, any compensating measure you will actually perform, and a date to revisit. Never quietly delete the requirement.

Not a veto on auto-remediation but a quarantine mode: replace the workload immediately, then hold the original with egress denied and credentials revoked for a hard-capped window, reaped automatically, invoked under standing authority by the incident lead.

The trade is certain business loss against residual adversary presence, so the accountable business owner takes it, not the responder. Your job is to state honestly what each option costs, offer the middle paths, and record what was accepted.

Stop waiting for evidence you cannot compel. Set an explicit working assumption that the access was used, remediate on that basis, escalate commercially for narrow tenant-specific artefacts, and report the residual uncertainty plainly rather than as an all-clear.

Grade on what the columns actually contain, not only on the label. Hold the conservative grade as explicitly provisional, sample the real values from the columns the query records name, escalate to whoever is accountable for the label rather than to whoever disputes it, and record the basis.

Split the authority. Pre-delegate in writing to a named duty officer the right to declare and contain against a standing threshold, and keep the acts that bind the company on a pre-cleared path with named fallbacks.