.

2026-08-22 12:49:53 +02:00 · 2026-01-27 17:35:45 -05:00
commit 2639af6531
176 changed files with 27104 additions and 0 deletions
@@ -0,0 +1,96 @@
+---
+name: incident-response
+description: Handle security incidents with IR playbooks and procedures. Implement detection, containment, eradication, and recovery processes. Use when responding to security events or building incident response capabilities.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Incident Response
+
+Handle security incidents effectively with structured response procedures.
+
+## Incident Response Phases
+
+```yaml
+phases:
+  1_preparation:
+    - IR team and contacts
+    - Tools and access ready
+    - Playbooks documented
+    
+  2_detection:
+    - Alert triage
+    - Initial assessment
+    - Severity classification
+    
+  3_containment:
+    - Short-term containment
+    - Evidence preservation
+    - System isolation
+    
+  4_eradication:
+    - Root cause analysis
+    - Remove threat
+    - Patch vulnerabilities
+    
+  5_recovery:
+    - System restoration
+    - Monitoring enhanced
+    - Business continuity
+    
+  6_lessons_learned:
+    - Post-incident review
+    - Documentation update
+    - Process improvement
+```
+
+## Severity Classification
+
+| Level | Impact | Response Time |
+|-------|--------|---------------|
+| Critical | Data breach, full outage | Immediate |
+| High | Service degraded, potential breach | < 1 hour |
+| Medium | Limited impact, contained | < 4 hours |
+| Low | Minimal impact | Next business day |
+
+## Initial Response Checklist
+
+```markdown
+- [ ] Confirm incident is real (not false positive)
+- [ ] Classify severity level
+- [ ] Notify IR team
+- [ ] Begin documentation
+- [ ] Preserve evidence
+- [ ] Implement containment
+- [ ] Communicate to stakeholders
+```
+
+## Evidence Collection
+
+```bash
+# System state
+ps aux > /evidence/processes.txt
+netstat -tuln > /evidence/connections.txt
+last -a > /evidence/logins.txt
+
+# Memory dump
+dd if=/dev/mem of=/evidence/memory.dump
+
+# Log preservation
+tar czf /evidence/logs.tar.gz /var/log/
+```
+
+## Best Practices
+
+- Pre-defined playbooks
+- Regular IR drills
+- Clear communication channels
+- Legal team involvement
+- Post-incident reviews
+
+## Related Skills
+
+- [audit-logging](../../../compliance/auditing/audit-logging/) - Log analysis
+- [alerting-oncall](../../../devops/observability/alerting-oncall/) - Alert management
@@ -0,0 +1,155 @@
+# Incident Report: [INCIDENT-ID]
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Incident ID** | INC-YYYY-MMDD-XXX |
+| **Status** | Open / Contained / Resolved |
+| **Severity** | SEV1 / SEV2 / SEV3 / SEV4 |
+| **Incident Commander** | [Name] |
+| **Detection Time** | YYYY-MM-DD HH:MM UTC |
+| **Resolution Time** | YYYY-MM-DD HH:MM UTC |
+| **Duration** | X hours Y minutes |
+
+**Summary:** [1-2 sentence description of the incident]
+
+---
+
+## Timeline
+
+| Time (UTC) | Event |
+|------------|-------|
+| YYYY-MM-DD HH:MM | [Event description] |
+| YYYY-MM-DD HH:MM | [Event description] |
+| YYYY-MM-DD HH:MM | [Event description] |
+
+---
+
+## Impact Assessment
+
+### Systems Affected
+- [ ] System 1 - [Impact description]
+- [ ] System 2 - [Impact description]
+
+### Data Affected
+- [ ] Type of data
+- [ ] Volume
+- [ ] Sensitivity classification
+
+### Users Affected
+- Number of users: [X]
+- User groups: [Groups]
+
+### Business Impact
+- [ ] Service downtime: [Duration]
+- [ ] Financial impact: [Estimate]
+- [ ] Reputation impact: [Assessment]
+
+---
+
+## Root Cause Analysis
+
+### Attack Vector
+[Description of how the incident occurred]
+
+### Contributing Factors
+1. [Factor 1]
+2. [Factor 2]
+3. [Factor 3]
+
+### Root Cause
+[Description of the underlying cause]
+
+---
+
+## Indicators of Compromise (IOCs)
+
+### IP Addresses
+```
+X.X.X.X - [Description]
+```
+
+### Domains
+```
+malicious.domain.com - [Description]
+```
+
+### File Hashes
+```
+SHA256: [hash] - [Filename]
+```
+
+### Other IOCs
+[Any other relevant indicators]
+
+---
+
+## Response Actions
+
+### Containment
+- [x] Action 1
+- [x] Action 2
+- [ ] Action 3 (in progress)
+
+### Eradication
+- [ ] Action 1
+- [ ] Action 2
+
+### Recovery
+- [ ] Action 1
+- [ ] Action 2
+
+---
+
+## Lessons Learned
+
+### What Went Well
+1. [Item 1]
+2. [Item 2]
+
+### What Could Be Improved
+1. [Item 1]
+2. [Item 2]
+
+---
+
+## Action Items
+
+| ID | Action | Owner | Due Date | Status |
+|----|--------|-------|----------|--------|
+| 1 | [Action description] | [Name] | YYYY-MM-DD | Open |
+| 2 | [Action description] | [Name] | YYYY-MM-DD | Open |
+
+---
+
+## Notifications
+
+### Internal
+- [ ] Security Team
+- [ ] Engineering Team
+- [ ] Executive Team
+- [ ] Legal/Compliance
+
+### External
+- [ ] Affected customers
+- [ ] Regulatory bodies
+- [ ] Law enforcement
+
+---
+
+## Appendix
+
+### Evidence Files
+- [Link to evidence archive]
+- [Link to log exports]
+
+### Related Documents
+- [Link to runbook used]
+- [Link to previous incidents]
+
+---
+
+**Report Author:** [Name]  
+**Report Date:** YYYY-MM-DD  
+**Last Updated:** YYYY-MM-DD
@@ -0,0 +1,147 @@
+# Incident Response Playbook
+
+## Incident Severity Levels
+
+| Level | Name | Description | Response Time | Example |
+|-------|------|-------------|---------------|---------|
+| SEV1 | Critical | Active breach, data exfiltration | Immediate | Ransomware, active attacker |
+| SEV2 | High | Confirmed compromise, contained | 1 hour | Malware, credential theft |
+| SEV3 | Medium | Suspicious activity, potential threat | 4 hours | Phishing success, anomaly |
+| SEV4 | Low | Minor security event | 24 hours | Policy violation |
+
+## Response Phases
+
+### 1. Detection & Triage (0-15 minutes)
+
+```
+□ Confirm the incident is real (not false positive)
+□ Assess initial scope and severity
+□ Assign Incident Commander
+□ Open incident channel (#incident-YYYY-MM-DD)
+□ Start incident timeline documentation
+```
+
+**Key Questions:**
+- What systems are affected?
+- Is the threat active?
+- What data may be compromised?
+- Is it contained or spreading?
+
+### 2. Containment (15-60 minutes)
+
+**Short-term Containment:**
+```
+□ Isolate affected systems (network/firewall)
+□ Block malicious IPs/domains
+□ Disable compromised accounts
+□ Preserve evidence before changes
+```
+
+**Commands:**
+```bash
+# Network isolation
+iptables -I INPUT -s <malicious-ip> -j DROP
+iptables -I OUTPUT -d <malicious-ip> -j DROP
+
+# Account disable
+usermod -L <username>
+passwd -l <username>
+
+# Service isolation
+systemctl stop <compromised-service>
+```
+
+### 3. Investigation (1-4 hours)
+
+```
+□ Collect evidence (logs, memory, disk)
+□ Identify attack vector
+□ Determine scope of compromise
+□ Document findings in timeline
+```
+
+**Log Sources:**
+- Authentication: /var/log/auth.log, CloudTrail
+- Application: Application logs, APM
+- Network: Firewall logs, VPC Flow Logs
+- System: syslog, journald
+
+### 4. Eradication (1-24 hours)
+
+```
+□ Remove malware/backdoors
+□ Patch vulnerabilities
+□ Reset compromised credentials
+□ Update security controls
+□ Verify complete removal
+```
+
+### 5. Recovery (1-48 hours)
+
+```
+□ Restore systems from clean backups
+□ Validate system integrity
+□ Monitor for re-infection
+□ Gradually restore services
+□ Communicate status updates
+```
+
+### 6. Post-Incident (1-2 weeks)
+
+```
+□ Conduct blameless post-mortem
+□ Document lessons learned
+□ Create action items
+□ Update runbooks and detection
+□ Report to stakeholders
+□ File regulatory notifications (if required)
+```
+
+## Communication Templates
+
+### Internal Notification
+```
+SECURITY INCIDENT - [SEV LEVEL]
+
+Status: Active/Contained/Resolved
+Incident Commander: [Name]
+Channel: #incident-YYYY-MM-DD
+
+Summary: [Brief description]
+
+Impact:
+- Systems: [List]
+- Data: [Type if applicable]
+- Users: [Count/scope]
+
+Current Actions:
+- [Action 1]
+- [Action 2]
+
+Next Update: [Time]
+```
+
+### External Notification (if required)
+```
+Subject: Security Incident Notification
+
+We are writing to inform you of a security incident 
+that occurred on [DATE].
+
+What Happened: [Description]
+Data Involved: [Types]
+Actions Taken: [Response measures]
+What You Can Do: [Recommendations]
+Contact: [Security team contact]
+```
+
+## Escalation Contacts
+
+| Role | Primary | Secondary |
+|------|---------|-----------|
+| Incident Commander | [Name] | [Name] |
+| Security Lead | [Name] | [Name] |
+| Engineering Lead | [Name] | [Name] |
+| Legal/Compliance | [Name] | [Name] |
+| Communications | [Name] | [Name] |
+| Executive Sponsor | [Name] | [Name] |
@@ -0,0 +1,149 @@
+# Indicator of Compromise (IOC) Hunting Guide
+
+## Common IOC Types
+
+| Type | Description | Example |
+|------|-------------|---------|
+| IP Address | Malicious source/destination | 192.168.1.100 |
+| Domain | C2 or phishing domain | malware.evil.com |
+| File Hash | Malware signature | SHA256:abc123... |
+| File Path | Suspicious file location | /tmp/.hidden |
+| Process | Malicious process name | cryptominer |
+| User | Compromised account | admin |
+
+## Log Hunting Queries
+
+### SSH Brute Force Detection
+```bash
+# Failed SSH attempts
+grep "Failed password" /var/log/auth.log | \
+  awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head
+
+# Successful logins after failures
+grep -E "Accepted|Failed" /var/log/auth.log | \
+  grep -B5 "Accepted" | grep "Failed"
+```
+
+### Suspicious Process Activity
+```bash
+# Processes running from /tmp
+ps aux | grep -E "^.*/tmp/|^.*/dev/shm/"
+
+# Hidden processes
+ps aux | awk '$11 ~ /^\./'
+
+# Processes with deleted binaries
+ls -la /proc/*/exe 2>/dev/null | grep deleted
+
+# Unusual parent-child relationships
+ps -eo pid,ppid,cmd | grep -E "bash.*-c|sh.*-c"
+```
+
+### Network IOCs
+```bash
+# Connections to known bad ports
+ss -anp | grep -E ":4444|:5555|:6666|:31337"
+
+# Outbound connections from unusual processes
+ss -anp | grep -v -E "chrome|firefox|curl|wget" | grep ESTAB
+
+# DNS queries to suspicious domains
+grep -E "query.*\.(tk|ml|ga|cf|gq)$" /var/log/syslog
+
+# Large outbound transfers
+ss -anp | awk '$3 > 1000000'
+```
+
+### File System IOCs
+```bash
+# Recently modified files in sensitive locations
+find /etc /usr/bin /usr/sbin -mtime -1 -ls 2>/dev/null
+
+# Files with suspicious permissions
+find / -perm -4000 -o -perm -2000 -ls 2>/dev/null
+
+# Hidden files
+find / -name ".*" -type f -ls 2>/dev/null | head -50
+
+# World-writable files
+find / -perm -002 -type f -ls 2>/dev/null
+```
+
+### User Activity IOCs
+```bash
+# Recent sudo usage
+grep sudo /var/log/auth.log | tail -50
+
+# Users logged in from multiple IPs
+last | awk '{print $1, $3}' | sort | uniq -c | sort -rn
+
+# SSH keys added recently
+find /home -name "authorized_keys" -mtime -7 -ls
+
+# Unusual cron jobs
+for user in $(cut -d: -f1 /etc/passwd); do
+  crontab -l -u $user 2>/dev/null | grep -v "^#"
+done
+```
+
+## AWS CloudTrail Hunting
+
+```bash
+# Console logins from unusual locations
+aws cloudtrail lookup-events \
+  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
+  --query 'Events[*].[CloudTrailEvent]' --output text | jq '.'
+
+# Root account usage
+aws cloudtrail lookup-events \
+  --lookup-attributes AttributeKey=Username,AttributeValue=root
+
+# Security group changes
+aws cloudtrail lookup-events \
+  --lookup-attributes AttributeKey=EventName,AttributeValue=AuthorizeSecurityGroupIngress
+```
+
+## YARA Rule Example
+
+```yara
+rule Suspicious_Shell_Script {
+    meta:
+        description = "Detects suspicious shell scripts"
+        severity = "medium"
+    strings:
+        $s1 = "curl" ascii
+        $s2 = "wget" ascii
+        $s3 = "/dev/tcp/" ascii
+        $s4 = "base64 -d" ascii
+        $s5 = "chmod +x" ascii
+    condition:
+        3 of them
+}
+```
+
+## Response Actions
+
+### Block IOC
+```bash
+# Block IP
+iptables -I INPUT -s <IP> -j DROP
+iptables -I OUTPUT -d <IP> -j DROP
+
+# Block domain (via hosts)
+echo "127.0.0.1 malicious.domain.com" >> /etc/hosts
+
+# Kill process
+kill -9 <PID>
+```
+
+### Preserve Evidence
+```bash
+# Capture process memory
+gcore <PID>
+
+# Copy suspicious file
+cp --preserve=all /path/to/file /evidence/
+
+# Capture network traffic
+tcpdump -i any -w /evidence/capture.pcap &
+```
@@ -0,0 +1,109 @@
+#!/bin/bash
+# Security Incident Evidence Collection Script
+# Usage: ./collect-evidence.sh [incident-id]
+
+set -euo pipefail
+
+INCIDENT_ID="${1:-incident-$(date +%Y%m%d-%H%M%S)}"
+EVIDENCE_DIR="/tmp/evidence-$INCIDENT_ID"
+HOSTNAME=$(hostname)
+
+mkdir -p "$EVIDENCE_DIR"
+
+echo "========================================="
+echo "Security Incident Evidence Collection"
+echo "Incident ID: $INCIDENT_ID"
+echo "Host: $HOSTNAME"
+echo "Time: $(date -u '+%Y-%m-%d %H:%M:%S UTC')"
+echo "Output: $EVIDENCE_DIR"
+echo "========================================="
+echo ""
+
+# Create metadata file
+cat > "$EVIDENCE_DIR/metadata.txt" << EOF
+Incident ID: $INCIDENT_ID
+Collection Time: $(date -u '+%Y-%m-%d %H:%M:%S UTC')
+Hostname: $HOSTNAME
+Kernel: $(uname -a)
+Collector: $(whoami)
+EOF
+
+# System information
+echo "Collecting system information..."
+mkdir -p "$EVIDENCE_DIR/system"
+uname -a > "$EVIDENCE_DIR/system/uname.txt"
+cat /etc/os-release > "$EVIDENCE_DIR/system/os-release.txt" 2>/dev/null || true
+uptime > "$EVIDENCE_DIR/system/uptime.txt"
+date -u > "$EVIDENCE_DIR/system/date.txt"
+
+# Running processes
+echo "Collecting process information..."
+mkdir -p "$EVIDENCE_DIR/processes"
+ps auxf > "$EVIDENCE_DIR/processes/ps-auxf.txt"
+ps -eo pid,ppid,user,cmd --sort=-pid > "$EVIDENCE_DIR/processes/ps-sorted.txt"
+pstree -p > "$EVIDENCE_DIR/processes/pstree.txt" 2>/dev/null || true
+
+# Network connections
+echo "Collecting network information..."
+mkdir -p "$EVIDENCE_DIR/network"
+ss -tlnp > "$EVIDENCE_DIR/network/listening-tcp.txt"
+ss -ulnp > "$EVIDENCE_DIR/network/listening-udp.txt"
+ss -anp > "$EVIDENCE_DIR/network/all-connections.txt"
+ip addr > "$EVIDENCE_DIR/network/ip-addr.txt"
+ip route > "$EVIDENCE_DIR/network/ip-route.txt"
+iptables -L -n -v > "$EVIDENCE_DIR/network/iptables.txt" 2>/dev/null || true
+cat /etc/hosts > "$EVIDENCE_DIR/network/hosts.txt"
+
+# User information
+echo "Collecting user information..."
+mkdir -p "$EVIDENCE_DIR/users"
+cat /etc/passwd > "$EVIDENCE_DIR/users/passwd.txt"
+cat /etc/group > "$EVIDENCE_DIR/users/group.txt"
+who > "$EVIDENCE_DIR/users/who.txt"
+w > "$EVIDENCE_DIR/users/w.txt"
+last -100 > "$EVIDENCE_DIR/users/last.txt"
+lastlog > "$EVIDENCE_DIR/users/lastlog.txt" 2>/dev/null || true
+
+# Authentication logs
+echo "Collecting authentication logs..."
+mkdir -p "$EVIDENCE_DIR/logs"
+tail -1000 /var/log/auth.log > "$EVIDENCE_DIR/logs/auth.log" 2>/dev/null || true
+tail -1000 /var/log/secure > "$EVIDENCE_DIR/logs/secure.log" 2>/dev/null || true
+tail -1000 /var/log/syslog > "$EVIDENCE_DIR/logs/syslog.txt" 2>/dev/null || true
+journalctl -u sshd --since "1 day ago" > "$EVIDENCE_DIR/logs/sshd.log" 2>/dev/null || true
+
+# Scheduled tasks
+echo "Collecting scheduled tasks..."
+mkdir -p "$EVIDENCE_DIR/scheduled"
+crontab -l > "$EVIDENCE_DIR/scheduled/crontab-current.txt" 2>/dev/null || true
+ls -la /etc/cron.* > "$EVIDENCE_DIR/scheduled/cron-dirs.txt" 2>/dev/null || true
+cat /etc/crontab > "$EVIDENCE_DIR/scheduled/etc-crontab.txt" 2>/dev/null || true
+systemctl list-timers > "$EVIDENCE_DIR/scheduled/systemd-timers.txt" 2>/dev/null || true
+
+# File system
+echo "Collecting filesystem information..."
+mkdir -p "$EVIDENCE_DIR/filesystem"
+df -h > "$EVIDENCE_DIR/filesystem/df.txt"
+mount > "$EVIDENCE_DIR/filesystem/mounts.txt"
+find /tmp /var/tmp -type f -mtime -1 -ls > "$EVIDENCE_DIR/filesystem/recent-tmp.txt" 2>/dev/null || true
+
+# Package hashes
+echo "Collecting hash information..."
+if command -v sha256sum &>/dev/null; then
+    find /usr/bin /usr/sbin -type f -executable 2>/dev/null | head -100 | xargs sha256sum > "$EVIDENCE_DIR/filesystem/binary-hashes.txt" 2>/dev/null || true
+fi
+
+# Create archive
+echo ""
+echo "Creating evidence archive..."
+ARCHIVE="/tmp/$INCIDENT_ID-evidence.tar.gz"
+tar -czf "$ARCHIVE" -C /tmp "evidence-$INCIDENT_ID"
+
+echo ""
+echo "========================================="
+echo "Evidence collection complete"
+echo "Archive: $ARCHIVE"
+echo "Size: $(du -h "$ARCHIVE" | cut -f1)"
+echo ""
+echo "SHA256: $(sha256sum "$ARCHIVE" | cut -d' ' -f1)"
+echo "========================================="