Incident Response: Key Questions to Guide Your Next Steps
Summary
Huntress outlines questions incident responders should ask to establish an incident’s severity and scope, understand applicable requirements, gather resources, preserve evidence, and guide containment and recovery.
Key points
- Check applicable cyber insurance, compliance requirements, and reporting obligations before deciding how to respond.
- Assess incident severity and scope, including whether activity affects one workstation, a server, or multiple clients.
- When law enforcement requests a device, ask about timing, scope, indicators of compromise, relevant IP addresses, and technical contacts.
- For credential dumping on a server, investigate the entry point, such as a compromised RMM tool or exposed RDP.
- Determine what the threat actor did to maintain access and how to limit or contain the attack.
- Use clarifying questions to gather information, select appropriate resources, and avoid acting before understanding the situation.
Article Details
- Defense Focus
- Guide incident responders to clarify incident severity, scope, root cause, and response requirements before choosing containment and remediation actions.
- Detection Methods
- Review EDR alerts for credential-dumping activity.
- Ask law enforcement for incident indicators, including any IP address to block.
- Determine whether the incident involves a single workstation, a server, multiple clients, or lateral movement between machines.
- Investigate the initial access method and any steps taken to maintain access.
- Data Sources
- EDR alerts
- Law-enforcement-provided incident details and indicators
- Affected endpoint and server findings
- Cyber-insurance and compliance requirements
- Platforms
- EDR
- Defensive Actions
- Clarify applicable insurance, compliance, and reporting requirements before responding.
- Establish the incident timeline, scope, severity, and technical contacts.
- Determine root cause and the appropriate restore point before restoring affected systems.
- Limit or mitigate attack spread across the organization.
- Investigate persistence or other measures used to retain access.
- Escalate severe incidents, such as Cobalt Strike on a server, to the full incident-response plan and outside support.
- Coordinate with law enforcement and obtain relevant incident details before transferring equipment.
- Block a specific IP address when supported by incident information.