GitHub - guardsight/gsvsoc_cirt-playbook-battle-cards: Cyber Incident Response Team Playbook Battle Cards

Playbook Battle Cards (PBC) are recipes for preparing and applying countermeasures against cyber threats and attacks
PBC are a prescriptive approach to combat various TTP deployed by cyber threat actors
PBC follow a PICERL model
PBC aid the kinetic activities conducted by humans prior to, during, and after cybersecurity incident response
PBC are inspired by https://github.com/certsocietegenerale/IRM/

Name		Name	Last commit message	Last commit date
Latest commit History 196 Commits
HTML		HTML
Markdown		Markdown
images		images
GSPBC-1000 - Impact - Data Encrypted For Impact - Ransomware.pdf		GSPBC-1000 - Impact - Data Encrypted For Impact - Ransomware.pdf
GSPBC-1001 - Initial Access - Exploit Enterprise Resources - Mobile Device SIM Attacks.pdf		GSPBC-1001 - Initial Access - Exploit Enterprise Resources - Mobile Device SIM Attacks.pdf
GSPBC-1002 - Credential Access - Spearphishing - Phishing.pdf		GSPBC-1002 - Credential Access - Spearphishing - Phishing.pdf
GSPBC-1003 - Exfiltration - Automated Exfiltration - Data Theft.pdf		GSPBC-1003 - Exfiltration - Automated Exfiltration - Data Theft.pdf
GSPBC-1004 - Lateral Movement - Pass the Hash.pdf		GSPBC-1004 - Lateral Movement - Pass the Hash.pdf
GSPBC-1005 - Persistence - Create Account - Backdoor User Accounts.pdf		GSPBC-1005 - Persistence - Create Account - Backdoor User Accounts.pdf
GSPBC-1006 - Initial Access - Trusted Relationship - Vendor Access to Infrastructure.pdf		GSPBC-1006 - Initial Access - Trusted Relationship - Vendor Access to Infrastructure.pdf
GSPBC-1007 - Persistence - Browser Extensions - Malicious Browser Extensions.pdf		GSPBC-1007 - Persistence - Browser Extensions - Malicious Browser Extensions.pdf
GSPBC-1008 - Money Mule Scams - CEO Fraud.pdf		GSPBC-1008 - Money Mule Scams - CEO Fraud.pdf
GSPBC-1009 - Persistence - Web Shells.pdf		GSPBC-1009 - Persistence - Web Shells.pdf
GSPBC-1010 - Device Theft - Device Loss.pdf		GSPBC-1010 - Device Theft - Device Loss.pdf
GSPBC-1011 - Initial Access - Drive By Compromise.pdf		GSPBC-1011 - Initial Access - Drive By Compromise.pdf
GSPBC-1012 - Initial Access - External Remote Services - Unauthorized VPN and VDI Access.pdf		GSPBC-1012 - Initial Access - External Remote Services - Unauthorized VPN and VDI Access.pdf
GSPBC-1013 - Impact - Defacement.pdf		GSPBC-1013 - Impact - Defacement.pdf
GSPBC-1014 - Impact - Inhibit System Recovery - Disabling Volume Shadow Service.pdf		GSPBC-1014 - Impact - Inhibit System Recovery - Disabling Volume Shadow Service.pdf
GSPBC-1015 - Defense Evasion - Disabling Security Software.pdf		GSPBC-1015 - Defense Evasion - Disabling Security Software.pdf
GSPBC-1016 - Defense Evasion - Install Root Certificate.pdf		GSPBC-1016 - Defense Evasion - Install Root Certificate.pdf
GSPBC-1017 - Credential Access - Password Spraying.pdf		GSPBC-1017 - Credential Access - Password Spraying.pdf
GSPBC-1018 - Collection - Email Collection - Cloud Email Compromise.pdf		GSPBC-1018 - Collection - Email Collection - Cloud Email Compromise.pdf
GSPBC-1019 - Persistence - BITS Jobs.pdf		GSPBC-1019 - Persistence - BITS Jobs.pdf
GSPBC-1020 - Persistence - Pre-OS Boot.pdf		GSPBC-1020 - Persistence - Pre-OS Boot.pdf
GSPBC-1021 - Privilege Escalation - Group Policy Modification.pdf		GSPBC-1021 - Privilege Escalation - Group Policy Modification.pdf
GSPBC-1022 - Defense Evasion - Process Injection.pdf		GSPBC-1022 - Defense Evasion - Process Injection.pdf
GSPBC-1023 - Privilege Escalation - Exploitation for Privilege Escalation.pdf		GSPBC-1023 - Privilege Escalation - Exploitation for Privilege Escalation.pdf
GSPBC-1024 - Credential Access - OS Credential Dumping.pdf		GSPBC-1024 - Credential Access - OS Credential Dumping.pdf
GSPBC-1025 - Credential Access - Unsecured Credentials.pdf		GSPBC-1025 - Credential Access - Unsecured Credentials.pdf
GSPBC-1026 - Defense Evasion - Obfuscated Files or Information.pdf		GSPBC-1026 - Defense Evasion - Obfuscated Files or Information.pdf
GSPBC-1027 - Impact - Disk Wipe.pdf		GSPBC-1027 - Impact - Disk Wipe.pdf
GSPBC-1028 - Persistence - Office Application Startup.pdf		GSPBC-1028 - Persistence - Office Application Startup.pdf
GSPBC-1029 - Execution - User Execution.pdf		GSPBC-1029 - Execution - User Execution.pdf
GSPBC-1030 - Reconnaissance - Active Scanning.pdf		GSPBC-1030 - Reconnaissance - Active Scanning.pdf
GSPBC-1031 - Persistence - Hijack Execution Flow.pdf		GSPBC-1031 - Persistence - Hijack Execution Flow.pdf
GSPBC-1032 - Resource Development - Compromise Accounts.pdf		GSPBC-1032 - Resource Development - Compromise Accounts.pdf
GSPBC-1033 - Credential Access - Input Capture.pdf		GSPBC-1033 - Credential Access - Input Capture.pdf
GSPBC-1034 - Execution - Native API.pdf		GSPBC-1034 - Execution - Native API.pdf
GSPBC-1035 - Credential Access - Credentials from Password Stores.pdf		GSPBC-1035 - Credential Access - Credentials from Password Stores.pdf
GSPBC-1036 - Defense Evasion - Indirect Command Execution.pdf		GSPBC-1036 - Defense Evasion - Indirect Command Execution.pdf
GSPBC-1037 - Execution - Deploy Container.pdf		GSPBC-1037 - Execution - Deploy Container.pdf
GSPBC-1038 - Credential Access - Steal Web Session Cookies.pdf		GSPBC-1038 - Credential Access - Steal Web Session Cookies.pdf
GSPBC-1039 - Lateral Movement - Use Alternate Authentication Material.pdf		GSPBC-1039 - Lateral Movement - Use Alternate Authentication Material.pdf
GSPBC-1040 - Discovery - Process Discovery.pdf		GSPBC-1040 - Discovery - Process Discovery.pdf
GSPBC-1041 - Persistence - Boot or Logon Autostart Execution.pdf		GSPBC-1041 - Persistence - Boot or Logon Autostart Execution.pdf
GSPBC-1042 - Lateral Movement - Replication Through Removable Media.pdf		GSPBC-1042 - Lateral Movement - Replication Through Removable Media.pdf
GSPBC-1043 - Execution - Exploitation for Client Execution.pdf		GSPBC-1043 - Execution - Exploitation for Client Execution.pdf
GSPBC-1044 - Lateral Movement - Taint Shared Content.pdf		GSPBC-1044 - Lateral Movement - Taint Shared Content.pdf
GSPBC-1045 - Privilege Escalation - Create or Modify System Process.pdf		GSPBC-1045 - Privilege Escalation - Create or Modify System Process.pdf
GSPBC-1046 - Defense Evasion - Subvert Trust Controls.pdf		GSPBC-1046 - Defense Evasion - Subvert Trust Controls.pdf
GSPBC-1047 - Defense Evasion - Domain Policy Modification.pdf		GSPBC-1047 - Defense Evasion - Domain Policy Modification.pdf
GSPBC-1048 - Credential Access - Brute Force.pdf		GSPBC-1048 - Credential Access - Brute Force.pdf
GSPBC-1049 - Impact - Resource Hijacking.pdf		GSPBC-1049 - Impact - Resource Hijacking.pdf
GSPBC-1050 - Initial Access - Hardware Additions.pdf		GSPBC-1050 - Initial Access - Hardware Additions.pdf
GSPBC-1051 - Exfiltration - Exfiltration Over Physical Medium.pdf		GSPBC-1051 - Exfiltration - Exfiltration Over Physical Medium.pdf
GSPBC-1052 - Defense Evasion - Impair Defenses.pdf		GSPBC-1052 - Defense Evasion - Impair Defenses.pdf
GSPBC-1053 - Initial Access - Exploit Public-Facing Application.pdf		GSPBC-1053 - Initial Access - Exploit Public-Facing Application.pdf
GSPBC-1054 - Discovery - Password Policy Discovery.pdf		GSPBC-1054 - Discovery - Password Policy Discovery.pdf
GSPBC-1055 - Reconnaissance - Search Victim-Owned Websites.pdf		GSPBC-1055 - Reconnaissance - Search Victim-Owned Websites.pdf
GSPBC-1056 - Reconnaissance - Gather Victim Host Information.pdf		GSPBC-1056 - Reconnaissance - Gather Victim Host Information.pdf
GSPBC-1057 - Defense Evasion - Valid Accounts.pdf		GSPBC-1057 - Defense Evasion - Valid Accounts.pdf
GSPBC-1058 - Persistence - Modify Authentication Process.pdf		GSPBC-1058 - Persistence - Modify Authentication Process.pdf
GSPBC-1059 - Discovery - Browser Bookmark Discovery.pdf		GSPBC-1059 - Discovery - Browser Bookmark Discovery.pdf
GSPBC-1060 - Lateral Movement - Internal Spearphishing.pdf		GSPBC-1060 - Lateral Movement - Internal Spearphishing.pdf
GSPBC-1061 - Reconnaissance - Gather Victim Identity Information.pdf		GSPBC-1061 - Reconnaissance - Gather Victim Identity Information.pdf
GSPBC-1062 - Command and Control - Application Layer Protocol.pdf		GSPBC-1062 - Command and Control - Application Layer Protocol.pdf
GSPBC-1063 - Execution - Scheduled Task or Job.pdf		GSPBC-1063 - Execution - Scheduled Task or Job.pdf
GSPBC-1064 - Persistence - Event Triggered Execution.pdf		GSPBC-1064 - Persistence - Event Triggered Execution.pdf
GSPBC-1065 - Privilege Escalation - Boot or Logon Initialization Scripts.pdf		GSPBC-1065 - Privilege Escalation - Boot or Logon Initialization Scripts.pdf
GSPBC-1066 - Initial Access - Replication Through Removable Media.pdf		GSPBC-1066 - Initial Access - Replication Through Removable Media.pdf
GSPBC-1067 - Persistence - Scheduled Task or Job.pdf		GSPBC-1067 - Persistence - Scheduled Task or Job.pdf
GSPBC-1068 - Credential Access - Network Sniffing.pdf		GSPBC-1068 - Credential Access - Network Sniffing.pdf
GSPBC-1069 - Command and Control - Communication Through Removable Media.pdf		GSPBC-1069 - Command and Control - Communication Through Removable Media.pdf
GSPBC-1070 - Command and Control - Protocol Tunneling.pdf		GSPBC-1070 - Command and Control - Protocol Tunneling.pdf
GSPBC-1071 - Exfiltration - Exfiltration Over Web Service.pdf		GSPBC-1071 - Exfiltration - Exfiltration Over Web Service.pdf
GSPBC-1072 - Privilege Escalation - Process Injection.pdf		GSPBC-1072 - Privilege Escalation - Process Injection.pdf
GSPBC-1073 - Privilege Escalation - Access Token Manipulation.pdf		GSPBC-1073 - Privilege Escalation - Access Token Manipulation.pdf
GSPBC-1074 - Reconnaissance - Search Open Websites_Domains.pdf		GSPBC-1074 - Reconnaissance - Search Open Websites_Domains.pdf
GSPBC-1075 - Initial Access - Supply Chain Compromise.pdf		GSPBC-1075 - Initial Access - Supply Chain Compromise.pdf
GSPBC-1076 - Discovery - Group Policy Discovery.pdf		GSPBC-1076 - Discovery - Group Policy Discovery.pdf
GSPBC-1077 - Persistence - Power Settings (1).pdf		GSPBC-1077 - Persistence - Power Settings (1).pdf
GSPBC-1078 - Lateral Movement - Lateral Tool Transfer.pdf		GSPBC-1078 - Lateral Movement - Lateral Tool Transfer.pdf
GSPBC-1079 - Defense Evasion - XSL Script Processing.pdf		GSPBC-1079 - Defense Evasion - XSL Script Processing.pdf
GSPBC-1080 - Impact - Network Denial of Service.pdf		GSPBC-1080 - Impact - Network Denial of Service.pdf
GSPBC-1081 - Impact - Endpoint Denial of Service.pdf		GSPBC-1081 - Impact - Endpoint Denial of Service.pdf
GSPBC-1082 - Reconnaissance - Gather Victim Network Information.pdf		GSPBC-1082 - Reconnaissance - Gather Victim Network Information.pdf
GSPBC-1083 - Initial Access - Content Injection.pdf		GSPBC-1083 - Initial Access - Content Injection.pdf
GSPBC-1084 - Persistence - Compromise Client Software Binary.pdf		GSPBC-1084 - Persistence - Compromise Client Software Binary.pdf
GSPBC-1085 - Defense Evasion - Template Injection.pdf		GSPBC-1085 - Defense Evasion - Template Injection.pdf
GSPBC-1086 - Discovery - Query Registry.pdf		GSPBC-1086 - Discovery - Query Registry.pdf
GSPBC-1087 - Collection - Video Capture.pdf		GSPBC-1087 - Collection - Video Capture.pdf
LICENSE		LICENSE
README.md		README.md
presentation-20191101-1.pdf		presentation-20191101-1.pdf

License

guardsight/gsvsoc_cirt-playbook-battle-cards

Folders and files

Latest commit

History