Skip to content
ERM&CK (Enterprise Response Model & Common Knowledge)
Unimplemented response playbook
Initializing search
GitHub
ERM&CK (Enterprise Response Model & Common Knowledge)
GitHub
Home
Infrastructure Profile
Usecases
Usecases
[Usecases List]
Adding shadow credential
Domain user enumeration attack using the Kerberos protocol without a domain account
Dumping and Cracking mscash
Forcing WDigest to store credentials in plaintext
Forcing load a malicious DLL via COM Abuse
Hijacking Default File Extension
Lateral movement via Service Configuration Manager
Pass the certificate
Privilege escalation via named pipe impersonation
Successfull OWA Password Spraying attack
Theft of user certificate and private key via CryptoAPI
WinRM or Powershell Remoting for Lateral Movement
Windows Logon Helper Persistense
Response Playbooks
Response Playbooks
[Playbooks List]
[Sub-Playbooks List]
Adding shadow credential
Compromised active directory account
Domain user enumarate attack using the Kerberos protocol without a domain account
Dumping mscash
External Phishing Email Message
Hijack default file extension
Lateral Movement using WinRM or Powershell Remoting
Lateral movement using SCM
Load malicious Dll load via COM abuse
Malware Outbrake
Pass the certificate
Persistense using Windows Logon Helper
Privilege escalation via named pipe impersonation
Successfull OWA Password Spraying attack
Theft of user certificate and private key
Wdigest credential access
Windows host compromise
Response Actions
Response Actions
[Stages List]
Preparation
Preparation
Practice
Take Trainings
Raise Personnel Awareness
Make Personnel Report Suspicious Activity
Set Up Relevant Data Collection
Set Up A Centralized Long
Develop Communication Map
Make Sure There Are Backups
Get Network Architecture Map
Get Access Control Matrix
Develop Assets Knowledge Base
Check Analysis Toolset
Access Vulnerability Management System Logs
Connect With Trusted Communities
Define Teams and Roles
Define Escalation Path
Prepare Golden Images
Deploy Edr Solution
Check Monitoring Toolset
Prepare Acquisition Profiles
Prepare Golden Image Comparsion Tool
Access External Network Flow Logs
Access Internal Network Flow Logs
Access Internal Http Logs
Access External Http Logs
Access Internal Dns Logs
Access External Dns Logs
Access Vpn Logs
Access Dhcp Logs
Access Internal Packet Capture Data
Access External Packet Capture Data
Get Ability To Block External Ip Address
Get Ability To Block Internal Ip Address
Get Ability To Block External Domain
Get Ability To Block Internal Domain
Get Ability To Block External Url
Get Ability To Block Internal Url
Get Ability To Block Port External Communication
Get Ability To Block Port Internal Communication
Get Ability To Block User External Communication
Get Ability To Block User Internal Communication
Get Ability To Find Data Transferred By Content Pattern
Get Ability To Block Data Transferring By Content Pattern
Get Ability To List Data Transferred
Get Ability To Collect Transferred Data
Get Ability To Identify Transferred Data
Find Data Transferred By Content Pattern
Get Ability To Analyse User
Get Ability To List Firewall Rules
Make Sure All Hosts Get Setting On Same Ntp
Prepare Network Activity Profiles
Get Ability To List Users Opened Email Message
Get Ability To List Email Message Receivers
Get Ability To Block Email Domain
Get Ability To Block Email Sender
Get Ability To Delete Email Message
Get Ability To Quarantine Email Message
Get Ability To Collect Email Message
Get Ability To Analyse Email Address
Get Ability To List Files Created
Get Ability To List Files Modified
Get Ability To List Files Deleted
Get Ability To List Files Downloaded
Get Ability To List Files With Tampered Timestamps
Get Ability To Find File By Path
Get Ability To Find File By Metadata
Get Ability To Find File By Hash
Get Ability To Find File By Format
Get Ability To Find File By Content Pattern
Get Ability To Collect File
Get Ability To Quarantine File By Path
Get Ability To Quarantine File By Hash
Get Ability To Quarantine File By Format
Get Ability To Quarantine File By Content Pattern
Get Ability To Remove File
Get Ability To Analyse File Hash
Get Ability To Analyse Windows Pe
Get Ability To Analyse Macos Macho
Get Ability To Analyse Unix Elf
Get Ability To Analyse Ms Office File
Get Ability To Analyse Pdf File
Get Ability To Analyse Script
Get Ability To Analyse Jar
Get Ability To Analyse Filename
Get Ability To List Processes Executed
Get Ability To Find Process By Executable Path
Get Ability To Find Process By Executable Metadata
Get Ability To Find Process By Executable Hash
Get Ability To Find Process By Executable Format
Get Ability To Find Process By Executable Content Pattern
Get Ability To Block Process By Executable Path
Get Ability To Block Process By Executable Metadata
Get Ability To Block Process By Executable Hash
Get Ability To Block Process By Executable Format
Get Ability To Block Process By Executable Content Pattern
Prepare Process Activity Profiles
Manage Remote Computer Management System Policies
Get Ability To List Registry Keys Modified
Get Ability To List Registry Keys Deleted
Get Ability To List Registry Keys Accessed
Get Ability To List Registry Keys Created
Get Ability To List Services Created
Get Ability To List Services Modified
Get Ability To List Services Deleted
Get Ability To Remove Registry Key
Get Ability To Remove Service
Get Ability To Analyse Registry Key
Manage Identity Management System
Get Ability To Lock User Account
Get Ability To Lock User Account
💡 Get Ability To Lock User Account
⮩ Preparing to block user account via Powershell
Get Ability To List Users Authenticated
Get Ability To Revoke Authentication Credentials
Get Ability To Remove User Account
Get Ability To List User Accounts
Identification
Identification
List Victims Of Security Alert
List Host Vulnerabilities
Put Compromised Accounts On Monitoring
Make A Volatile Memory Capture
Conduct Memory Analysis
Build Super Timeline
Prepare Iocs List
Scan With Iocs And Rules
List Hosts Communicated With Internal Domain
List Hosts Communicated With Internal Ip
List Hosts Communicated With Internal Url
Analyse Domain Name
Analyse Ip
Analyse Uri
List Hosts Communicated By Port
List Hosts Connected To Vpn
List Hosts Connected To Intranet
List Data Transferred
Collect Transferred Data
Identify Transferred Data
List Hosts Communicated With External Domain
List Hosts Communicated With External Ip
List Hosts Communicated With External Url
Find Data Transferred By Content Pattern
Analyse User
List Firewall Rules
Identify impacted services
Identify userful security systems
List Users Opened Email Message
Collect Email Message
List Email Message Receivers
Make Sure Email Message Is Phishing
Extract Observables From Email Message
Analyse Email Address
List Files Created
List Files Modified
List Files Deleted
List Files Downloaded
List Files With Tampered Timestamps
Find File By Path
Find File By Metadata
Find File By Hash
Find File By Format
Find File By Content Pattern
Collect File
Collect File
💡 Collect File
⮩ Collect file via SOLDR
Analyse File Hash
Analyse Windows Pe
Analyse Windows Pe
💡 Analyse Windows Pe
⮩ Perform malware analysis via SOLDR
Analyse Macos Macho
Analyse Unix Elf
Analyse Ms Office File
Analyse Pdf File
Analyse Script
Analyse Jar
Analyse Filename
List Processes Executed
Find Process By Executable Path
Find Process By Executable Metadata
Find Process By Executable Hash
Find Process By Executable Format
Find Process By Executable Content Pattern
List Registry Keys Modified
List Registry Keys Deleted
List Registry Keys Accessed
List Registry Keys Created
List Registry Keys Created
💡 List Registry Keys Created
⮩ Listing registry keys with Powershell
List Services Created
List Services Modified
List Services Deleted
Analyse Registry Key
List Users Authenticated
List User Accounts
Find successfully enumerated users
Find Compromised User
Find Compromised User
💡 Find Compromised User
⮩ Find account with shadow credential via Powershell
Examine Content
Containment
Containment
Patch Vulnerability
Block External Ip Address
Block Internal Ip Address
Block External Domain
Block Internal Domain
Block External Url
Block Internal Url
Block Port External Communication
Block Port Internal Communication
Block User External Communication
Block User Internal Communication
Block Data Transferring By Content Pattern
Isolate Asset
Inspect Network Shares
Block Domain On Email
Block Sender On Email
Quarantine Email Message
Quarantine File By Format
Quarantine File By Hash
Quarantine File By Path
Quarantine File By Path
💡 Quarantine File By Path
⮩ Perform quarantine file via SOLDR
Quarantine File By Content Pattern
Block Process By Executable Path
Block Process By Executable Path
💡 Block Process By Executable Path
⮩ Terminate process via SOLDR
Block Process By Executable Metadata
Block Process By Executable Hash
Block Process By Executable Format
Block Process By Executable Content Pattern
Disable System Service
Lock User Account
Lock User Account
💡 Lock User Account
⮩ Powershell disable AD user
Block User Account
Block User Account
💡 Block User Account
⮩ Block domain user account via Powershell
Eradication
Eradication
Report Incident To External Companies
Apply Prevention Mode For Iocs
Remove Rogue Network Device
Delete Email Message
Remove File
Remove File
💡 Remove File
⮩ Deleting a file from Windows with Powershell
⮩ Deleting a file from Windows via SOLDR
Remove Registry Key
Remove Registry Key
💡 Remove Registry Key
⮩ Remove Windows registry key with Powershell
Remove Service
Remove Persistence Mechanisms
Revoke Authentication Credentials
Remove User Account
Reset Authentication Credentials
Delete Attribute From Object
Delete Attribute From Object
💡 Delete Attribute From Object
⮩ Powershell clear attribute from AD object
Revoke Certificate
Recovery
Recovery
Reinstall Host From Golden Image
Restore Data From Backup
Unblock Blocked Ip
Unblock Blocked Domain
Unblock Blocked Url
Unblock Blocked Port
Unblock Blocked User
Unblock Blocked User
💡 Unblock Blocked User
⮩ Unblock domain account via powershell
Unblock Domain On Email
Unblock Sender On Email
Restore Quarantined Email Message
Restore Quarantined File
Restore Modified File
Unblock Blocked Process
Enable Disabled Service
Unlock Locked User Account
Unlock Locked User Account
💡 Unlock Locked User Account
⮩ Powershell enable AD user
Reissue Revoked Certificate
Lessons Learned
Lessons Learned
Develop Incident Report
Conduct Lessons Learned Exercise
Update Acquisition Profiles
Update Network Profiles
Update Process Profiles
Software
Software
[Software List]
Apache Tomcat Server
Bitrix Server
Checkpoint Firewall
Cisco ASA Firewall
Citrix Server
Gitlab Server
Linux
MS DNS Server
MS Exchange Server
MS Server 2019 with Active Directory role
MS Sharepoint Server
MySQL Server
Postfix Server
PostgreSQL Server
SOLDR
Skype for Business Server
Weblogic Server
Windows Host
Windows PowerShell
Zabbix Server
Artifacts
Artifacts
[Artifacts List]
Access Token
Access right
Active Directory Account
Authentication service
Certificate
Certificate authority
Credential
DNS Network Traffic
Directory Service object attribute
Email Message
Encrypted Credential
Executable Binary
Executable Script
File
Host
IP Address
Kerberos Ticket Granting Tickets
Linux Local Account
Local Windows Account
Log
Login Session
OWA Web Token
Object File
Operating System Executable File
Password
Password file
Pipe
Private key
Privileged User Account
Process
Process Image
RPC Network Traffic
Remote Procedure Call
Remote Session
Remote Session
Service Application
The Component Object Model
URL
Windows Registry
Unimplemented response playbook
Sorry, this response playbook is not implemented yet!
Back to top