41:02This recording is not available yet.
IR Playbooks – A New Open Source Resource
Download resourcesCategories
About this session
Mathieu Saulnier, then technical director of advanced security at Syntax and a DEF CON Blue Team Village mentor, rejects the idea that incident response playbooks are too organisation-specific to share. He separates three layers: the IR plan for executives (policy, legal, communications), the playbooks for SOC management (procedures such as ransom, account compromise, phishing, malware and data loss) and the micro plays or work instructions for analysts (how to submit a hash, pull a PCAP, disable a user). Only the middle layer is generic, and only that layer is published. He reviews existing open resources, from the Société Générale IRM and the Scottish government PDFs to the RE&CT framework and a per-technique project, and explains why he settled on a hybrid of draw.io workflows and Markdown hosted in Git. A live demo of the account compromise playbook walks through detect, analyse, contain and eradicate, recover and post-incident, with numbered steps so an incident commander can track several playbooks running in parallel. He closes by asking defenders to contribute through pull requests and to share the way red teams do.
I often hear that Playbooks can't be shared because they are org specific. I strongly believe this is not true. In most
organisations I've worked with the exact same steps are taken when a specific security event occurs. When a malware is identified, almost everyone will at some point check the hash on VirusTotal. In this talk I will present a "new" format of Playbook based on workflow and markdown files. I will also share a Git repo to find more playbooks to get your IR Program started.
Key takeaways
- Split IR documentation into plan (executives), playbooks (SOC management) and micro plays (analysts); share the playbooks, keep the plan and work instructions internal.
- Write playbooks as a draw.io workflow with a Markdown section per box, and link each box to the internal work instruction so juniors never skip a step.
- Number every step (for example AA1 for analyse, account compromise, step one) so the incident commander can see where each of several parallel playbooks stands.
- Design playbooks to spawn one another rather than duplicate content: account compromise typically hands off to data loss, ransom, malware and the critical incident playbook.
- During recovery, reset the krbtgt password twice, rebuild from clean media and use the post-incident review to add detections, LAPS and awareness content.
Speakers
Mathieu Saulnier
Mathieu Saulnier is a cybersecurity leader with 20+ years in Threat Research, Detection Engineering, Threat Hunting, and Incident Response. He has led diverse, global teams to success and shared his expertise on stages at Derbycon, SANS Summits… Read moreRead less
Mathieu Saulnier is a cybersecurity leader with 20+ years in Threat Research, Detection Engineering, Threat Hunting, and Incident Response. He has led diverse, global teams to success and shared his expertise on stages at Derbycon, SANS Summits, RSAC, SecTor, and BSides worldwide. A dedicated community mentor with DEF CON’s Blue Team Village and co-organizer of NorthSec, DEATHcon and SkiCon, Mathieu now serves as Product Manager for BloodHound Community Edition, empowering attackers and defenders to audit and secure complex environments.
