Réponse à incident — Playbook

$output = "C:\IR\$(hostname)_$(Get-Date -Format 'yyyyMMdd_HHmmss')"
New-Item -ItemType Directory -Path $output -Force
# Mémoire volatile — processus, connexions réseau
Get-Process | Export-Csv "$output\processes.csv" -NoTypeInformation
Get-NetTCPConnection | Export-Csv "$output\netconn.csv" -NoTypeInformation
netstat -nao > "$output\netstat.txt"
# Services et tâches planifiées
Get-Service | Export-Csv "$output\services.csv" -NoTypeInformation
Get-ScheduledTask | Export-Csv "$output\scheduled_tasks.csv" -NoTypeInformation
# Logs de sécurité (dernières 24h)
wevtutil epl Security "$output\Security.evtx" /q:"*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]"
wevtutil epl System "$output\System.evtx"
wevtutil epl "Microsoft-Windows-PowerShell/Operational" "$output\PowerShell.evtx"
# Registre — clés de persistance
reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "$output\HKLM_Run.reg"
reg export "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "$output\HKCU_Run.reg"
# Utilisateurs et sessions actives
query user > "$output\logged_users.txt"
net user > "$output\local_users.txt"
net localgroup administrators > "$output\local_admins.txt"
# Connexions établies avec hash des process
Get-NetTCPConnection -State Established | ForEach-Object {
  $p = Get-Process -Id $_.OwningProcess -EA 0
  [PSCustomObject]@{
    RemoteIP   = $_.RemoteAddress
    RemotePort = $_.RemotePort
    PID        = $_.OwningProcess
    Process    = $p.Name
    Path       = $p.Path
    Hash       = (Get-FileHash $p.Path -EA 0).Hash
  }
} | Export-Csv "$output\established_conns.csv" -NoTypeInformation
Write-Host "Evidence collected to: $output"

#!/bin/bash
OUTPUT"/tmp/ir_$(hostname)_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTPUT"
# Processus et connexions
ps auxf > "$OUTPUT/processes.txt"
ss -tulnp > "$OUTPUT/network_sockets.txt"
lsof -i > "$OUTPUT/open_files_network.txt"
netstat -nap 2>/dev/null > "$OUTPUT/netstat.txt"
# Utilisateurs connectés
who > "$OUTPUT/who.txt"
last -n 100 > "$OUTPUT/last.txt"
lastb -n 100 > "$OUTPUT/lastb.txt" 2>/dev/null
# Logs auth
cp /var/log/auth.log "$OUTPUT/" 2>/dev/null
cp /var/log/secure "$OUTPUT/" 2>/dev/null
journalctl --since "24 hours ago" > "$OUTPUT/journal_24h.txt"
# Tâches planifiées
crontab -l > "$OUTPUT/crontab_root.txt" 2>/dev/null
ls -la /etc/cron > "$OUTPUT/cron_dirs.txt"
cat /etc/crontab > "$OUTPUT/etc_crontab.txt"
# Persistance
systemctl list-units --type=service --state=running > "$OUTPUT/services.txt"
ls -la /etc/systemd/system/ > "$OUTPUT/systemd_units.txt"
# Hash des process actifs
for pid in ls /proc | grep -E '^[0-9]+$'; do
  exereadlink /proc/$pid/exe 2>/dev/null
   -n "$exe"  && echo "$pid $exe $(md5sum $exe 2>/dev/null | cut -d' ' -f1)"
done > "$OUTPUT/process_hashes.txt"
echo "Evidence collected to: $OUTPUT"
tar czf "${OUTPUT}.tar.gz" "$OUTPUT"

# Windows Defender — Isolation via PowerShell
Add-MpPreference -ThreatIDDefaultAction_Actions 6 # Block
# Ou via script Defender ATP isolate device
# Appeler l'API Microsoft Defender pour isoler l'hôte
$token = "{{DEFENDER_TOKEN}}"
$machineId = "{{MACHINE_ID}}"
Invoke-RestMethod -Method POST `
  -Uri "https://api.securitycenter.microsoft.com/api/machines/$machineId/isolate" `
  -Headers @{Authorization = "Bearer $token"} `
  -Body (@{Comment="IR Isolation - P1 incident"; IsolationType="Full"} | ConvertTo-Json) `
  -ContentType "application/json"

# Linux iptables — bloquer IP C2
iptables -I OUTPUT -d {{C2_IP}} -j DROP
iptables -I INPUT -s {{C2_IP}} -j DROP
iptables-save > /etc/iptables/rules.v4
# Windows — règle firewall
netsh advfirewall firewall add rule name"IR-Block-C2" 
  dirout actionblock remoteip{{C2_IP}}
# Palo Alto via CLI
set security policy rules ir-block-c2 destination  {{C2_IP}}/32  action deny

# Désactiver immédiatement le compte compromis
Disable-ADAccount -Identity "{{COMPROMISED_USER}}"
# Réinitialiser le mot de passe
Set-ADAccountPassword -Identity "{{COMPROMISED_USER}}" `
  -NewPassword (ConvertTo-SecureString "{{NEW_RANDOM_PASS}}" -AsPlainText -Force) `
  -Reset
# Forcer la déconnexion des sessions Kerberos (invalidate tickets)
$user = Get-ADUser "{{COMPROMISED_USER}}"
Get-ADUser $user -Properties msDS-KeyVersionNumber
Set-ADUser $user -Replace @{'msDS-KeyVersionNumber' = 1}
# Retirer des groupes privilégiés
Remove-ADGroupMember -Identity "Domain Admins" -Members "{{COMPROMISED_USER}}" -Confirm:$false

OBJET  P1 INCIDENT {{INCIDENT_TYPE}}  {{DATE}} {{HEURE}} UTC
INCIDENT EN COURS  SEVERITY P1
Incident ID  IR{{YYYYMMDD}}{{NNN}}
Dtect le   {{DATE}}  {{HEURE}} UTC
Analyste     {{ANALYST_NAME}}
Statut       CONTAINMENT IN PROGRESS
RSUM 
Description en 3-5 phrases  quoi qui impact mtier estim
SCOPE CONFIRM 
 Htes affects  {{COUNT}} {{HOSTNAMES}}
 Utilisateurs compromis  {{COUNT}} {{USERNAMES}}
 Donnes potentiellement exposes  OUI/NON/EN COURS DVALUATION
ACTIONS EN COURS 
 HHMM Isolation de {{HOST}} initie
 HHMM Compte {{USER}} dsactiv
 HHMM Analyse forensique en cours
 HHMM Recherche de propagation latrale
PROCHAINE MISE  JOUR  dans 30 minutes ou  changement de statut
Contact SOC  {{SOC_PHONE}} | {{SOC_SLACK_CHANNEL}}

# Post-Mortem — IR-{{ID}}
## Chronologie
| Heure (UTC) | Événement |
|---|---|
| {{T0}} | Première occurrence détectable |
| {{T1}} | Alerte SIEM déclenchée |
| {{T2}} | Analyse SOC débutée |
| {{T3}} | Incident confirmé P{{LEVEL}} |
| {{T4}} | Containment initié |
| {{T5}} | Containment complet |
| {{T6}} | Eradication confirmée |
| {{T7}} | Retour à la normale |
## Cause racine
{{RCA en 1-2 paragraphes}}
## Impact
- Durée d'exposition : {{DURATION}}
- Systèmes affectés : {{LIST}}
- Données exposées : {{OUI/NON + détails RGPD si applicable}}
## Ce qui a bien fonctionné
- ...
## Ce qui doit être amélioré
- ...
## Actions correctives
| Action | Responsable | Deadline |
|---|---|---|
| {{ACTION}} | {{TEAM}} | {{DATE}} |