Incident Response: SOC workflow & IR lifecycle

Incident Response is the structured process organizations follow to detect, analyze, contain, eradicate, and recover from security incidents. The IR lifecycle, formalized by NIST SP 800-61, defines six phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. The SOC workflow driving this lifecycle relies on playbooks that map alert types to precise response actions. Each phase demands specific technical skills. Preparation means deploying log sources, SIEM rules, and EDR agents before any breach occurs. Detection requires correlating events across endpoints, network flows, and identity logs to confirm a true positive. Analysis means reconstructing attacker timelines using forensic artifacts such as prefetch files, Windows event logs, MFT records, and memory dumps. The SOC workflow must distinguish between an isolated workstation compromise and a lateral-movement campaign touching domain controllers. IR is relevant not only in enterprise environments but also in cloud and hybrid infrastructures, where ephemeral assets complicate evidence preservation. Every analyst working IR must understand scope creep: failing to identify all compromised systems before containment leads to reinfection cycles. A documented IR lifecycle reduces mean time to respond and limits dwell time, which directly constrains attacker impact.

Concrete detection during Incident Response starts with reliable log ingestion. On Windows systems, Event ID 4624 and 4625 track logon successes and failures. Event ID 4688 records process creation when command-line auditing is enabled. Event ID 7045 signals new service installation, a common persistence mechanism. SIEM platforms such as Splunk or Microsoft Sentinel correlate these events using sigma rules, mapping behavior to MITRE ATT&CK techniques. Network detection relies on flow data (NetFlow, Zeek logs) to spot beaconing patterns, unusual outbound connections, and lateral movement via SMB or WMI. EDR tools like CrowdStrike Falcon or SentinelOne generate telemetry covering process trees, file writes, and registry modifications under HKLM/Software/Microsoft/Windows/CurrentVersion/Run. Indicators of Compromise (IOCs) including malicious hashes, domain names, and IP addresses are ingested into threat intelligence platforms such as MISP or OpenCTI to automate detection across the environment. Memory forensics using Volatility helps identify injected code, rogue processes, or credential dumping artifacts that disk-based tools miss entirely. Alert triage must prioritize high-fidelity detections to avoid analyst fatigue. SOC teams should maintain asset criticality matrices so that an alert on a domain controller escalates faster than the same alert on a standard workstation. Proper detection hygiene directly determines how fast containment begins.

From a Red Team and pentest perspective, understanding IR workflows allows adversaries to time and shape their activity to delay detection. Common techniques include timestomping to alter NTFS metadata, clearing Windows event logs via 'wevtutil cl', and using living-off-the-land binaries (LOLBins) like certutil or mshta to evade signature-based detection. Attackers may also leverage encrypted C2 channels over HTTPS or DNS tunneling to blend with legitimate traffic and avoid network-based IOC matching. On the Blue Team side, effective countermeasures begin at the containment phase. Network segmentation using firewall ACLs or EDR-driven host isolation cuts attacker access without requiring full system shutdown. Forensic imaging of compromised hosts using tools like FTK Imager or dc3dd preserves volatile evidence before remediation. Eradication requires removing all persistence mechanisms: scheduled tasks (schtasks), registry run keys under HKLM/Software/Microsoft/Windows/CurrentVersion/Run, WMI subscriptions, and malicious services. Recovery must include credential rotation for all accounts active during the incident window, particularly service accounts and privileged identities. Post-incident reviews should produce updated detection rules, revised playbooks, and gap analyses mapped to ATT&CK. Tabletop exercises and Cyber Range simulations allow SOC teams to rehearse IR workflows under realistic conditions, building muscle memory that reduces decision latency during real incidents.