Blue Team Handbook Incident Response (Don Murdoch)（Z-Library）

# Blue Team Handbook: Incident Response — Reading Guide ## 【One-Line Pitch】 A field-ready operational manual for SOC analysts, incident responders, and defensive security professionals who need practical, actionable guidance on detecting, containing, and eradicating cyber threats — from recognizing indicators of compromise to conducting forensic analysis on Windows and Linux systems. ## 【Book Arc】 - **Opening (~0%–9%)**: Establishes the book's purpose as a practical field guide for incident response, introduces the NIST IR lifecycle framework, and sets expectations for hands-on, immediately applicable content. - **Early (~9%–25%)**: Covers threat-informed defense using MITRE ATT&CK, prioritizes top telemetry data sources (command execution, process creation, file modification), and introduces the six-phase PICERL model (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned). - **Early (~25%–34%)**: Deep-dives into Preparation phase specifics — knowing your network, managing identities, DNS logging strategies, NSM deployment with Zeek, TLS break-and-inspect, and application-layer visibility. - **Middle (~34%–47%)**: Walks through Containment and Eradication checklists — stopping adversaries without destroying volatile evidence, credential resets (including KRBTGT), countermeasure implementation, and incident-driven hardening. - **Middle (~47%–end of excerpts)**: Focuses on analyst skills — formulating investigative questions, the Alexiou Principle's four questions, recognizing indicators of attack (unusual outbound traffic, privileged account anomalies, geographically improbable travel), and Windows event ID analysis. ## 【Key Takeaways】 - **Threat-informed defense is the foundation** (Early): Align detection capabilities with MITRE ATT&CK techniques using tools like DeTT&CT to quantify which techniques your data sources actually support — this enables proactive hunting rather than reactive alerting. - **Top data sources matter more than tool count** (Early): Command execution (255 techniques), process creation (206), and file modification (98) are the highest-value telemetry sources — prioritize Windows 4688 events, Sysmon, EDR, and auditd before investing elsewhere. - **Preparation means knowing identity, not just network** (Early): Maintain a federated identity meta-directory, enforce "one user, one account," audit SaaS/cloud accounts for local elevated credentials, and require MFA with step-up authentication and risk engines. - **DNS logging is a hunting goldmine** (Early): Configure logging to capture client source, query, and answers as a single record (Zeek does this well), and deploy RPZ-based DNS filtering as an application-aware firewall layer. - **Containment requires evidence preservation** (Middle): Pull the plug sacrifices volatile data — collect memory images or filesystem triage images first, then perform targeted shutdowns; cloud systems can be isolated by changing security groups. - **Credential resets are ecosystem-wide operations** (Middle): Beyond passwords, reset tokens, VPN sessions, and Entra ID access tokens; change KRBTGT password twice (two history entries) with awareness of the 10-hour default ticket lifetime. - **The Alexiou Principle structures investigations** (Middle): Every investigation should answer four questions — what happened, why, what's the impact, and how to prevent recurrence — forming the basis for lines of inquiry and root cause analysis. - **Indicators of attack follow behavioral patterns** (Middle): Watch for privileged account anomalies, geographically improbable travel (multiple ISPs/ASNs within 12 hours suggests commodity VPN use), and baseline changes in RDBMS or web browsing activity. ## 【Reading Tips】 - **Skim the early chapters** (~0%–9%) if you already know NIST lifecycle basics — the real value starts with the ATT&CK alignment and data source prioritization. - **Deep-read the Preparation phase** (~25%–34%) — the DNS logging, NSM deployment, and TLS break-and-inspect sections contain concrete architecture decisions you can implement directly. - **Use the checklists as reference tools** — the Containment and Eradication tables (around 34%–44%) are designed for field use during active incidents; bookmark them for quick access. - **Pay special attention to Windows Event IDs** (around 47%) — 4625, 4771, and 4772 are critical for login failure analysis; consider creating a quick-reference card. - **The excerpts don't cover later chapters** on enterprise detection capabilities, hyperautomation, or the appendices (TCP/UDP ports, ICMP types, headers) — plan to read those sections separately if you need that depth. ## 【Coverage Limits】 This guide synthesizes excerpts covering approximately the first half of the book (through ~47%). Later content on enterprise detection response capabilities, hyperautomation, and reference appendices is not covered here. ##