Blue | Orga Cheatsheet

Acquire a copy of Malicious file(s) for analysis?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Malicious effects on systems list. Acquire an itemized list of all known changes on computer systems, files, settings, registry, services add/modified/deleted or stop/started.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Which A/V or malware tools can detect and remove malicious threat?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Where does malware/attacker exit the network?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Malicious internal/external sites/connections still active?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Malware listening on any ports?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Malware method of original infection, and/or weakness?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Packet capture of Malware trying to infect others?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Any packet capture of malware trying to communicate out of network and ID method of ports, IPs, DNS, etc?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Malware pose threat to any sensitive data (Files, credentials, Intellectual Property, PII, etc)?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

What are the DNS entries on an infected system?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Is it possible to detect the first infected system(s)?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Has the first systems hard drive been preserved?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Do any scripts need to be ran on live infected systems?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Is there a desktop management tool? If so, what reports are available to inventory all systems and statuses?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

List of all infected systems?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Identify any patching missing with current and/or previous vulnerability scan.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Look for systems that have stopped reporting into Malware servers for updates, or which ones have stopped going to AV vendors for updates.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Look for systems that have stopped going to Update server or directly to Microsoft for updates.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

How many systems are still unknown, clear, suspicious, or infected?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Networking device(s) changes. (Switches, Routers, Firewalls, IPS, NAC, Wi-Fi, etc.).
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Active Directory OU isolation of suspected systems.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Active Directory - User account restrictions and resets.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Active Directory policies to prohibit threats from running and/or access.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Firewall blocks.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

DNS blocks (null route malware site(s)).
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Web filtering blocks.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Administrative AD Password Changes.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Local Administrative Password Changes.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

User AD Password Changes.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Local User Password Changes.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Service Account Password Changes.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Push Antivirus updates for detected malware.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Try multiple antivirus tools.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

What Active Directory GPO policies are set (Logs, Restrictions, etc.)?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

What is the network architecture and how would Malware traverse?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Are there additional IDS/IPS segments that need coverage to prevent/detect outbreak?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

3rd Party Applications missing patches (Adobe, Java, etc.)?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Monitor client email for vendor or other business continuity items of interest.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Monitor RDP sessions on external accessible RDP client system.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Are there any applications in use that are facilitating the attack? If so, are there alternatives?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Is there a baseline system to review for changes?
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Monitor user name variations.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Managing and monitoring tasks.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Review border router logs.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Review VPN (remote access) logs.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Citrix / VMWare or similar logs.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Review accounting server(s) logs and trends of users.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Review AD server logs.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Review Anti-Virus (Malicious Code Services) logs.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Review email abuse notifications and logs.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Review DNS logs.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Review account and policy abuse logs.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Review host firewall logs.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Rebuild all systems in life cycle rebuild plan.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Synchronize time services across of systems.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Create incident data repository.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Consider host based IPS.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Consider Network Access Control (NAC).
- Priority: H/M/L | Effort: H/M/L | Open/Closed

3rd Party internal/external security and perimeter security tools and assessment services.
- Priority: H/M/L | Effort: H/M/L | Open/Closed

Runs in memory only.
- Yes | No | Unknown | N/A

Runs out of registry.
- Yes | No | Unknown | N/A

Artifacts on disk.
- Yes | No | Unknown | N/A

Disk file presence hidden, stored in unallocated, free/slack space or encrypted.
- Yes | No | Unknown | N/A

Has no icon.
- Yes | No | Unknown | N/A

Has no description or company name.
- Yes | No | Unknown | N/A

Unsigned Microsoft images.
- Yes | No | Unknown | N/A

Are packed and likely encrypted.
- Yes | No | Unknown | N/A

Suspicious DLLs or services.
- Yes | No | Unknown | N/A

Backups and swaps itself in and out in place of real file.
- Yes | No | Unknown | N/A

Stays alive working in file pairs.
- Yes | No | Unknown | N/A

Found in embedded devices, industrial controls and IOT.
- Yes | No | Unknown | N/A

Downloads new code/functionality.
- Yes | No | Unknown | N/A

Leverages pivot system(s) and network path(s) to exit the victim network including VPN/Dial-Up, HTTP/HTTPS, and other standard or non-standard services and ports.
- Yes | No | Unknown | N/A

Ability to leverage mobile devices and other removable media.
- Yes | No | Unknown | N/A

Ability to detect and utilize authenticated web proxies.
- Yes | No | Unknown | N/A

Morphs on victim client system.
- Yes | No | Unknown | N/A

Contains red herring (misleading/distracting) features depending on the environment it detects.
- Yes | No | Unknown | N/A

Ability to traverse all known operating systems.
- Yes | No | Unknown | N/A

Ability to move into embedded devices
- Yes | No | Unknown | N/A

Ability to conduct most Windows based Active Directory commands.
- Yes | No | Unknown | N/A

Ability to upload and download files/payloads.
- Yes | No | Unknown | N/A

Can use built-in services or purpose built malware for needed services.
- Yes | No | Unknown | N/A

Has several persistent features, making the malware highly resilient to A/V defenses.
- Yes | No | Unknown | N/A

Ability to brute force.
- Yes | No | Unknown | N/A

Ability to DoS/DDoS tools.
- Yes | No | Unknown | N/A

Ability to steal and/or pass the hash.
- Yes | No | Unknown | N/A

Ability to conduct credential harvesting.
- Yes | No | Unknown | N/A

Privilege escalation capability.
- Yes | No | Unknown | N/A

Ransomware or like capability.
- Yes | No | Unknown | N/A

Self-Destruct mode, including destructive methods.
- Yes | No | Unknown | N/A

Anti memory forensics.
- Yes | No | Unknown | N/A

Is sandbox aware and virtual machine aware.
- Yes | No | Unknown | N/A

Apply software patch to prevent other malware infection
- Yes | No | Unknown | N/A

C2 techniques: DNS, HTTP, HTTPS, stegonagraphy, cloud, TOR, online code, etc.
- Yes | No | Unknown | N/A

One time install/detonation
- Yes | No | Unknown | N/A

Communicates in no predictable patterns including short and long-term sleep techniques.
- Yes | No | Unknown | N/A

Makes use of compromised CA, in order to hide communications.
- Yes | No | Unknown | N/A

Time zone and IP Geo aware.
- Yes | No | Unknown | N/A

Makes use of well-established commercial compromised web sites for C2, i.e. Dropbox, Gmail, etc.
- Yes | No | Unknown | N/A

incident_id: [BLANK]

security_incident: Confirmed, Suspected, False positive, Near miss, No

confidence: High, Medium, Low, None

victim.employee_count: [BLANK]

timeline.unit: Unknown, NA, Seconds, Minutes, Hours, Days, Weeks, Months, Years, Never

impact.overall_rating: Unknown, Insignificant, Distracting, Painful, Damaging, Catastrophic

impact.loss.variety: Asset and fraud, Brand damage, Business disruption, Operating costs, Legal and regulatory, Competitive advantage, Response and recovery

impact.loss.rating: Unknown, Major, Moderate, Minor, None

discovery_method: Unknown, Ext - actor disclosure, Ext - fraud detection, Ext - monitoring service, Ext - customer, Ext - unrelated party, Ext - audit, Ext - unknown, Int - antivirus, Int - incident response, Int - financial audit, Int - fraud detection, Int - HIDS, Int - IT audit, Int - log review, Int - NIDS, Ext - law enforcement, Int - security alarm, Int - reported by user, Int - unknown, Other

targeted: Unknown, Opportunistic, Targeted, NA

cost_corrective_action: Unknown, Simple and cheap, Difficult and expensive, Something in-between

country: Unknown, Two Letter, Other

iso_currency_code: AED, AFN, ALL, AMD, ANG, AOA, ARS, AUD, AWG, AZN, BAM, BBD, BDT, BGN, BHD, BIF, BMD, BND, BOB, BRL, BSD, BTN, BWP, BYR, BZD, CAD, CDF, CHF, CLP, CNY, COP, CRC, CUC, CUP, CVE, CZK, DJF, DKK, DOP, DZD, EGP, ERN, ETB, EUR, FJD, FKP, GBP, GEL, GGP, GHS, GIP, GMD, GNF, GTQ, GYD, HKD, HNL, HRK, HTG, HUF, IDR, ILS, IMP, INR, IQD, IRR, ISK, JEP, JMD, JOD, JPY, KES, KGS, KHR, KMF, KPW, KRW, KWD, KYD, KZT, LAK, LBP, LKR, LRD, LSL, LTL, LVL, LYD, MAD, MDL, MGA, MKD, MMK, MNT, MOP, MRO, MUR, MVR, MWK, MXN, MYR, MZN, NAD, NGN, NIO, NOK, NPR, NZD, OMR, PAB, PEN, PGK, PHP, PKR, PLN, PYG, QAR, RON, RSD, RUB, RWF, SAR, SBD, SCR, SDG, SEK, SGD, SHP, SLL, SOS, SPL, SRD, STD, SVC, SYP, SZL, THB, TJS, TMT, TND, TOP, TRY, TTD, TVD, TWD, TZS, UAH, UGX, USD, UYU, UZS, VEF, VND, VUV, WST, XAF, XCD, XDR, XOF, XPF, YER, ZAR, ZMK, ZWD

actor.x.motive: Unknown, NA, Espionage, Fear, Financial, Fun, Grudge, Ideology, Convenience, Other

actor.external.variety: Unknown, Activist, Auditor, Competitor, Customer, Force majeure, Former employee, Nation-state, Organized crime, Acquaintance, State-affiliated, Terrorist, Unaffiliated, Other

actor.internal.variety: Unknown, Auditor, Call center, Cashier, End-user, Executive, Finance, Helpdesk, Human resources, Maintenance, Manager, Guard, Developer, System admin, Other

action.malware.variety: Unknown, Adware, Backdoor, Brute force, Capture app data, Capture stored data, Client-side attack, Click fraud, C2, Destroy data, Disable controls, DoS, Downloader, Exploit vuln, Export data, Packet sniffer, Password dumper, Ram scraper, Ransomware, Rootkit, Scan network, Spam, Spyware/Keylogger, SQL injection, Adminware, Worm, Other

action.malware.vector: Unknown, Direct install, Download by malware, Email autoexecute, Email link, Email attachment, Instant messaging, Network propagation, Remote injection, Removable media, Web drive-by, Web download, Other

action.hacking.variety: Unknown, Abuse of functionality, Brute force, Buffer overflow, Cache poisoning, Session prediction, CSRF, XSS, Cryptanalysis, DoS, Footprinting, Forced browsing, Format string attack, Fuzz testing, HTTP request smuggling, HTTP request splitting, HTTP response smuggling, HTTP Response Splitting, Integer overflows, LDAP injection, Mail command injection, MitM, Null byte injection, Offline cracking, OS commanding, Path traversal, RFI, Reverse engineering, Routing detour, Session fixation, Session replay, Soap array abuse, Special element injection, SQLi, SSI injection, URL redirector abuse, Use of backdoor or C2, Use of stolen creds, XML attribute blowup, XML entity expansion, XML external entities, XML injection, XPath injection, XQuery injection, Virtual machine escape, Other

action.hacking.vector: Unknown, 3rd party desktop, Backdoor or C2, Desktop sharing, Physical access, Command shell, Partner, VPN, Web application, Other

action.social.variety: Unknown, Baiting, Bribery, Elicitation, Extortion, Forgery, Influence, Scam, Phishing, Pretexting, Propaganda, Spam, Other

action.social.vector: Unknown, Documents, Email, In-person, IM, Phone, Removable media, SMS, Social media, Software, Website, Other

action.social.target: Unknown, Auditor, Call center, Cashier, Customer, End-user, Executive, Finance, Former employee, Helpdesk, Human resources, Maintenance, Manager, Partner, Guard, Developer, System admin, Other

action.misuse.variety: Unknown, Knowledge abuse, Privilege abuse, Embezzlement, Data mishandling, Email misuse, Net misuse, Illicit content, Unapproved workaround, Unapproved hardware, Unapproved software, Other

action.misuse.vector: Unknown, Physical access, LAN access, Remote access, Non-corporate, Other

action.physical.variety: Unknown, Assault, Sabotage, Snooping, Surveillance, Tampering, Theft, Wiretapping, Connection, Other

action.physical.location: Unknown, Partner facility, Partner vehicle, Personal residence, Personal vehicle, Public facility, Public vehicle, Victim secure area, Victim work area, Victim public area, Victim grounds, Other

action.physical.vector: Unknown, Privileged access, Visitor privileges, Bypassed controls, Disabled controls, Uncontrolled location, Other

action.error.variety: Unknown, Classification error, Data entry error, Disposal error, Gaffe, Loss, Maintenance error, Misconfiguration, Misdelivery, Misinformation, Omission, Physical accidents, Capacity shortage, Programming error, Publishing error, Malfunction, Other

action.error.vector: Unknown, Random error, Carelessness, Inadequate personnel, Inadequate processes, Inadequate technology, Other

action.environmental.variety: Unknown, Deterioration, Earthquake, EMI, ESD, Temperature, Fire, Flood, Hazmat, Humidity, Hurricane, Ice, Landslide, Lightning, Meteorite, Particulates, Pathogen, Power failure, Tornado, Tsunami, Vermin, Volcano, Leak, Wind, Other

asset.variety: Unknown, S - Authentication, S - Backup, S - Database, S - DHCP, S - Directory, S - DCS, S - DNS, S - File, S - Log, S - Mail, S - Mainframe, S - Payment switch, S - POS controller, S - Print, S - Proxy, S - Remote access, S - SCADA, S - Web application, S - Code repository, S - VM host, S - Other N - Access reader, N - Camera, N - Firewall, N - HSM, N - IDS, N - Broadband, N - PBX, N - Private WAN, N - PLC, N - Public WAN, N - RTU, N - Router or switch, N - SAN, N - Telephone, N - VoIP adapter, N - LAN, N - WLAN, N - Other U - Auth token, U - Desktop, U - Laptop, U - Media, U - Mobile phone, U - Peripheral, U - POS terminal, U - Tablet, U - Telephone, U - VoIP phone, U - Other T - ATM, T - PED pad, T - Gas terminal, T - Kiosk, T - Other M - Tapes, M - Disk media, M - Documents, M - Flash drive, M - Disk drive, M - Smart card, M - Payment card, M - Other P - System admin, P - Auditor, P - Call center, P - Cashier, P - Customer, P - Developer, P - End-user, P - Executive, P - Finance, P - Former employee, P - Guard, P - Helpdesk, P - Human resources, P - Maintenance, P - Manager, P - Partner, P - Other

asset.accessibility: Unknown, External, Internal, Isolated, NA

asset.accessibility: Unknown, External, Internal, Isolated, NA

asset.ownership: Unknown, Victim, Employee, Partner, Customer, NA

asset.management: Unknown, Internal, External, NA

asset.hosting: Unknown, Internal, External shared, External dedicated, External, NA

asset.cloud: Unknown, Hypervisor, Partner application, Hosting governance, Customer attack, Hosting

attribute.confidentiality.data_disclosure: Unknown, Yes, Potentially, No

attribute.confidentiality.data.variety: Unknown, Credentials, Bank, Classified, Copyrighted, Medical, Payment, Personal, Internal, System, Secrets, Other

attribute.confidentiality.state: Unknown, Stored, Stored encrypted, Stored unencrypted, Transmitted, Transmitted encrypted, Transmitted unencrypted, Processed

attribute.integrity.variety: Unknown, Created account, Hardware tampering, Alter behavior, Fraudulent transaction, Log tampering, Misappropriation, Misrepresentation, Modify configuration, Modify privileges, Modify data, Software installation, Other

attribute.availability.variety: Unknown, Destruction, Loss, Interruption, Degradation, Acceleration, Obscuration, Other

coa.type: Blocking, Redirecting, Hardening, Patching, Rebuilding, Monitoring, Other

coa.impact: Insignificant, Distracting, Painful, Damaging, Catastrophic, Unknown

coa.efficacy: Not Effective, Somewhat Effective, Mostly Effective, Completely Effective, NA

coa.stage: Prepare, Remedy, Response, Recovered

coa.hosting: Unknown, Internal, External shared, External dedicated, External, NA

coa.objective: Detect, Deny, Disrupt, Degrade, Deceive, Destroy

Active Reconnaissance

• Identified evidence, artifact, info, or intel | [BLANK]
• Course of Action | Detect, Deny, Disrupt, Degrade, Deceive, Destroy

Weaponization and Customization

• Identified evidence, artifact, info, or intel | [BLANK]
• Course of Action | Detect, Deny, Disrupt, Degrade, Deceive, Destroy

Delivery

• Identified evidence, artifact, info, or intel | [BLANK]
• Course of Action | Detect, Deny, Disrupt, Degrade, Deceive, Destroy

Exploitation

• Identified evidence, artifact, info, or intel | [BLANK]
• Course of Action | Detect, Deny, Disrupt, Degrade, Deceive, Destroy

Installation

• Identified evidence, artifact, info, or intel | [BLANK]
• Course of Action | Detect, Deny, Disrupt, Degrade, Deceive, Destroy

Command & Control (C2)

• Identified evidence, artifact, info, or intel | [BLANK]
• Course of Action | Detect, Deny, Disrupt, Degrade, Deceive, Destroy

Action on Objectives

• Identified evidence, artifact, info, or intel | [BLANK]
• Course of Action | Detect, Deny, Disrupt, Degrade, Deceive, Destroy

Asset: [BLANK]

• Location: [BLANK]
• Description: [BLANK]
• Purpose: [BLANK]
• Time Prioritized: [BLANK]
• Criticality: [BLANK]
• Vulnerability: [BLANK]
• Recoverability: [BLANK]
• Ranking: [BLANK]
• Priority: I

Asset: [BLANK]

• Location: [BLANK]
• Description: [BLANK]
• Purpose: [BLANK]
• Time Prioritized: [BLANK]
• Criticality: [BLANK]
• Vulnerability: [BLANK]
• Recoverability: [BLANK]
• Ranking: [BLANK]
• Priority: II

Asset: [BLANK]

• Location: [BLANK]
• Description: [BLANK]
• Purpose: [BLANK]
• Time Prioritized: [BLANK]
• Criticality: [BLANK]
• Vulnerability: [BLANK]
• Recoverability: [BLANK]
• Ranking: [BLANK]
• Priority: III