.

security/operations/incident-response/references/incident-playbook.md

@@ -0,0 +1,147 @@
+# Incident Response Playbook
+
+## Incident Severity Levels
+
+| Level | Name | Description | Response Time | Example |
+|-------|------|-------------|---------------|---------|
+| SEV1 | Critical | Active breach, data exfiltration | Immediate | Ransomware, active attacker |
+| SEV2 | High | Confirmed compromise, contained | 1 hour | Malware, credential theft |
+| SEV3 | Medium | Suspicious activity, potential threat | 4 hours | Phishing success, anomaly |
+| SEV4 | Low | Minor security event | 24 hours | Policy violation |
+
+## Response Phases
+
+### 1. Detection & Triage (0-15 minutes)
+
+```
+□ Confirm the incident is real (not false positive)
+□ Assess initial scope and severity
+□ Assign Incident Commander
+□ Open incident channel (#incident-YYYY-MM-DD)
+□ Start incident timeline documentation
+```
+
+**Key Questions:**
+- What systems are affected?
+- Is the threat active?
+- What data may be compromised?
+- Is it contained or spreading?
+
+### 2. Containment (15-60 minutes)
+
+**Short-term Containment:**
+```
+□ Isolate affected systems (network/firewall)
+□ Block malicious IPs/domains
+□ Disable compromised accounts
+□ Preserve evidence before changes
+```
+
+**Commands:**
+```bash
+# Network isolation
+iptables -I INPUT -s <malicious-ip> -j DROP
+iptables -I OUTPUT -d <malicious-ip> -j DROP
+
+# Account disable
+usermod -L <username>
+passwd -l <username>
+
+# Service isolation
+systemctl stop <compromised-service>
+```
+
+### 3. Investigation (1-4 hours)
+
+```
+□ Collect evidence (logs, memory, disk)
+□ Identify attack vector
+□ Determine scope of compromise
+□ Document findings in timeline
+```
+
+**Log Sources:**
+- Authentication: /var/log/auth.log, CloudTrail
+- Application: Application logs, APM
+- Network: Firewall logs, VPC Flow Logs
+- System: syslog, journald
+
+### 4. Eradication (1-24 hours)
+
+```
+□ Remove malware/backdoors
+□ Patch vulnerabilities
+□ Reset compromised credentials
+□ Update security controls
+□ Verify complete removal
+```
+
+### 5. Recovery (1-48 hours)
+
+```
+□ Restore systems from clean backups
+□ Validate system integrity
+□ Monitor for re-infection
+□ Gradually restore services
+□ Communicate status updates
+```
+
+### 6. Post-Incident (1-2 weeks)
+
+```
+□ Conduct blameless post-mortem
+□ Document lessons learned
+□ Create action items
+□ Update runbooks and detection
+□ Report to stakeholders
+□ File regulatory notifications (if required)
+```
+
+## Communication Templates
+
+### Internal Notification
+```
+SECURITY INCIDENT - [SEV LEVEL]
+
+Status: Active/Contained/Resolved
+Incident Commander: [Name]
+Channel: #incident-YYYY-MM-DD
+
+Summary: [Brief description]
+
+Impact:
+- Systems: [List]
+- Data: [Type if applicable]
+- Users: [Count/scope]
+
+Current Actions:
+- [Action 1]
+- [Action 2]
+
+Next Update: [Time]
+```
+
+### External Notification (if required)
+```
+Subject: Security Incident Notification
+
+We are writing to inform you of a security incident 
+that occurred on [DATE].
+
+What Happened: [Description]
+Data Involved: [Types]
+Actions Taken: [Response measures]
+What You Can Do: [Recommendations]
+Contact: [Security team contact]
+```
+
+## Escalation Contacts
+
+| Role | Primary | Secondary |
+|------|---------|-----------|
+| Incident Commander | [Name] | [Name] |
+| Security Lead | [Name] | [Name] |
+| Engineering Lead | [Name] | [Name] |
+| Legal/Compliance | [Name] | [Name] |
+| Communications | [Name] | [Name] |
+| Executive Sponsor | [Name] | [Name] |

security/operations/incident-response/references/ioc-hunting.md

@@ -0,0 +1,149 @@
+# Indicator of Compromise (IOC) Hunting Guide
+
+## Common IOC Types
+
+| Type | Description | Example |
+|------|-------------|---------|
+| IP Address | Malicious source/destination | 192.168.1.100 |
+| Domain | C2 or phishing domain | malware.evil.com |
+| File Hash | Malware signature | SHA256:abc123... |
+| File Path | Suspicious file location | /tmp/.hidden |
+| Process | Malicious process name | cryptominer |
+| User | Compromised account | admin |
+
+## Log Hunting Queries
+
+### SSH Brute Force Detection
+```bash
+# Failed SSH attempts
+grep "Failed password" /var/log/auth.log | \
+  awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head
+
+# Successful logins after failures
+grep -E "Accepted|Failed" /var/log/auth.log | \
+  grep -B5 "Accepted" | grep "Failed"
+```
+
+### Suspicious Process Activity
+```bash
+# Processes running from /tmp
+ps aux | grep -E "^.*/tmp/|^.*/dev/shm/"
+
+# Hidden processes
+ps aux | awk '$11 ~ /^\./'
+
+# Processes with deleted binaries
+ls -la /proc/*/exe 2>/dev/null | grep deleted
+
+# Unusual parent-child relationships
+ps -eo pid,ppid,cmd | grep -E "bash.*-c|sh.*-c"
+```
+
+### Network IOCs
+```bash
+# Connections to known bad ports
+ss -anp | grep -E ":4444|:5555|:6666|:31337"
+
+# Outbound connections from unusual processes
+ss -anp | grep -v -E "chrome|firefox|curl|wget" | grep ESTAB
+
+# DNS queries to suspicious domains
+grep -E "query.*\.(tk|ml|ga|cf|gq)$" /var/log/syslog
+
+# Large outbound transfers
+ss -anp | awk '$3 > 1000000'
+```
+
+### File System IOCs
+```bash
+# Recently modified files in sensitive locations
+find /etc /usr/bin /usr/sbin -mtime -1 -ls 2>/dev/null
+
+# Files with suspicious permissions
+find / -perm -4000 -o -perm -2000 -ls 2>/dev/null
+
+# Hidden files
+find / -name ".*" -type f -ls 2>/dev/null | head -50
+
+# World-writable files
+find / -perm -002 -type f -ls 2>/dev/null
+```
+
+### User Activity IOCs
+```bash
+# Recent sudo usage
+grep sudo /var/log/auth.log | tail -50
+
+# Users logged in from multiple IPs
+last | awk '{print $1, $3}' | sort | uniq -c | sort -rn
+
+# SSH keys added recently
+find /home -name "authorized_keys" -mtime -7 -ls
+
+# Unusual cron jobs
+for user in $(cut -d: -f1 /etc/passwd); do
+  crontab -l -u $user 2>/dev/null | grep -v "^#"
+done
+```
+
+## AWS CloudTrail Hunting
+
+```bash
+# Console logins from unusual locations
+aws cloudtrail lookup-events \
+  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
+  --query 'Events[*].[CloudTrailEvent]' --output text | jq '.'
+
+# Root account usage
+aws cloudtrail lookup-events \
+  --lookup-attributes AttributeKey=Username,AttributeValue=root
+
+# Security group changes
+aws cloudtrail lookup-events \
+  --lookup-attributes AttributeKey=EventName,AttributeValue=AuthorizeSecurityGroupIngress
+```
+
+## YARA Rule Example
+
+```yara
+rule Suspicious_Shell_Script {
+    meta:
+        description = "Detects suspicious shell scripts"
+        severity = "medium"
+    strings:
+        $s1 = "curl" ascii
+        $s2 = "wget" ascii
+        $s3 = "/dev/tcp/" ascii
+        $s4 = "base64 -d" ascii
+        $s5 = "chmod +x" ascii
+    condition:
+        3 of them
+}
+```
+
+## Response Actions
+
+### Block IOC
+```bash
+# Block IP
+iptables -I INPUT -s <IP> -j DROP
+iptables -I OUTPUT -d <IP> -j DROP
+
+# Block domain (via hosts)
+echo "127.0.0.1 malicious.domain.com" >> /etc/hosts
+
+# Kill process
+kill -9 <PID>
+```
+
+### Preserve Evidence
+```bash
+# Capture process memory
+gcore <PID>
+
+# Copy suspicious file
+cp --preserve=all /path/to/file /evidence/
+
+# Capture network traffic
+tcpdump -i any -w /evidence/capture.pcap &
+```