Applied Incident Response

CHAPTER 3Remote Triage

An incident may begin with the detection of an anomaly on a single system, but the scope of the incident is likely to be much larger. Understanding the scope of the incident, including the number of systems currently impacted and the number of systems vulnerable to the tools and techniques of the adversary, is an important step in any incident response. Given the size and scale of modern network environments, frequently involving on‐site, off‐site, and cloud‐based resources, remote triage is a critical skill for any incident responder to develop.

Many vendors sell products to help make this process more efficient and to minimize the impact on the network environment during the triage process. Having access to commercial enterprise incident response, endpoint detection and response, or similar categories of products can significantly aid in many phases of the incident response process, including identifying the scope of the incident. However, these products are frequently expensive and not always available in the environment where the incident occurs. Installing such a solution after an incident is detected might delay the response process, overwrite potential evidence on remote systems, and potentially alert the adversary to the fact that their activity has been detected.

Just as modern adversaries will attempt to live off the land, this chapter will focus on using tools that are commonly found within enterprise networks and using those tools to perform ...