Incident Response Playbook Catalogue

An attacker gains access to or spoofs a legitimate business email account to deceive internal staff, customers or partners into making unauthorised wire transfers, sharing credentials or altering financial records.

Respond to adversary-in-the-middle attacks that intercept authentication tokens and bypass multi-factor authentication. Covers phishing-resistant MFA deployment, session anomaly detection and conditional access remediation.

Respond to widespread phishing campaigns targeting your organisation. Covers credential harvesting, malware delivery, email gateway triage and user awareness actions.

An attacker uses automated tools and botnets to test large volumes of stolen credentials against a login portal in hopes of reusing valid username-password combinations, leading to unauthorised account access.

An attacker gains unauthorised access to a user's cloud account through phishing, password spraying, token theft or OAuth abuse. The attacker may access email, storage, admin functions or cloud infrastructure.

An attacker gains access to a valid session token and uses it to impersonate a legitimate user on a SaaS platform, allowing access without triggering MFA or login anomaly alerts.

An attacker escalates privileges from a low-privilege user to an administrative or root-level account through a vulnerability, misconfiguration or stolen credentials, potentially compromising critical systems.

An attacker gains access to a user's cloud or application account by tricking them into authorising a malicious OAuth app, giving persistent access without requiring login credentials and bypassing MFA.

An attacker launches a brute-force or password spraying attack against internet-exposed or internal RDP services to gain access using weak or reused credentials, potentially leading to lateral movement or malware deployment.

An insider or external actor using stolen insider credentials accesses sensitive systems, extracts data or performs unauthorised activities, often bypassing traditional security detection.

An endpoint or server exhibits signs of ransomware activity such as file encryption, ransom notes or alerts from EDR/XDR tools. Covers NCSC guidance, ICO notification and law enforcement engagement.

An attacker gains access to cloud object storage and performs malicious actions such as encrypting files, altering permissions or deleting backups, purely using APIs or SDKs without deploying ransomware binaries.

Respond to unauthorised cryptocurrency mining on endpoints, servers or cloud instances. Covers CPU/GPU anomaly detection, mining pool blocking, container image hardening and cloud billing anomaly investigation.

Malicious software is introduced into the environment through an infected USB storage device. Covers autorun malware, ransomware, keyloggers and tools used to establish persistence or exfiltrate data.

Handle compromise of corporate and BYOD mobile devices. Covers MDM-based containment, app removal, factory reset procedures and data protection considerations.

Detect and respond to advanced persistent threats involving sophisticated, long-term intrusions. Covers threat hunting, forensic analysis, NCSC engagement and coordinated eradication across the environment.

Respond to volumetric, protocol and application-layer DDoS attacks targeting public-facing infrastructure. Covers ISP engagement, CDN configuration, traffic scrubbing and business continuity activation.

Respond to a watering hole attack where an attacker compromises a website frequently visited by target users to deliver malware or harvest credentials. Covers browser forensics and network indicator analysis.

Sensitive or confidential data is exposed to the public due to misconfigured permissions on cloud storage services, often discovered via threat intelligence feeds, automated scanners or internal audits.

An attacker gains a foothold in one cloud workload and moves laterally by leveraging over-permissive roles, unsecured credentials, shared storage or misconfigured network rules to reach other workloads or services.

A misconfigured cloud identity or access control is exploited by an internal or external actor to gain elevated access, move laterally or access restricted resources. Covers IAM policy remediation and CSPM tooling.

A cloud database snapshot is created or shared without approval, potentially leading to sensitive data exfiltration if the snapshot is exposed to unauthorised users or shared publicly.

An attacker exploits a vulnerability in a web application or server to gain unauthorised access, execute commands or extract sensitive data. Covers WAF tuning, forensic analysis and secure code review.

An attacker injects malicious JavaScript code into a public-facing website via compromised CMS, third-party scripts or misconfigured CDN. Covers credential harvesting, skimming and session hijacking response.

An attacker discovers and exploits insecure API endpoints lacking authentication, rate limiting or proper input validation to perform unauthorised data access, modify business logic or escalate privileges.

Full UK GDPR personal data breach response. Covers 72-hour ICO notification, data subject communication, risk assessment, multi-jurisdictional notification requirements and regulatory liaison.

An internal employee, contractor or privileged user attempts to or successfully exfiltrates sensitive data through unauthorised channels such as personal email, cloud storage, removable media or file transfer tools.

A trusted user abuses their access to sensitive data and begins uploading it to unapproved cloud platforms for exfiltration. This may precede resignation, whistleblowing or corporate espionage.

An attacker uses DNS as a communication channel to exfiltrate data or maintain command and control. DNS tunnelling disguises malicious payloads or stolen data inside DNS queries, bypassing traditional detection.

An insider or compromised system accesses database resources in an unauthorised manner, such as bypassing access controls, querying sensitive tables or using privileged database accounts inappropriately.

An employee or system uses a generative AI tool in a production environment without formal approval or proper security evaluation, risking sensitive data exposure through AI prompts or integrations.

Respond to deliberate sabotage or destructive actions by an insider, including mass file deletion, service disruption, configuration wipes and permission changes. Covers HR coordination and evidence handling.

An organisation is compromised through a trusted third-party service, software update, library, plugin or IT service provider. The attacker uses the trusted relationship to move laterally, deploy malware or exfiltrate data.

A critical vulnerability is disclosed or actively exploited in a third-party library or framework used within your environment. Covers asset inventory, patching prioritisation and compensating controls.

An attacker gains access to or exploits weaknesses in a CI/CD pipeline to manipulate build processes, inject malicious code or secrets or use the pipeline to pivot into broader infrastructure.

Secrets stored in CI/CD tools are accessed by an unauthorised party through misconfiguration, leaked logs, compromised runners or malicious pull requests. Covers credential rotation and vault migration.

A developer accidentally commits and pushes API keys, cloud credentials or other secrets to a public GitHub repository. These secrets can be harvested by attackers and used to access critical systems.

An attacker gains access to a container and attempts to escape the isolated environment to interact with the host operating system, escalate privileges or compromise other containers or underlying infrastructure.

An individual gains access to a development environment without authorisation, potentially resulting in code theft, insertion of malicious code or exposure of credentials and secrets.

An employee or team uses an unapproved SaaS application for work-related purposes, transferring corporate data without security oversight. This can result in unauthorised data exposure or regulatory breaches.

A previously unknown or unauthorised IT asset is discovered operating within or connected to the corporate environment, potentially bypassing security controls and increasing risk exposure.

An employee or attacker grants a third-party application access to a corporate SaaS account using OAuth scopes. These applications may exfiltrate data, impersonate users or maintain persistent access.