Conversation
The runbooks covered infrastructure and key compromise but not the contributor workstation, which is where infostealer and fake-recruiter intrusions actually land. malware.mdx covers the victim side; this is the responder side. Severity derives from the access tier the user holds rather than the malware family, since access is observable in the first twenty minutes and impact is not. Escalators cover ungated pipelines, sub-threshold signers, and public channel control. The credential revocation table is ordered because the common failures are sequencing errors: rotating an SSH key before killing the live session lets the attacker re-add it, and changing a password before revoking sessions leaves the stolen cookie valid. Containment forks on capability rather than doctrine, and handles the already-powered-off device, which is the state malware.mdx produces. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx
Checked the runbook against SP 800-61r3, SP 800-86, and the CISA incident and vulnerability response playbooks. Four things were missing. Evidence collection now runs in order of volatility per SP 800-86, so a responder holding a live machine knows memory outranks disk rather than working down an unordered list. Eradication is gated on finishing the foothold inventory first, which is the CISA sequencing rule. Rebuilding the laptop while an OAuth grant survives moves the attacker off the device and leaves them in the accounts, and the rebuild destroys the evidence that would have found them. The runbook had no way to close an incident. SP 800-61r3 makes improve a standing function, and the repo's own runbook template asks for a resolution checklist, so there is now a closing section covering the incident log, post-mortem, indicator sharing, and the detection gap. External notification was absent on the responder side even though malware.mdx carries it for victims. Legal owns the decision, but the clock starts at discovery, so it belongs in escalation. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx
The closing section opened by negating ("an incident is not closed
because the laptop was rebuilt") and letting the next sentence carry the
correction, which is the same rhetorical move the key takeaway already
spends. Leads with the claim instead.
Also drops a filler "just", replaces an unclear line about evidence
surviving "without you" with what the rows actually do, and unpacks
"a deadline stays a choice" into plain terms.
Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx
The symptoms list describes lures this repo already documents with real message screenshots, but nothing connected the two. Differentiation now routes a suspicious meeting-link domain or fake recruiter task to the DPRK playbook, and a Zoom screen-share request to ELUSIVE COMET, since naming the campaign tells the responder which follow-on accounts to check. Both playbooks link back. ELUSIVE COMET previously ended at the malware playbook, which is victim guidance, leaving no route to the org-side process. External notification points at the communications template and communication strategies, which own wording, cadence, and spokesperson while this runbook only covers the legal clock. Closing the incident points at Lessons Learned for the review questions and blameless format. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx
The paragraph added with the playbook cross-links leaned on "worth" twice in four sentences and closed on a generic recommendation rather than a reason. Says what the screenshots are for and stops there. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx
"A stolen session cookie stays valid until revoked" was stated three times: in the P4/P5 note, in step 4, and in row 1 of the revocation table. Step 4 carried nothing else, since it only pointed at the section immediately below it, so it is gone. Two lines contradicted each other on the same phrase. Quick Reference said access is observable within the first twenty minutes, then twenty lines later said access is least understood during the first twenty minutes. The second now makes its point about defaulting high without re-litigating when access becomes knowable. Step 2 explained the memory tradeoff twice in consecutive paragraphs. General principle first, then the already-powered-off case as a short consequence. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx
Six headings were sentence case while the ones inherited from the template were title case, so the file was inconsistent with itself and with all nine sibling runbooks, which title-case step headings too. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx
Sidebar Configuration ReminderThis PR includes added, renamed, or removed documentation files:
Please ensure that:
See Contributing guidelines - Sidebar / Navigation for more details. This is an automated reminder. If this PR doesn't need sidebar changes, you can ignore this message. |
built with Refined Cloudflare Pages Action⚡ Cloudflare Pages Deployment
|
Collaborator
|
Thanks for this contribution @s1ns3nz0! @hexnickk4997 and @n0guest 🙏🏻 |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
Runbook: Endpoint Compromiseto the incident response template, plus the cross-links that connect it to pages already in the repo.The runbooks covered infrastructure and key compromise but not the contributor workstation, which is where infostealer and fake-recruiter intrusions actually land.
playbooks/malware.mdxcovers the victim side of the same incident ("your computer was hacked, save your crypto"). This is the responder side: what the security team does once a colleague reports it.Design decisions
Severity derives from the access tier the user holds, not the malware family. Access is observable in the first twenty minutes and impact is not, so the tier table stands in for the impact bands in the Incident Response Policy. Escalators cover pipelines that reach production without an approval gate, sub-threshold multisig signers, and control of public channels.
The revocation table is ordered, because the common failures are sequencing errors. Rotating an SSH key before killing the attacker's live session lets them add the new key. Changing a password before revoking sessions leaves the stolen cookie valid. Re-enrolling 2FA from a cloud backup restores the stolen seed. The table supplies the order; each row links to whoever owns the procedure.
Containment forks on capability, not doctrine. Teams with endpoint tooling contain in the console and keep the host up for memory capture. Teams without it disconnect, and power off only when nobody can capture memory. The table also handles the already-powered-off device, which is the state
malware.mdxproduces when it tells the affected person to shut down immediately.There is an insider branch. The normal path says to phone the user immediately, which is exactly wrong if the user is the threat actor, so that case routes to Legal and the DPRK IT worker guidance instead.
The runbook stops at P3. The policy defines P4 and P5, but their response times ("can be scheduled", "no immediate action") do not fit a confirmed endpoint compromise. A downgrade path closes the incident when the lure arrived but never ran.
Checked against NIST and CISA
Evidence collection runs in order of volatility per NIST SP 800-86. Eradication is gated on finishing the foothold inventory first, per the CISA incident and vulnerability response playbooks. A closing section covers the incident log, post-mortem, indicator sharing, and the detection gap, since SP 800-61r3 treats improvement as a standing function and the repo's own runbook template asks for a resolution checklist.
Files
runbooks/endpoint-compromise.mdxrunbooks/overview.mdxrunbooks/index.mdxvocs.config.tsplaybooks/malware.mdxplaybooks/hacked-dprk.mdxplaybooks/hacked-elusive-comet.mdxNotes for review
[Date],[Name],[X hours], and the suggested 30-day monitoring window need filling in per organization.cspellclean,validate:contentpasses, every internal link resolves, renders invocs dev.