Repository files navigation

If you have an idea for the project please start adiscusssion.

That this project will be created by the SOC/Incident Response Community

• Develop a Catalog of Incident Response Playbook for every MITRE Technique (Keep in mind it won't work for some tactics).
• Develop a Catalog of Incident Response Playbook for uncommon incidents.
• Develop JSON Setup for Playbooks
• Develop a Catalog of Exercise Scenarios that can be used for training purposes.
• Develop a Catalog of tools used for Incident Response[Plus Reviews for the different tools].
• Develop a Catalog of Incident Response Automations.
• Develop a Catalog of Checklists[For Before, During, After Incidents].
• Develop a Catalog of Roles that a organization can use, to build their own program.
• Develop a Catalog of Event Codes and API Actions that you can/will see in a SIEM Detections.

• Develop a Battle Card Book, that can be reference for immediate help during a incident.

• Playbook: T1133 - Unauthorized VPN and VDI Access
• Playbook: T1189 - Drive By Compromise
• Playbook: T1566 - Phishing

• Playbook: T1114 - Cloud Email Compromise

• Playbook: T1110.003 - Password Spraying

• Playbook: T1055 - Process Injection

• Playbook: T1053 - Scheduled Task/Job

• Playbook: T1052.001 - Exfiltration over USB

• Playbook: T1485 - Data Destruction
• Playbook: T1486 - Data Encrypted for Impact Ransomware
• Playbook: T1489 - Service Stop
• Playbook: T1491.002 - External Defacement

For every pull request submitted a issue must also be created.

• Please ReadCreating a New Playbook;
• Check the list ofMITRE Techniques to choose from and create a new issue;
• Or you can just look at the list of issues that are ready to be worked on.

• Figure out how to IntegrateAtomic Red Team

• Creating a Playbook
• Combining Techniques Into One Playbook
• Incident Response Phases

Planning on Adding Photos later

• Dominik Sigl