topic
Response Playbook
2 posts
-
T1218.005 - msxsl / typeperf Execution Response Playbook
Incident response playbook for containing and eradicating LOLBin abuse via msxsl.exe and typeperf.exe, including containment, credential reset, and post-incident detection steps.
-
T1068 - Vulnerable Driver Write Response Playbook
Incident response playbook for handling BYOVD alerts involving vulnerable kernel drivers like gdrv.sys, covering identification, containment, remediation, and recovery.