0xSAC // Readiness & Field Resources

Host Triage & Hardening Baseline

• Linux: Review /etc/passwd for unexpected UID 0 accounts; inspect sudoers and included files. Check auditd status, authentication logs, Nginx configuration and access/error logs.
• Active Directory: Review privileged membership, krbtgt rotation history, and duplicate or unexpected Kerberos SPNs. Coordinate any dual reset of krbtgt with the directory recovery lead; do not reset during triage.
• Sysmon: Correlate Event IDs 1 (process creation), 3 (network connection), and 11 (file creation). Network logging depends on the deployed configuration.

awk -F: '$3 == 0 {print $1}' /etc/passwd
sudo visudo -c
sudo systemctl status auditd --no-pager
sudo nginx -t

# Windows: duplicate SPNs (authorized domain)
setspn -X
Get-WinEvent -FilterHashtable @{
  LogName='Microsoft-Windows-Sysmon/Operational'
  Id=1,3,11
} -MaxEvents 50

DFIR & Memory Analysis Cheatsheet

Work from hashed copies of acquired memory and packet captures. Plugin availability depends on OS, symbols, and the installed Volatility 3 release; confirm with vol.py --help. Treat hashdump output as sensitive credential material.

python vol.py -f memory.raw windows.pslist
python vol.py -f memory.raw windows.sessions
python vol.py -f memory.raw windows.hashdump

# Zeek: process a local capture
zeek -r incident.pcap
zeek-cut id.orig_h id.resp_h service < conn.log

# Wireshark display filters
dns.flags.response == 0
tcp.flags.syn == 1 && tcp.flags.ack == 0
http.request
tls.handshake.type == 1

Operator Tooling Jump-Kit

Local verification manifest: obtain tools from official publishers, verify signatures/checksums, record versions, and test offline before arrival. These links do not certify your installed binaries.

• Sysinternals Suite — process and autorun review
• KAPE — artifact collection
• Velociraptor — endpoint investigation
• curl / jq — HTTP and JSON inspection
• Wireshark — packet analysis

Tool | Version | Publisher URL | SHA-256
Sysinternals Suite | [record] | [record] | [record]
KAPE               | [record] | [record] | [record]
Velociraptor       | [record] | [record] | [record]
curl / jq          | [record] | [record] | [record]
Wireshark          | [record] | [record] | [record]

Signature verified: [yes/no + verifier]
Offline smoke test: [date + outcome]
Exercise authorization: [scope + owner]

California Breach Clock Guide

1. Discovery: Record discovery time, evidence, affected services, data ownership, and counsel's notification assessment.
2. Immediate coordination: Assign incident/legal leads; coordinate threat intake with Cal-CSIC. Intake is not a substitute for statutory notices.
3. Resident notice: Review Civil Code § 1798.82, including the 2026 30-calendar-day discovery deadline and permitted delays. Public agencies must separately assess § 1798.29.
4. Attorney General: For notices to more than 500 California residents under § 1798.82, review the 15-calendar-day deadline after resident notification and AG submission requirements.
5. Federal thresholds: Assess sector rules and CISA/CIRCIA coverage. The framework specifies 72 hours for covered incidents and 24 hours for ransom payments; verify final-rule effective dates and applicability before treating these as operative deadlines.

Discovery timestamp + timezone: [ ]
Entity / applicable statute: [ ]
Data types + affected residents: [ ]
Counsel / decision owner: [ ]
Resident notice deadline + basis: [ ]
AG deadline + submission record: [ ]
Cal-CSIC intake reference: [ ]
Federal coverage + rule effective date: [ ]
Permitted delay + legal basis: [ ]
Next assessment / approver: [ ]

Crisis Communications Holding Statements

Replace placeholders with verified facts. Require counsel and communications approval; these statements do not replace legally required breach notices.

Initial Anomaly Ingestion

We are reviewing unusual activity affecting [service]. Our response team is assessing the situation. Current service availability is [verified status]. We will provide our next update at [time / channel].

Active Forensic Investigation

We are investigating a cybersecurity incident involving [confirmed scope]. We have taken [verified containment action] and engaged [response partners]. The impact on personal information remains under assessment. For essential services, use [verified alternative]. Our next update will be [time / channel].

Confirmed Breach / Citizen Assistance

Our investigation confirmed unauthorized access to [verified data / systems] during [confirmed period]. We are notifying affected individuals through [approved channel]. Assistance is available at [verified contact], including [approved support]. Please follow [verified protective steps]. We will update [official channel] at [time].

Strategic Decision Rubric

Compare network boundary severance against essential public safety service continuity. Record the accountable executive's decision, residual risk, and a time-bound reassessment.

Decision / timestamp: [ ]
Verified facts / confidence: [ ]
Options + public safety impact: [ ]
Containment scope / exceptions: [ ]
Legal + service owner input: [ ]
Approver / accepted residual risk: [ ]
Fallback / rollback trigger: [ ]
Reassessment deadline / owner: [ ]

Enterprise System Recovery Plan (SRP) Skeleton

NIST SP 800-34r1 planning reference. Define recovery priorities and validate restoration before returning systems to service.

ENTERPRISE SYSTEM RECOVERY PLAN
Reference: NIST SP 800-34r1
Status: Local exercise starter; tailor before use

1. System / owner / approval / version: [ ]
2. Business impact + essential dependencies: [ ]
3. Recovery time objective / recovery point objective: [ ]
4. Activation criteria / authority / contacts: [ ]
5. Trusted backups + integrity verification: [ ]
6. Recovery sequence / dependencies / accountable owners: [ ]
7. Alternate services + public safety continuity: [ ]
8. Security validation / acceptance / rollback criteria: [ ]
9. Reconstitution + stakeholder communications: [ ]
10. Exercise results / corrective actions / review date: [ ]

Enterprise Incident Response Plan (IRP) Template

NIST SP 800-61r2 lifecycle reference, as requested. Revision 2 is superseded by revision 3; use current guidance for operational adoption.

ENTERPRISE INCIDENT RESPONSE PLAN
Reference: NIST SP 800-61r2 (superseded by r3)
Status: Local exercise starter; tailor before use

1. Scope / authority / incident commander: [ ]
2. Preparation: contacts, tooling, exercises, evidence handling [ ]
3. Detection + analysis: severity, timeline, scope, confidence [ ]
4. Containment: boundaries, service impact, executive approval [ ]
5. Eradication: root cause, persistence removal, validation [ ]
6. Recovery: trusted restore, monitoring, acceptance criteria [ ]
7. Legal: applicable clocks, counsel, notification records [ ]
8. Communications: audiences, approvers, update cadence [ ]
9. Post-incident: lessons, action owners, due dates [ ]
10. Plan approval / next review / exercise date: [ ]

Hotwash & After-Action Review (AAR) Matrix

Bring both tracks into one review. Separate observations from assumptions and track each corrective action to closure.

HOTWASH / AFTER-ACTION REVIEW
Status: Local exercise starter

Exercise / date / facilitator: [ ]
Participants / tracks / scope: [ ]
Objective / expected outcome: [ ]

Observation | Evidence / timestamp | Impact | Root cause
[ ]         | [ ]                  | [ ]    | [ ]

Corrective action | Owner | Due date | Priority | Closure evidence
[ ]               | [ ]   | [ ]      | [ ]      | [ ]

What worked / preserve: [ ]
Technical-to-executive handoff gaps: [ ]
Notification / communications lessons: [ ]
Service continuity / recovery lessons: [ ]
Follow-up review / acceptance owner: [ ]