[FAIL]
For a suspected live incident: freeze evidence first, clean up only afterwards. Restarting or cleaning a system too quickly can destroy the only evidence.
The six phases (NIST-like)
- Preparation — tooling, contact lists and procedures ready before anything happens
- Identification — is this actually an incident, and what is the scope
- Containment — stop the spread without destroying evidence
- Eradication — actually remove the cause
- Recovery — bring systems back online in a controlled way, with monitoring
- Lessons learned — what went well/wrong, what needs to change structurally
First hour — containment without destroying evidence
- Pull the network cable/isolate the VLAN — do not power off, RAM often holds crucial evidence
- Take a memory dump before you do anything else on the system
- Note a timeline: when noticed, by whom, what was the first signal
- Inform the right people (no broader than necessary — operational security)
# Memory dump with dumpit/winpmem (Windows) or LiME (Linux)
winpmem.exe memory.raw
# Create a disk image for forensic analysis (never work on the original)
dd if=/dev/sda of=/evidence/disk.img bs=4M status=progressLog sources to check
- Authentication logs — unusual login times, locations, failed attempts
- Firewall/proxy logs — connections to unknown external IPs
- EDR/antivirus logs — detected but possibly not blocked activity
- DNS logs — queries to known C2 domains or DGA-like patterns
- Process and command-line logs (Sysmon, auditd) — what was actually executed
Tooling
- Volatility 3 — memory forensics, extract processes/network connections from a dump
- Autopsy / Sleuth Kit — disk forensics, file carving, timeline analysis
- Wazuh / ELK — search centralized logs during the investigation
- YARA — pattern matching to find variants of a discovered malware sample