FIRST RESPONDER PROTOCOL

STANDARD OPERATING PROCEDURE: PRE-ARRIVAL TRIAGE & FORENSIC EVIDENCE PRESERVATION

PROTOCOL // CIRT-SOP-001TLP:CLEAR // FIELD DOSSIER

MANDATORY DIRECTIVE // ZERO HOUR

First Responder Protocol

STOP. Take a breath. Step away from the keyboard for 60 seconds.

In the early hours of an incident, the urge to immediately "fix" systems and delete malware is strong. Hasty remediation routinely destroys critical forensic evidence, tips off the attackers, and can trigger them to detonate ransomware early.

If you suspect an active breach, follow this triage protocol to stabilize your environment and preserve evidence while coordinating incident response.

NON-TECHNICAL QUICK START

Not Technical? Start Here

If you suspect something is wrong with your computer, take a breath. You don't need to be a cybersecurity specialist to prevent further problems.

1. Disconnect from the network: Unplug the network cable (Ethernet) from the computer, or disconnect from Wi-Fi. Leave the computer powered on and running.

2. Contact your internal IT team first: If your company has internal IT staff or an MSP, alert them immediately so they can begin investigation. If you do not have internal IT, contact us directly.

3. Use a separate device: Make all phone calls or send emails from your personal cell phone rather than your work computer or work email account.

LEGAL DISCLAIMER & LIABILITY NOTICE

OPERATIONAL DISCLAIMER: This protocol provides general emergency triage guidance and does not substitute for an organization-specific Incident Response Plan (IRP) or formal legal counsel directives. Technical actions—such as forcing system shutdowns, pulling power, or severing network routes—carry inherent risks of data corruption, storage pool degradation, or operational downtime. Any individual or organization applying these steps is solely responsible for fully understanding their own environment and assumes all operational and technical risks. VesperDryft Solutions, LLC disclaims all liability for any data loss, hardware damage, or operational disruption resulting from following these guidelines.

Doc Ref: CIRT-SOP-001 • Version 1.2 • Last Reviewed: 2026-10-15

PHASE 01 // MINUTES 0-15 // COMMS & LEGAL

Zero-Hour Triage & Chain of Custody

What you do in the first 15 minutes decides whether this stays a manageable incident or becomes an uninsurable disaster. Complete these steps before touching production systems.

MANDATORY PROTOCOL

1. Move Out-of-Band (OOB) Immediately

Assume corporate email, Microsoft Teams, Slack channels, and internal VoIP phone systems are compromised and actively monitored by the adversary.

Adversary Monitoring Rationale: Modern threat actors actively monitor enterprise communication platforms and deploy mailbox keyword filters (e.g., searching for "breach", "incident", "investigation", "forensics", "counsel"). Alerting human adversaries that they have been discovered triggers rapid operational escalation: attackers routinely deploy destructive wipers, execute premature domain-wide ransomware encryption, or dump mass exfiltration staging archives before defenders can coordinate isolation.

Action: Switch all incident communication to personal cellular phones or an air-gapped, external communication tenant.
Prohibition: Never transmit emails or helpdesk tickets with subject lines like "Breach", "Incident Response", or "Compromised" across enterprise networks.

LEGAL SAFEGUARD

2. Notify Cyber Insurance & External Breach Counsel

Engage your cyber insurance carrier and external breach counsel before signing independent vendor retainers or modifying infrastructure.

Attorney-Client Privilege: When breach counsel formally retains an external DFIR firm on your behalf under a separate agreement, forensic work product, root cause analyses, and technical reports can be protected under attorney-client privilege and the work-product doctrine. Courts have rejected privilege when engagements were structured poorly, so confirm the arrangement with your counsel before work begins.
Insurer Panel Compliance: Insurance carriers enforce pre-approved vendor panels. Failing to notify carriers early risks forfeiture of coverage for forensic services, business interruption claims, and legal defense costs.
Statutory & Regulatory Clocks (Consult Counsel): Breach notification deadlines start running upon discovery or determination of materiality. Work with legal counsel immediately to evaluate your obligations:
• SEC Form 8-K (Item 1.05): 4 business days after determining an incident is material (public companies).
• GDPR (EU/UK): 72 hours from becoming aware of a personal data breach posing risk to rights and freedoms.
• HIPAA: Without unreasonable delay and no later than 60 calendar days from discovery (immediate OCR notification if 500+ individuals).
• State Breach Laws & CIRCIA: US state deadlines range from 14 to 45 days; CISA CIRCIA requires 72-hour reporting for covered critical infrastructure entities.
Note: Statutory definitions, applicability, and exceptions must be determined by qualified legal counsel.

OPERATIONAL SAFEGUARD

3. Coordinate with Your MSP / IT Provider (Prioritize Containment)

If you partner with an outsourced IT firm or Managed Service Provider (MSP), advise them to prioritize isolation and containment over immediate cleanup or system reimaging.

Preserve Root Cause Evidence: Eagerly formatting affected machines, deleting suspicious files, or restoring backups over suspect drives destroys the attacker's timeline and binary artifacts, making root-cause determination and blast-radius mapping significantly harder or impossible.
Align on Strategy: Request that IT providers focus on network isolation and log preservation while coordinating forensic acquisition with your CIRT or DFIR team.

AUDIT TRAIL

4. Establish an Incident Scribe Log

Appoint a scribe to record what happened and when. When investigating an endpoint, normal IT actions and troubleshooting commands often look identical to malicious activity. The scribe log helps the CIRT immediately distinguish legitimate administrative actions from threat actor behavior.

Use Real-World Time: Always record entries using current real-life time (UTC or your local time with timezone noted). Threat actors and malware frequently alter device timestamps to evade detection.
Never Change System Clocks: If you notice the time on a device is wrong, do not change or sync it. Simply document the discrepancy in the scribe log as an observation for the CIRT so forensic timelines can be calibrated accurately.
Record Actions & Observations: Note who performed the action, which system was touched, what command or step was taken, and the observed result.

TIME (UTC)	TARGET	IP	ACTOR	ACTION TAKEN	RESULT / STATUS
14:02 UTC	`DC-PROD-01`	`10.10.10.5`	J. Doe	EDR Network Quarantine	Host isolated; sockets held
14:05 UTC	`FS-CORP-02`	`10.10.20.12`	M. Smt	Pull physical power	Encryption halted; host powered off
14:08 UTC	`VE-BKUP-01`	`10.10.99.2`	A. Vnc	Disconnect storage NICs	Backups air-gapped
14:11 UTC	`WS-FIN-04`	`10.10.30.18`	A. Vnc	Observed clock drift	Device clock 14m slow; did not alter time

PHASE 02 // CONTAINMENT & PRESERVATION // CRITICAL EXCEPTIONS & BASELINE RULES

Containment Directives: Critical Exceptions & Operational Rules

Check the critical exceptions in Step 1 first. If none of their trigger conditions apply, enforce the baseline rules in Step 2.

STEP 1 // CRITICAL EXCEPTIONS & RULE INVERSIONS

Environmental Edge Cases & Tactical Rule Inversions

Every environment and attack is different. When specific triggers occur, standard baseline rules are inverted immediately:

CRITICAL EXCEPTION

Edge Case 1: Active Ransomware Detonation

Trigger Condition: Files are actively changing extensions (e.g., .locked, .enc), ransom notes are populating desktops, or continuous high-volume disk write I/O is observed across shared volumes.

Protocol Inversion: HARD POWER CUT IMMEDIATELY. Disregard volatile RAM preservation. Preserving unencrypted business data supersedes memory forensics.
Execution (Endpoints & Standalone Servers): For physical endpoints, hypervisors, and standalone file servers, pull physical AC power cords immediately. For laptops, force power-off by holding the power button for 10 seconds or removing the battery.
NAS / SAN Storage Protection (DO NOT CUT POWER FIRST): Do NOT pull power cords directly on enterprise NAS/SAN storage arrays. Sudden power loss can induce catastrophic filesystem corruption, uncommitted dirty cache loss, and RAID pool degradation. Furthermore, files on shared storage are typically encrypted via SMB/NFS mounts from compromised client endpoints, not native binaries running on the storage controller OS.
• Step 1: Immediately disconnect the client-facing data connections (Ethernet data ports and Fibre Channel / SFP+ optical uplinks) from the NAS/SAN array to sever endpoint access instantly. Leave the dedicated out-of-band management port (iDRAC / iLO / IPMI) connected.
• Step 2: Monitor the storage controller management console (IPMI/iDRAC/iLO) out-of-band to confirm disk write I/O has halted before considering any controlled controller shutdown.
BitLocker & FDE Key Recovery Risks: Forcing a hard power cut immediately returns Full-Disk Encryption volumes (BitLocker, FileVault, LUKS) to a locked state. If recovery keys are not already verified in Active Directory, Microsoft Entra ID, or offline escrows, and if central domain infrastructure becomes encrypted or unreachable, you risk permanent data lockout. Weigh the risk of unescrowed FDE lockouts before pulling power.
Mandatory Nuance: Do NOT initiate a graceful operating system shutdown (e.g., clicking "Shut Down" or issuing shutdown /s). Modern ransomware strains hook OS shutdown sequences or exploit shutdown delays to encrypt critical system files before termination.

HYPERVISOR WORKLOADS

Edge Case 2: Virtual Machines (VMware ESXi / Hyper-V / Proxmox)

Trigger Condition: The compromised workload is a guest virtual machine running on an enterprise hypervisor, or the hypervisor host itself is under attack.

Step 1: Disconnect the Virtual Network Adapter (vNIC) at the hypervisor level (vCenter / Hyper-V Manager / Proxmox interface).
Step 2: Do NOT reboot, pause, or suspend the guest operating system.
Step 3: Take an immediate hypervisor snapshot with the option "Snapshot virtual machine memory" enabled (captures .vmem / .bin). This freezes RAM and disk state to hypervisor storage without executing any software inside the compromised guest.
Domain Controller Revert Warning (USN Rollback): While taking a memory-inclusive VM snapshot for forensic acquisition is safe, never revert or restore an active Domain Controller from a hypervisor snapshot. Restoring a snapshot causes an Update Sequence Number (USN) rollback, permanently corrupting Active Directory replication across all domain controllers. If a DC is compromised, isolate it and coordinate clean rebuild or authoritative restore with the CIRT.
Exception (Ransomware Running on the Host): If many VMs are powering off at once, or .vmdk / -flat.vmdk files on the datastore are changing extensions or growing, the encryptor is running on the hypervisor itself, not inside a guest. Disconnecting vNICs will not stop it. Pull physical power on the affected host immediately (Edge Case 1 applies). If encryption has not started yet, isolate the host's management network and disable SSH / ESXi Shell from the physical console (DCUI).

CLOUD INFRASTRUCTURE

Edge Case 3: Public Cloud Workloads (AWS / Azure / GCP)

Trigger Condition: Compromised virtual instances in public cloud environments (EC2, Azure VM, Compute Engine).

DO NOT TERMINATE THE INSTANCE: Most cloud environments default to "Delete on Termination" for root and attached block storage volumes (EBS, Managed Disks, Persistent Disks). Terminating an instance permanently destroys the entire evidentiary record.
Prevent Auto-Termination: If the instance belongs to an Auto Scaling Group or Scale Set, move it to Standby (or detach it) first. Isolation causes health checks to fail, and the scaler will terminate the instance and its disks automatically.
Isolate via Security Group: Reassign the instance's Network Security Group (NSG) or Security Group to a dedicated "Forensic Quarantine" group containing 0 inbound and 0 outbound rules. Do not detach the network interface (ENI). This blocks new connections only.
Cut Established Sessions: Cloud security groups are stateful: connections that are already open (an active reverse shell or exfiltration stream) can keep running after the rules change. To sever them, add an explicit deny rule to the subnet's Network ACL (AWS), kill the offending process through SSM / Run Command, or Stop (never Terminate) the instance once memory has been captured or is no longer needed.
Volume Snapshots: Take immediate point-in-time snapshots of all attached storage volumes (EBS Snapshot, Azure Disk Snapshot, GCP Disk Snapshot).
Control Plane Export: Lock and export cloud audit logs immediately: AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs, and VPC Flow Logs.

SAAS & IDENTITY

Edge Case 4: Cloud Identity & SaaS (Microsoft 365 / Entra ID / Google Workspace)

Trigger Condition: Business Email Compromise (BEC), adversary-in-the-middle (AiTM) token theft, or compromised tenant administrator.

Password Resets Are Insufficient: Threat actors utilizing stolen session cookies bypass password authentication and MFA entirely.
Revoke All Active Sessions: Issue an immediate global session revocation via Microsoft Graph PowerShell (Revoke-MgUserSignInSession -UserId <UPN>) or the admin center ("Revoke sessions" / "Sign out of all sessions"). Access tokens already issued can remain valid for up to an hour, so pair revocation with disabling the account.
Audit MFA Registrations: Inspect and purge all registered Multi-Factor Authentication (MFA) devices on the compromised account. Adversaries routinely register secondary authenticator apps or FIDO security keys for persistent access.
Revoke Malicious Enterprise Apps: Audit third-party Enterprise Applications and OAuth permissions. Revoke any apps granted high-privilege scopes (e.g., Mail.ReadWrite, Mail.Send, Files.ReadWrite.All, Directory.ReadWrite.All).
Audit Mailbox Rules: Audit Exchange mailbox forwarding rules, transport rules, and hidden inbox filtering rules configured to divert alerts into RSS Feeds or Deleted Items.
Wire Fraud / Financial Recall (Time-Critical): If fraudulent wire transfers, altered invoices, or redirected payroll instructions were executed, immediately contact your financial institution's fraud department by phone to request an urgent wire recall and freeze the beneficiary account. Immediately file a complaint at IC3.gov (FBI Internet Crime Complaint Center) to initiate the Financial Fraud Kill Chain (FFKC). Recovery odds drop sharply after 24–72 hours.

CRITICAL EXCEPTION

Edge Case 5: Active Mass Data Exfiltration

Trigger Condition: Real-time detection of high-volume outbound network egress, active cloud synchronization tools (e.g., rclone, Megasync, AzCopy, WinSCP), or automated staging scripts transmitting archive files.

Protocol Inversion: Immediate Credential & Session Revocation. Standard containment mandates avoiding single-account resets to prevent tipping off adversaries. However, active mass exfiltration represents an imminent, irreversible loss of proprietary data that supersedes surveillance.
Execution: Instantly terminate active network egress connections at the perimeter firewall, kill exfiltration process trees, and immediately revoke credentials, Kerberos tickets, and cloud session tokens for all compromised service or user accounts executing the transfer.

EDGE APPLIANCE WORKLOADS

Edge Case 6: Edge Appliances (VPNs / Firewalls / Load Balancers)

Trigger Condition: Suspected exploitation of perimeter network appliances (e.g., Ivanti Connect Secure, Fortinet FortiGate, Palo Alto GlobalProtect, Citrix NetScaler, F5 BIG-IP).

DO NOT REBOOT OR POWER CYCLE: Edge appliances run embedded kernels with volatile filesystems in tmpfs or RAM. Active sessions, webshells, and in-memory payloads reside strictly in RAM. Rebooting or patching wipes volatile evidence.
Step 1 (Generate Diagnostic & Core Dumps): Before severing connections, generate full diagnostic bundles (e.g., show tech-support, memory core dumps, and session tables) and export them directly to an external, offline store.
Step 2 (Isolate at Connected Switch Ports): Sever appliance connectivity by disabling upstream and downstream physical switch ports. Do not rely on internal appliance software ACLs, as an attacker with root privileges can subvert on-device rules.
Step 3 (Run External Integrity Tools): Do not trust built-in self-checks, which adversaries frequently tamper with. Run vendor-provided external integrity checker tools (e.g., Ivanti External ICT) via out-of-band console access.
Step 4 (Rotate Directory & Service Credentials): Immediately rotate all directory service accounts used by the appliance (Active Directory LDAP bind accounts, RADIUS secrets, Kerberos keytabs, and VPN certificates).
Step 5 (Rebuild from Clean Media — Do Not Patch in Place): In accordance with CISA guidance, never simply apply a patch to an exploited appliance. Once forensic evidence is captured, perform a full factory reset and rebuild the system from verified, clean vendor firmware before restoring audited configurations.

STEP 2 // GENERAL OPERATIONAL RULES & BASELINE MATRIX

Baseline Operational Directives & Forensic Rationale

When no critical hard-cut exception applies, enforce these baseline containment directives. Standard IT troubleshooting instincts (rebooting, running antivirus scans, resetting passwords piecemeal) actively assist the attacker. Follow these rules instead:

PROHIBITED ACTION	MANDATORY ALTERNATIVE	FORENSIC RATIONALE
DO NOT REBOOT OR POWER OFFNever reboot, cycle power, or shut down suspected machines.	ISOLATE AT NETWORK LAYERPull the physical Ethernet cable, disable Wi-Fi, or execute an EDR network quarantine. If isolating via EDR, independently verify at the switch port or firewall that traffic has ceased. Keep power connected.	Volatile memory (RAM) contains running processes, injected DLLs, unencrypted C2 configurations (Cobalt Strike, Sliver), active sockets, encryption keys, and cached credentials. Rebooting purges this evidence permanently. Verify Isolation Independently: Attackers can tamper with or blind EDR sensors to report a false "isolated" status in the console while keeping C2 channels open. Whenever possible, confirm isolation at the physical switch port (disable the port or move to an isolated remediation VLAN) or verify zero egress at the firewall. FDE / BitLocker Preservation: Keeping the system running maintains the unlocked state of encrypted volumes. Master keys reside in RAM and BitLocker recovery keys can still be retrieved (e.g., `manage-bde -protectors -get C:`). Powering off relocks the disk; if keys are not escrowed, forensic access is permanently lost.
DO NOT LOG IN WITH DOMAIN ADMINNever log into suspected hosts using Domain Admin, Enterprise Admin, or shared credentials via RDP, SSH, or PowerShell.	USE UNIQUE LOCAL BREAK-GLASSAccess systems only via physical console or a dedicated local administrator account with a password unique to that host.	Interactive logons write credentials and Kerberos tickets (TGT) into LSASS process memory. If the adversary has deployed Mimikatz, ProcDump, or Nanodump on that box, you surrender enterprise-wide credentials.
DO NOT RUN AV SCANS OR DISK REPAIRSNever execute full-disk antivirus scans, `chkdsk`, `sfc /scannow`, or disk defragmentation.	LEAVE MALWARE IN SITULeave malicious binaries, scheduled tasks, and scripts in place on the network-isolated machine.	AV scans overwrite $MFT records, alter MACB file timestamps, and purge unallocated clusters. Deleting the malware prevents analysts from extracting C2 endpoints, staging scripts, and assessing exfiltration scope.
DO NOT DELETE ROGUE ACCOUNTS OR FILESNever delete suspicious user accounts, administrative objects, or malicious files.	DISABLE ACCOUNTS & REVOKE SESSIONSDisable the account, set an invalid password (30+ random characters), and revoke all active authentication tokens.	Deleting accounts destroys Security Identifier (SID) mappings from Active Directory and local SAM databases. This severs the evidentiary link between event logs (Event ID 4624/4672) and user profile artifacts.
DO NOT PLAY WHACK-A-MOLENever reset a single user password or block a single C2 IP address in an ad-hoc manner while an intruder is active.	COORDINATE SYNCHRONIZED EVICTIONMaintain surveillance and document adversary infrastructure until a synchronized domain-wide containment plan is ready.	Tipping off human operators causes them to activate secondary backdoors, drop destructive wipers, or trigger ransomware prematurely across the domain before you have mapped the full blast radius. Coordinate Kerberos (krbtgt) Resets: Never execute an ad-hoc `krbtgt` password reset. Invalidating Kerberos Golden Tickets requires a synchronized double-reset timed to Kerberos ticket lifetimes to prevent enterprise-wide authentication lockouts.
DO NOT RESTORE FROM BACKUPS YETNever restore servers or databases onto compromised or uncontained network segments.	AIR-GAP BACKUP INFRASTRUCTUREPhysically and logically sever network connections to backup servers, Veeam repositories, and NAS/SAN storage arrays now.	Extortion groups systematically enumerate and wipe backups prior to encryption (via `vssadmin delete shadows` and storage APIs). Restoring onto an uncontained network results in immediate re-infection.

PHASE 03 // STAGING & EVIDENCE // PRE-DEPLOYMENT

Pre-Arrival CIRT Handover & Artifact Staging

Once systems are isolated and the bleeding is stopped, gather these items so the CIRT can start work the moment the kickoff call begins:

Freeze Circular Log Buffers (External Storage Only): Perimeter firewalls, VPN gateways, and Windows Domain Controllers overwrite event buffers every 4 to 12 hours under load. Immediately export current Windows Security Event Logs (Security.evtx), Sysmon logs, and PowerShell Script Block Logging (Event ID 4104).
MANDATORY: Export logs directly to an external USB drive or offline network share—NEVER to the local disk. Writing new files to the local disk allocates clusters across unallocated space, permanently destroying deleted attacker staging tools, scripts, and webshell artifacts.
Export Cloud Identity & SaaS Logs (M365 / Entra ID / Google Workspace): Cloud audit logs have strict default retention windows (Entra ID sign-in logs purge after 7 to 30 days depending on license tier). Immediately initiate an export of the Microsoft 365 Unified Audit Log (UAL) via the Purview portal or PowerShell (Search-UnifiedAuditLog), export all Entra ID sign-in logs (interactive, non-interactive, and service principal), and preserve Google Workspace Admin and Login audit logs.
Compile Patient Zero Brief: Document initial alert identifiers, source hostnames, internal IP addresses, egress destination IPs, affected user accounts, and first-observed detection timestamps in UTC.
Prepare Architecture Reference: Locate network topology diagrams, Active Directory trust relationships, and an inventory of crown-jewel assets (Domain Controllers, core databases, ERP infrastructure, hypervisors, and backup management consoles).
Agent Deployment Authorization: Identify authorized engineers and systems capable of deploying an incident response triage sensor (e.g., Velociraptor / Wazuh) across endpoints via GPO, Microsoft Intune, or SCCM. Precaution: If central management servers are suspected of compromise, halt all automated deployment until CIRT briefing.
Cryptographic Hash Verification: Calculate SHA-256 cryptographic hashes for all acquired disk snapshots and log archives immediately upon capture to guarantee evidentiary integrity. Record all generated hashes directly into the Scribe Log:
Windows (PowerShell):Get-FileHash <file> -Algorithm SHA256
Linux:sha256sum <evidence_file> > <evidence_file>.sha256

ACTIVE ENGAGEMENT // CIRT STANDBY

CIRT Intake & Contact Channels

We deploy non-destructive, fleet-wide forensic telemetry to identify the full blast radius, contain the adversary, and preserve evidence to evidentiary standards (documented chain of custody and hash verification).

OUT-OF-BAND CONTACT REMINDER

Mandatory External Contact Channels

CRITICAL: Do NOT initiate contact with VesperDryft using corporate email accounts, corporate-managed workstations, or internal VoIP lines. All communications must be conducted via personal cellular devices, personal unmanaged email accounts (e.g., ProtonMail, Gmail on personal hardware), or an external air-gapped network to prevent alerting adversaries active within the enterprise perimeter.

DIRECT LINE (VOICE):(701) 840-6203

PRIMARY CIRT INTAKE:contact@vesperdryft.com

PGP ENCRYPTION & FINGERPRINT:PGP-encrypted communication available for sensitive artifact transmission.

KEY FINGERPRINT:C0F1 627C 089C 7BC0 0B58 3ADE D46E 1735 0909 3370

Download Public Key (.asc) →

ONLINE INTAKE FORM:https://vesperdryft.com/contact