MIMIR // SecOps & DFIR Knowledge Base

🚨 Incident Runbooks

Tactical, step-by-step containment procedures and triage scripts for active threat scenarios:

⏱️ First 60 Mins Cloud IRPhase-by-phase emergency checklist: bleed-stopping, ephemeral log dumps, blast-radius scoping.🎣 Phishing Triage & Tenant PurgeSPF/DKIM/DMARC analysis, blast-radius scoping query, compliance search hard-delete.🦠 Malware & InfostealersHost isolation, process tree termination, dropped payload eradication, cookie dump scoping.📡 Active C2 Beacon HuntingJitter ratio calculation, hollowed process attribution, volatile memory config extraction.🍪 Stolen Tokens & Session HijackingTenant-wide session invalidation, PRT device quarantine, rogue OAuth consent purge.👑 Entra ID Global Admin CompromiseTenant-wide session purge, PIM audit, Conditional Access validation, and service principal backdoors.🔌 Rogue RMM (AnyDesk / ScreenConnect)Abused administrative RMM identification, log carving, and C2 sinkholing.

---

⚡ Core SecOps Pillars

⚡ KQL & Threat Hunting

Ready-to-deploy hunting queries for Defender XDR and Microsoft Sentinel across Windows and macOS endpoints. Unmask LOLBins, memory injections, and token replay.

👉 Explore KQL Hunting Queries

💻 PowerShell Ops & Triage

Battle-tested automation scripts for live response, non-destructive artifact acquisition, .evtx log filtering, and Entra ID / Intune compliance audits.

👉 Review PowerShell Triage

🔍 DFIR Forensic Artifacts

Deep-dive field matrix of Windows forensic evidence: MFT, Amcache, Shimcache, Prefetch, SRUM, and Shellbags. Execution vs. knowledge proof guides.

👉 Inspect Artifact Matrix

🛡️ SecOps Playbooks

Standard operating procedures and containment workflows for Business Email Compromise (BEC), Ransomware containment, and Cloud Lateral Movement.

👉 Access SecOps Playbooks

---

🚨 Incident Response Quick-Jump Matrix

Emergency Scenario	Primary Playbook / Runbook	Essential Tool / Query	Target Speed
Initial Cloud Breach	First 60 Mins Cloud IR	Live Response & Ephemeral UAL dump	< 60 mins
Phishing Campaign	Phishing Triage & Purge	EmailEvents blast-radius & purge script	< 15 mins
Active Malware / Infostealer	Endpoint Malware Containment	MDE Host isolation & process tree kill	< 15 mins
Suspected C2 Beacon	C2 Beacon Hunting	Jitter calculation & firewall egress drop	< 20 mins
Stolen Session Cookie	Stolen Token Remediation	Revoke-MgUserSignInSession & PRT reset	< 10 mins
Global Admin / Break-Glass Breach	Entra ID Admin Compromise	PIM audit, session revocation & CA check	< 30 mins
Verified Upstream Sources	Gold-Standard Repositories	Microsoft MSTIC, SigmaHQ, Zimmerman SANS	Reference