🚨

Intermediate1-4 hours (initial triage)|6 steps, 25 tools

Incident Response Triage Workflow

Rapid triage when you suspect a compromise. Collect volatile evidence, assess the scope, contain the threat, and begin investigation. Time-critical steps organized by priority.

incident-responsedfirtriageforensics

Volatile Data Collection

Collect evidence that will disappear when the machine is powered off or rebooted. This means running processes, network connections, logged-in users, clipboard contents, and memory. Do this before anything else - every minute that passes is data lost.

Tools for this step

Velociraptor

KAPE

GRR Rapid Response

Tip: KAPE can collect a full forensic triage in under 10 minutes. Velociraptor can collect from multiple endpoints simultaneously if you have agents deployed. GRR enables remote collection at scale. Always collect memory if possible - it contains decrypted data, running malware, and network connections that don't survive a reboot.

Quick-Win IOC Checks

While volatile data is being collected, run quick checks for known indicators of compromise. Check running processes against known malware names, look for suspicious network connections to known-bad IPs, scan for unauthorized scheduled tasks and services, and check autorun locations for persistence mechanisms.

Tools for this step

Tip: osquery lets you ask 'show me all listening ports' or 'show me all processes started in the last 24 hours' as simple SQL queries. Chainsaw and Hayabusa rapidly scan Windows event logs against Sigma rules. Check for processes running from unusual locations (Temp, AppData, ProgramData).

Log Analysis and Timeline Building

Pull logs from the affected systems and start building a timeline. Windows Event Logs, syslog, authentication logs, web server logs, and firewall logs all contribute to the picture. The goal is to establish: when did the compromise start, what was the initial access vector, and what happened after.

Tools for this step

Tip: Plaso (log2timeline) creates super-timelines from multiple log sources. Chainsaw scans event logs with Sigma rules to surface suspicious activity fast. Focus on authentication events (4624, 4625), process creation (4688), and PowerShell logging (4104) in Windows. Check for log gaps - attackers often clear logs.

Memory and Disk Forensics

Analyze the memory dump and disk image from affected systems. Memory analysis can reveal running malware, injected code, network connections, and decrypted data. Disk analysis covers file system artifacts, deleted files, browser history, and persistence mechanisms.

Tools for this step

Tip: Volatility 3 is the standard for memory forensics - check process lists, network connections, loaded DLLs, and injected code. Autopsy provides a full disk forensics GUI. RegRipper extracts forensic artifacts from Windows registry hives. bulk_extractor carves emails, URLs, and other data from raw images at high speed.

Malware Analysis (if applicable)

If you've recovered malware samples, analyze them to understand capabilities and extract additional IOCs. Start with static analysis (file type, strings, imports), then move to dynamic analysis in a sandbox if needed. Extract C2 addresses, file paths, registry keys, and network signatures.

Tools for this step

Tip: Detect It Easy identifies packers and compilers instantly. capa detects capabilities (like 'encrypts files' or 'communicates via HTTP') automatically. PE-sieve scans running processes for injected code. oletools analyzes malicious Office documents. Write YARA rules for any unique malware indicators so you can scan other systems.

Scope Assessment and Containment

Use everything you've learned to assess how far the compromise extends. Search for the IOCs you've discovered across all endpoints and network logs. Identify all affected systems, compromised accounts, and data that may have been accessed or exfiltrated. Then contain - isolate affected systems, reset compromised credentials, and block attacker infrastructure.

Tools for this step

Tip: Velociraptor and osquery can sweep entire endpoint fleets for IOCs. Wazuh correlates events across your monitoring infrastructure. Deploy YARA rules across endpoints to find malware variants. Don't just contain the systems you've confirmed - contain anything that might be compromised based on lateral movement paths.

Other Workflows

🔎

OSINT Investigation Workflow

A structured approach to open-source intelligence gathering, from target identification through to reporting. Covers passive reconnaissance, social media analysis, email and phone lookups, and data correlation.

🕸

Web Application Penetration Test

A systematic approach to testing web applications for security vulnerabilities. Covers reconnaissance, mapping, vulnerability discovery, exploitation, and reporting.

🔥

Active Directory Attack Path

From initial foothold to domain admin. A step-by-step approach to enumerating and attacking Active Directory environments during authorized penetration tests.