Chapter 5 · Attacks & Defenses·Intermediate·~15 min

Incident Response

Beyond the IR loop: playbook structure, evidence handling, live forensics, MITRE ATT&CK mapping, and metrics worth tracking.

You will learn

  • What goes in a playbook and how to keep it usable
  • Chain of custody for evidence that needs to hold up in court
  • Memory forensics with Volatility and network forensics with PCAP analysis
  • How MITRE ATT&CK maps observations to known attacker tradecraft
  • The four IR metrics that actually drive program improvement

Playbook structure

A useful IR playbook fits on a few pages and answers, for each likely scenario:

  • Trigger: how the incident is detected.
  • Severity criteria: clear thresholds for SEV1/SEV2/SEV3.
  • Roles: incident commander, communications lead, technical lead, scribe.
  • Contain steps: ordered actions with explicit decision points.
  • Eradicate steps: what to remove, what to rotate, what to rebuild.
  • Recover steps: criteria for declaring service restored.
  • Communication templates: pre-approved language for status pages, customer notification, regulator notification.

The test for whether a playbook is usable: a sleep-deprived on-call engineer can follow it at 3 AM. If it reads like compliance prose, rewrite.

Chain of custody

Evidence that might end up in court (criminal prosecution, civil suit, employment dispute) needs a documented chain of custody from collection to presentation. Standard elements:

  • Who collected the evidence, when, where, with what tools.
  • Cryptographic hashes (SHA-256 minimum) of every file or image, recorded at collection time and verified at each subsequent handoff.
  • Sealed storage between handoffs.
  • A log of every access: who, when, why.

Forensic tools (EnCase, FTK, dd) compute hashes automatically. The discipline is the documentation, not the cryptography.

Live forensics

Volatile data is lost on shutdown. Live forensics captures it before the box is unplugged:

  • Memory dump: Belkasoft RAM Capturer, WinPmem, LiME (Linux). Process list, open handles, in-memory strings, injected code, encryption keys still in RAM.
  • Network capture: tcpdump or Wireshark before isolating the host, so beacons in flight are recorded.
  • Triage artifacts: KAPE on Windows captures registry hives, event logs, browser history, prefetch, MFT extracts in minutes.

Volatility is the standard memory-analysis framework. Plugins like pslist, netscan, malfind, handles, cmdline let you reconstruct what was running at capture time.

MITRE ATT&CK alignment

ATT&CK is a catalogue of adversary tactics (the "why") and techniques (the "how"), organized into 14 tactic columns: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.

How to use it operationally:

  • Map each detection rule to one or more ATT&CK techniques. Now you can see your coverage as a heatmap.
  • During an incident, map each observed action to a technique. The pattern tells you the likely actor profile.
  • For tabletop exercises, pick an APT group's documented techniques and walk through whether your detections would catch each step.

ATT&CK Navigator is the visualization tool. Detection-as-code projects (Sigma rules, KQL libraries) increasingly publish ATT&CK mappings alongside the rule.

Four IR metrics worth tracking

  • MTTD (Mean Time To Detect): from initial compromise to first defender awareness. Industry median is depressingly high (200+ days for some sectors).
  • MTTR (Mean Time To Respond / Recover): from detection to remediation.
  • Dwell time: total attacker presence. Combination of MTTD and the response phase.
  • Post-mortem action item closure rate: percentage of action items closed within 30/60/90 days. This is the leading indicator of program health; everything else is lagging.

Vanity metrics to avoid: alert volume (more is rarely better), tickets closed per analyst (incentivizes shallow work), and "we improved by X%" without showing the baseline calculation.

Take the quiz Back to beginner