RP0001: External Phishing Email Message

Summary

ID	RP0001
Brief Description	Response playbook for external Phishing Email Message case
Author	@atc_project
Creation Date	2019/01/31
Modification Date	2019/01/31
ATT&CK Tactics	TA0001: Initial Access
ATT&CK Techniques	T1566.001: Spearphishing Attachment T1566.002: Spearphishing Link
Tags	Phishing
Linked Response Playbooks	Domain user enumarate attack using the Kerberos protocol without a domain account

Execute Response Actions step by step. Some of them directly connected, which means you will not be able to move forward not finishing the previous step. Some of them are redundant, as those that are related to the blocking a threat using network filtering systems (containment stage)
Start executing containment and eradication stages concurrently with next identification steps, as soon as you will receive information about malicious hosts
If phishing led to code execution or remote access to victim host, immediately start executing Generic Post Exploitation Incident Response Playbook
Save all timestamps of implemented actions in Incident Report draft on the fly, it will save a lot of time