Scribd
Upload
22 views5 pages

Tabletop

Uploaded by

Biniam Tekle
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
22 views5 pages

Tabletop

Uploaded by

Biniam Tekle
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 5

3.

Analyze
Verify
In conjunction with a senior member of the SOC
● Double check previous data
● Rule out False Positive

Identify IOCs
● Validate hashes
○ VirusTotal
○ Hybrid Analysis
● Validate links
○ VirusTotal
○ Hybrid Analysis
○ URLScan
● ID subject, attachments, from addr
● ID other addresses, domains, IPs
○ VirusTotal
○ Hybrid Analysis
○ Talos Intelligence
● Search Threat Intel sources
○ VirusTotal
○ Hybrid Analysis
○ Talos Intelligence
● Disk forensics on recipient's endpoint

Scan Enterprise
● Update spam filter
● Update FW, IDS, etc. rules w/ IOCs
● Search all mail folders for IOCs
● Search endpoints for IOCs w/ EDR

Update Scope
● Update lists of
○ affected recipient addresses
○ affected endpoints
○ affected enclaves
○ affected business units
Update Scope
● Update lists of
○ affected recipient addresses
○ affected endpoints
○ affected enclaves
○ affected business units

Scope Validation
Have all the machines been identified? If you find further traces of phishing or new IOCs go
back through this step.
When you are done identifying all compromised:
● Hosts
● Mailboxes
And investigated all:
● URLs
● Domains
● IP
● Ports
● Files
● Hash
Go to the next phase ‘Contain/Eradicate’

4. Contain / Eradicate
Block
● Update Spam Filters
● Update FW, Proxy, etc. rules
● Blackhole DNS
● Submit to thrid parties
○ Google Safe Browsing
○ Web Filter Vendor
○ etc.

Validate User's Actions


● Have emails been read
● Have attachments been opened
● Have links been clicked

Malware Infection?
If there was malicious attachments that were opened we need to assume the endpoint(s)
was/were infected by a malware and proceed to the Malware Playbook

Delete Emails
● Delete From Users' Inboxes
○ Spam Tool
○ Email Admin Console
○ Cloud & On-Prem
● Delete Downloaded Attachments
○ EDR, SIEM, etc. to scan enterprise

Close Monitoring
● Monitor for
○ Related incoming messages
○ Internet connections to IOC
○ New files that matches hashes identified

All Affected Endpoints Contained?


If all affected endpoints have been contained, you can go to the next phase, otherwise
continue below.

New IOC Discovered?


If there was new IOC discovered, go back to the Analyze Phase

5. Recover
Update Defenses
Determine which of the following rules needs to be removed and which needs to stay in the
following list:
● Spam Filters
● Firewall Rules
● EDR
○ ban hashes
○ ban domains
○ Containment
● Proxy Block

All Affected Endpoints Recovered?


If all affected endpoints have been contained, you can go to the next phase, otherwise
continue below.
Validate Countermeasures
Determine if legitimate elements are blocked by:
● Spam Filters
● Proxy
● Firewall
● EDR
If so, go back to Update Defenses Otherwise go to the next phase

6. Post Incident
Incident Review
● What worked
● What didn't work

Update Mode of Operations


Update the following documents as required:
● Policies
● Processes
● Procedures
● Playbooks
● Runbooks
Update Detection Rules in:
● SIEM
● Anti-Spam
● Malware Getaway
● EDR
● Other security solution

Review Defensive Posture


● Schedule review of newly introduced rules in6 months
● Are the following still applicable
○ Spam Filter Rules
○ Firewall Rules
○ Proxy Rules for C2
○ AV / EDR Custom Signatures
○ IPS Signatures

User Awareness Training


● Ensure that the user receives Phishing training
○ How to recognize Phish
○ How to report Phish
○ Danger of following links
○ Danger of opening attachments
○ Danger of complying with scammers requests

You might also like