Skip to content
MIMIR

RUNBOOK // First 60 Minutes Cloud Incident Checklist

EMERGENCY CHECKLIST TRIAGE & CONTAINMENT Target Execution Window: 0 - 60 minutes

The first 60 minutes of a cloud security incident dictate whether the breach remains contained to a single identity/device or cascades across the entire Microsoft 365 tenant. Follow this sequential operational checklist.

⏱️ Cloud Evidence Shelf-Life & Retention Constraints

Section titled “⏱️ Cloud Evidence Shelf-Life & Retention Constraints”

Before making invasive administrative changes, understand what logs expire if not preserved immediately:

Telemetry SourceNative Retention WindowRetention Extension Mechanism
Microsoft Defender for Endpoint (MDE)30 DaysStream to Azure Event Hub / Sentinel
Microsoft Entra ID Sign-in Logs30 Days (P1/P2)Diagnostic Settings export to Log Analytics
Unified Audit Log (Standard E3/Business)180 DaysAdvanced Audit (1-year / 10-year add-on)
Volatile RAM (Endpoints)Until reboot or sleepMDE Live Response live capture script
Defender for Cloud Apps (MDCA)90 DaysSentinel data connector ingestion

📋 Phase 1: 0 - 15 Minutes // Immediate Bleed-Stopping

Section titled “📋 Phase 1: 0 - 15 Minutes // Immediate Bleed-Stopping”

The priority is severing adversary control without destroying forensic evidence:

  • Revoke User Cloud Sessions:
    Terminal window
    Revoke-MgUserSignInSession -UserId "compromised.user@company.com"
  • Isolate Compromised Endpoints (MDE):
    • Locate device in Defender Portal $\rightarrow$ Isolate device (Full Isolation).
    • Do NOT reboot or shut down the machine (preserves volatile memory and unbacked code injection).
  • Quarantine User Risk:
    • In Entra ID, reset password and set user risk state to Confirmed Compromised to trigger Conditional Access block policies.
  • Check PIM Elevations:
    • Confirm whether the compromised identity has active or eligible privileged roles in Privileged Identity Management (PIM).

📋 Phase 2: 15 - 30 Minutes // Ephemeral Evidence Preservation

Section titled “📋 Phase 2: 15 - 30 Minutes // Ephemeral Evidence Preservation”

Capture volatile data before tokens expire or logs roll over:

  • Collect MDE Forensic Package:
    • Device page in Defender Portal $\rightarrow$ … $\rightarrow$ Collect investigation package.
  • Initiate Memory Acquisition (if active malware/C2):
    • Connect via MDE Live Response and execute procdump against suspicious parent processes.
  • Export Sign-in Logs (Last 48 Hours):
    • Export interactive and non-interactive sign-in logs with IP, user agent, and correlation IDs to CSV.
  • Snapshot Exchange Mailbox Rules:
    Terminal window
    Get-InboxRule -Mailbox "compromised.user@company.com" | Export-Clixml "C:\Forensics\InboxRules_PreContainment.xml"

📋 Phase 3: 30 - 45 Minutes // Blast Radius Scoping

Section titled “📋 Phase 3: 30 - 45 Minutes // Blast Radius Scoping”

Map how far the adversary moved laterally across the tenant:

  • Audit New OAuth Consents & Apps:
    • Query Entra ID audit logs for any Consent to application or Add service principal credentials in the last 72 hours.
  • Check Mail Forwarding & Exfiltration:
    • Run Get-Mailbox -Identity "compromised.user@company.com" | Select ForwardingSmtpAddress, DeliverToMailboxAndForward.
  • Check SharePoint / OneDrive Mass Downloads:
    • Query OfficeActivity | where UserId =~ "compromised.user@company.com" and Operation == "FileDownloaded".
  • Check Intune Script Deployments:
    • Verify if any new PowerShell or shell scripts were created in Intune during the incident window.

📋 Phase 4: 45 - 60 Minutes // Command Briefing & Next Actions

Section titled “📋 Phase 4: 45 - 60 Minutes // Command Briefing & Next Actions”

Synthesize findings into an executive incident briefing:

  • Status Briefing Matrix:
    • Root Cause Vector: (e.g., AiTM phishing, stolen token, rogue RMM)
    • Identities Impacted: (List of UPNs and role tier)
    • Devices Contained: (Hostnames and MDE isolation state)
    • Evidence Preserved: (Location of UAL export and memory dumps)
  • Determine Notification Requirements:
    • Assess if regulated customer data, PII, or credentials were confirmed accessed via MailItemsAccessed or FileDownloaded.
  • Transition to Deep Forensics: