Logo
SOC Incident Playbooks Defend · Detect · Respond
Baldwin CIS SecOps Team

Real-World Incident Playbooks for SOC Analysts

Step-by-step investigation and response guides for the most common security incidents — built for students, freshers, and daily SOC work.

Step-by-Step GuidancePractical ExamplesFor Students & FreshersDaily SOC Work

What Is an Incident Playbook?

An incident playbook is a documented, step-by-step guide that helps SOC analysts detect, investigate, contain, eradicate, and recover from security incidents in a consistent and efficient manner.

Why Playbooks Matter

  • Ensure consistent response
  • Reduce response time
  • Improve accuracy
  • Help new analysts learn faster
  • Improve communication & reporting

Playbook Structure

  1. Preparation
  2. Detection
  3. Analysis
  4. Containment
  5. Eradication
  6. Recovery
  7. Post-Incident Review
  8. Lessons Learned

The SOC Investigation Lifecycle

Alert→Triage→Investigation→Containment→Escalation→Closure

Example: what happens when a phishing alert arrives?

  1. Alert received in SIEM
  2. Triage & validate the alert
  3. Investigate using playbook steps
  4. Contain if malicious
  5. Escalate if required
  6. Document & close the incident

How to Use These Playbooks

Before Investigation

  • Understand the alert clearly
  • Follow the steps in order
  • Use the recommended tools
  • Document everything you do
  • Communicate with the team
  • Escalate when required

Common SOC Tools

  • SIEM (Wazuh / Splunk)
  • EDR (CrowdStrike / Microsoft Defender)
  • Threat Intelligence (VirusTotal)
  • Ticketing (TheHive / ServiceNow)
  • Communication (Slack / Teams)
  • Network Tools (Wireshark, Nslookup)

Playbook Usage Tips

  • Always validate the alert before proceeding.
  • Collect as much evidence as possible.
  • Use threat intelligence to enrich IOCs.
  • Do not delete or modify evidence.
  • Keep the end user informed when necessary.
  • Document each step in the ticket.
  • Escalate if you are unsure or if the incident is beyond your scope.
Important reminder: the goal of a SOC analyst is not just to close alerts, but to understand, investigate, and stop threats. Tip: always verify before escalating.

SOC Analyst Quick Reference Guide

Important Event IDs

Event IDMeaning
4624Successful Login
4625Failed Login
4688Process Creation
4689Process Terminated
4728User Added to Group
4732User Removed from Group
7045Service Installed
1102Security Log Cleared
4104PowerShell Script Block

Alert Severity Guide

CRITICAL
Active attack or major impact · respond in 0–15 min
e.g. ransomware, data exfiltration
HIGH
High risk or potential breach · respond in 15–60 min
e.g. brute force, privilege escalation
MEDIUM
Suspicious activity needs validation · respond in 1–4 hrs
e.g. unusual login, policy violation
LOW
Informational or low impact · respond in 4–24 hrs
e.g. scan, info events
Part 1 · Core Playbooks
PB-01

Phishing Email Investigation

Purpose: investigate phishing emails and identify malicious intent, URLs, domains, and attachments. Phishing is an attack where an attacker attempts to trick users into revealing sensitive information or installing malicious content by disguising as a trusted entity.

Playbook Workflow

Alert / Email Report→Analyze Email Header→Check URLs & Attachments→Threat Intelligence Lookup→Determine Malicious / Safe→Report & Close

Common Phishing Indicators

  • Suspicious or unknown sender
  • Urgent or threatening language
  • Mismatched or spoofed domain
  • Shortened or suspicious URLs
  • Unexpected attachments
  • Poor grammar or spelling
  • Requests for sensitive information

Types of Phishing

  • Credential Phishing
  • Spear Phishing
  • Business Email Compromise (BEC)
  • Malware / Attachment Phishing
  • Smishing (SMS Phishing)
  • Vishing (Voice Phishing)

Detailed Steps

  1. Collect the email (.eml file)
  2. Analyze headers (Received, From, SPF, DKIM, DMARC)
  3. Check sender domain reputation
  4. Extract URLs and scan in VirusTotal
  5. Analyze attachments in sandbox
  6. Identify indicators (IPs, domains, hashes)
  7. Determine if malicious
  8. Assess impact on users / systems
  9. Report findings and close the case

Escalation Criteria

  • Credential submission detected
  • Malicious attachment executed
  • High severity threat identified
  • Multiple users report the same email
  • Incident affects business operations
  • Any uncertainty or critical impact

Response Actions

  • Block sender email and domain
  • Remove email from user inbox
  • Quarantine suspicious attachments
  • Block malicious URLs / IPs
  • Notify affected users
  • Update email security rules
  • Document all findings in ticket

Tools

Microsoft 365 / Gmail Admin · VirusTotal · MX Toolbox · Any.run / Hybrid Analysis · Wazuh / Splunk · AbuseIPDB / Cisco Talos · URLScan.io

Example: a user reports an email from "support@microsoft.com" asking them to "verify account." The link redirects to a fake login page. Using this playbook, we validate the domain, check the URL, analyze the header, and confirm it is a phishing attempt.
PB-02

Malware Alert Investigation

Purpose: investigate malware alerts from EDR, anti-virus, or user reports to identify the threat, contain it, and remove it from the environment. Malware (malicious software) is any software designed to damage, disrupt, steal data, or gain unauthorized access to systems.

Playbook Workflow

Alert from EDR / AV→Identify Affected Host→Collect IOCs (Hash, IP, Domain)→Threat Intelligence Lookup→Contain the Host→Eradicate & Recover→Document & Close

Key Things to Verify

  • Is the alert real or a false positive?
  • What is the file / process name?
  • Where is the file located?
  • What is the parent process?
  • Is the host communicating externally?
  • Is any data stolen or encrypted?

Response Actions

  • Isolate the affected endpoint
  • Block malicious file hash / IP
  • Remove or quarantine malware
  • Kill malicious processes
  • Update signatures & scan again
  • Monitor the host for activity
  • Document all actions in ticket

Detailed Investigation Steps

  1. Review malware alert details
  2. Verify affected endpoint
  3. Collect file hash (MD5 / SHA256)
  4. Review file path
  5. Identify parent process
  6. Check VirusTotal reputation
  7. Run sandbox analysis
  8. Review network connections
  9. Isolate endpoint if malicious
  10. Remove malware
  11. Verify clean system
  12. Document findings
PB-03

Brute Force Login Detection

Purpose: detect and respond to brute force login attempts targeting user accounts and prevent unauthorized access.

Playbook Workflow

SIEM Alert (Multiple Failed Logins)→Review Login Attempts (User, IP, Time)→Identify Source IP & Location→Validate Activity→Block Source IP (If Malicious)→Monitor & Document

Common Indicators

  • Multiple failed login attempts in a short time
  • Same source IP targeting multiple users
  • Password spraying attempts
  • Unusual login time
  • Login attempts from unfamiliar location
  • Success after multiple failed attempts

Response Actions

  • Block the malicious IP
  • Reset user password (if needed)
  • Enable / enforce MFA
  • Check for other targeted accounts
  • Monitor for suspicious activity
  • Document the incident & findings
  • Escalate if the threat persists

Detailed Investigation Steps

  1. Review alert details and timestamp
  2. Check Event ID 4625 (Failed Logon)
  3. Count number of failed attempts
  4. Identify the username targeted
  5. Identify the source IP address
  6. Perform geo-location & IP reputation check
  7. Verify if successful logon followed (Event ID 4624)
  8. Block the malicious IP at firewall / AD level
  9. Reset password if account is compromised
PB-04

Privilege Escalation Detection

Purpose: detect unauthorized attempts to gain elevated privileges or modify user roles and permissions.

Common Indicators

  • User added to admin groups unexpectedly
  • Privilege changes outside of change window
  • New admin account creation
  • Usage of tools like PowerShell, PsExec, or Mimikatz
  • Access from unusual locations before privilege change

Important Event IDs

4728User Added to Global Group
4732Member Added to Local Group
4756Member Added to Universal Group
4672Special Privileges Assigned
4663Object Access Attempt (elevated rights)

Detailed Investigation Steps

  1. Review the alert and event details
  2. Identify the affected user or account
  3. Check the type of privilege change
  4. Review the group or permissions modified
  5. Verify if the change was authorized
  6. Review related events before and after
  7. Remove or roll back unauthorized changes
  8. Reset credentials if compromise suspected

Response Actions

  • Remove unauthorized privileges
  • Disable or lock the compromised account
  • Restore original permissions
  • Reset affected account passwords
  • Review and harden access controls
  • Monitor for further suspicious activity
  • Escalate to L2 / Incident Response Team
PB-05

Data Exfiltration Detection

Purpose: detect unauthorized transfer of sensitive or confidential data outside the organization.

Playbook Workflow

DLP / SIEM Alert Triggered→Identify User, Data Type & Destination→Analyze Transfer Details & Volume→Validate Business Justification→Contain & Block the Transfer→Document & Escalate if Required

Common Indicators

  • Large volume data uploads to cloud storage
  • Data sent to external email accounts
  • USB / removable device usage
  • Access to sensitive files outside normal role
  • Data transfer at unusual hours
  • Encrypted files leaving the network

Common Destinations

  • Cloud storage (Google Drive, Dropbox, OneDrive, etc.)
  • External email (personal domains)
  • Web uploads (file sharing sites)
  • Removable devices (USB, external HDD)
  • Encrypted channels (Tor, VPN, etc.)

Tools

  • Data Loss Prevention (DLP)
  • SIEM (Splunk, Wazuh, etc.)
  • Proxy / web gateway logs
  • Email security gateway
  • Endpoint Detection & Response (EDR)
  • Cloud Access Security Broker (CASB)

Escalate When

  • Large volume of sensitive data transferred
  • Data sent to untrusted or unknown destination
  • Repeated attempts after initial warning
  • User shows suspicious behavior or policy violation
  • Potential data breach impact

Detailed Investigation Steps

  1. Review DLP alert details
  2. Identify affected user
  3. Determine data classification
  4. Review file names transferred
  5. Check destination domain / IP
  6. Verify transfer volume
  7. Validate business justification
  8. Review historical behavior
  9. Preserve logs and evidence
  10. Block transfer if malicious
  11. Escalate if breach suspected
  12. Document findings

Response Actions

  • Block the data transfer immediately
  • Disable user account (if necessary)
  • Revoke access to sensitive data
  • Preserve logs and evidence
  • Notify Data / Security Team
  • Investigate source system
  • Escalate to Incident Response Team
PB-06

Web Application Attack Detection

Purpose: detect attacks targeting web applications that exploit vulnerabilities to steal data, execute code, or disrupt services. A web application attack is an attempt to exploit vulnerabilities in a web application to gain unauthorized access or perform malicious actions.

Playbook Workflow

WAF Alert Triggered→Review Request (Source IP, URL, Method)→Identify Attack Type (Payload Analysis)→Analyze Logs (Web Server / App)→Validate Impact (Success or Blocked)→Block Attack & Document

Common Web Attacks

SQL InjectionAttackers manipulate SQL queries to access or modify the database.
Cross-Site Scripting (XSS)Attackers inject malicious scripts into webpages.
Command InjectionAttackers execute OS commands on the server.
Path TraversalAttackers access files outside the web root directory.
File Upload AttacksUploading malicious files to the server.

Escalate When

  • Database access or data dump detected
  • Sensitive information is exposed
  • Multiple attack attempts from same IP
  • Web shell or RCE suspected
  • Application is defaced or unavailable

Response Actions

  • Block the malicious IP address
  • Update WAF rules / signatures
  • Validate and patch the vulnerability
  • Review application access logs
  • Notify the application team
  • Monitor for similar attacks
  • Escalate if data exposure suspected

Detailed Investigation Steps

  1. Review the WAF / IDS alert details
  2. Identify the source IP address
  3. Review the HTTP request (URL, method, headers)
  4. Analyze the payload for malicious patterns
  5. Check web server / application logs
  6. Determine the type of attack
  7. Validate if the attack was successful
  8. Identify the affected application / endpoint
  9. Block the malicious IP at the WAF / firewall
  10. Update WAF rules / signatures
  11. Notify the application / development team
  12. Document the incident and evidence
Part 2 · Advanced Real-World Playbooks
PB-07

Ransomware Activity Detection

Purpose: detect ransomware behavior early to stop encryption, prevent data loss, and limit business impact. Ransomware is malicious software that encrypts files or locks systems and demands payment (ransom) to restore access.

Common Indicators

  • Mass file renaming or extension changes (e.g. .locky, .crypted)
  • Ransom notes (README.txt, DECRYPT FILES.txt)
  • Shadow copy deletion (vssadmin delete, wmic shadowcopy)
  • Unusual SMB / RDP activity
  • Unusual encryption processes

Escalate When

  • Multiple files are being encrypted
  • Ransom note is found
  • Encryption spreading to multiple systems
  • Critical servers or backups are affected
  • Any payment demand seen

Detailed Investigation Steps

  1. Review the alert details in EDR / SIEM
  2. Identify the affected endpoint(s)
  3. Check ransom note and contact details
  4. Analyze encrypted file extensions
  5. Check for shadow copy deletion attempts
  6. Investigate lateral movement (SMB, RDP)
  7. Identify initial access / patient zero
  8. Review task scheduler & startup entries
  9. Collect IOCs and block across environment
  10. Escalate to Incident Response Team

Response Actions

  • Isolate affected host from the network
  • Kill malicious processes
  • Disable affected user accounts (if any)
  • Block malicious IPs / domains
  • Preserve evidence (logs, memory, disk image)
  • Engage IR team and management
  • Communicate with stakeholders
PB-08

Suspicious PowerShell Activity

Purpose: detect malicious or suspicious PowerShell execution that can be used for reconnaissance, payload delivery, persistence, and credential theft.

Why Attackers Use PowerShell

  • Built-in Windows tool (Living-off-the-Land)
  • Can bypass application whitelisting
  • Supports encoding and obfuscation
  • Powerful access to system & network
  • Useful for persistence and lateral movement
  • Harder to detect when obfuscated

Common Indicators

  • Encoded PowerShell commands (e.g. -enc, EncodedCommand)
  • Execution policy bypass (e.g. Bypass, Unrestricted)
  • Suspicious parent process (e.g. winword.exe, excel.exe)
  • Downloading content from external sources
  • Use of Invoke-Expression, IEX, or Add-Type
  • Access to sensitive system areas or registry

Detailed Investigation Steps

  1. Review alert in EDR / SIEM
  2. Identify the affected host and user
  3. Collect PowerShell logs (Event ID 4103 / 4104)
  4. Retrieve the full command line or script block
  5. Check for encoded or obfuscated commands
  6. Decode Base64 or encoded content
  7. Analyze the script behavior and intent
  8. Check parent process and child processes
  9. Review network connections (destinations)
  10. Determine the impact and escalate if needed

Response Actions

  • Verify the command and intent
  • Kill malicious PowerShell process
  • Block the malicious indicators (IP, domain, hash)
  • Reset affected user credentials
  • Check for persistence mechanisms
  • Collect logs and evidence
  • Escalate to Incident Response Team
PB-09

Account Compromise Detection

Purpose: detect compromised user accounts early to prevent unauthorized access, data theft, and lateral movement.

Indicators of Account Compromise

  • Login from unusual location
  • Impossible travel
  • Unusual device or application
  • Privilege changes
  • Password or MFA changes
  • New inbox rules / forwarding

Commonly Seen In

  • Microsoft 365 / Entra ID
  • Google Workspace
  • VPN / cloud applications
  • SIEM alerts (Splunk, Wazuh, Sentinel)
  • EDR alerts
  • Email security gateways

Detailed Investigation Steps

  1. Review login history
  2. Verify source IP addresses
  3. Check impossible travel alerts
  4. Review MFA changes
  5. Check mailbox forwarding rules
  6. Review OAuth applications
  7. Verify role / privilege changes
  8. Review active sessions
  9. Revoke suspicious sessions
  10. Reset credentials
  11. Enforce MFA
  12. Escalate if compromise confirmed

Response Actions

  • Disable or lock the account
  • Reset password and enforce MFA
  • Revoke all active sessions
  • Remove malicious inbox rules
  • Revoke OAuth / application tokens
  • Notify user and management
  • Monitor the account closely
  • Escalate to IR team
PB-10

Command & Control (C2) Activity Detection

Purpose: detect and respond to systems communicating with attacker infrastructure used for remote control, data theft, or additional malicious activities. Command & Control (C2) is the channel used by attackers to send commands, steal data, or maintain persistence on compromised systems.

Common Indicators

  • Beaconing traffic at regular intervals (30s – 60s)
  • Connections to known malicious IPs or domains
  • High volume of DNS requests to rare domains
  • Unusual user agent or HTTP headers
  • Encrypted traffic to unusual locations
  • Outbound connections on uncommon ports
  • Use of tunneling protocols (DNS, HTTPS, ICMP, WebSocket, etc.)

Detailed Investigation Steps

  1. Review the alert in SIEM / EDR
  2. Identify the source host / user
  3. Review destination IP / domain
  4. Check IP / domain reputation
  5. Analyze DNS queries & responses
  6. Review network connection pattern
  7. Identify the associated process
  8. Check for persistence mechanism
  9. Block communication (firewall / DNS)
  10. Isolate the affected host
  11. Collect and preserve evidence
  12. Escalate to Incident Response Team

Mitigation Actions

  • Block malicious IPs / domains
  • Block malicious ports
  • Update firewall rules
  • Disable malicious services
  • Remove persistence mechanisms
  • Monitor for reoccurrence
PB-11

Insider Threat Activity Detection

Purpose: detect and respond to malicious, negligent, or risky activities performed by internal users that could lead to data loss, fraud, or security breaches.

Common Indicators

  • Large file downloads / uploads
  • Data staging before exfiltration
  • Access to sensitive data
  • Access from personal accounts
  • USB or external device usage
  • Disabling security controls
  • Unusual working hours activity
  • Privilege escalation / abuse
  • Deletion of logs or evidence
  • Sharing data to personal email / cloud

Detailed Investigation Steps

  1. Review the alert in SIEM / DLP / UEBA
  2. Identify the user and affected assets
  3. Review user activity timeline
  4. Check access to sensitive data
  5. Review file transfers and downloads
  6. Check email / cloud sharing activity
  7. Review USB device usage logs
  8. Validate with HR / manager if needed
  9. Determine intent (malicious / negligent)
  10. Restrict access & revoke privileges
  11. Document findings and evidence
  12. Escalate to Incident Response Team

Response Actions

  • Isolate or restrict user account
  • Revoke admin / elevated access
  • Disable external device usage
  • Block data exfiltration channels
  • Notify management / HR
  • Collect full forensic evidence
  • Monitor for further activity
  • Document the incident
  • Provide user awareness training
  • Escalate if malicious intent confirmed
PB-12

Lost / Stolen Device Investigation

Purpose: respond quickly to lost or stolen corporate devices to protect organizational data, prevent unauthorized access, and reduce security risks.

Common Scenarios

  • Laptop left in taxi / public place
  • Device stolen from bag or office
  • Mobile phone lost during travel
  • Unauthorized access attempts detected
  • Device not returning online

Detailed Investigation Steps

  1. Verify the device ownership and user details
  2. Confirm last seen time and last known location
  3. Check device health in EDR / MDM
  4. Review active sessions and logged-in accounts
  5. Revoke access tokens and active sessions
  6. Disable user account if needed
  7. Force password reset for all critical accounts
  8. Initiate remote lock on the device
  9. If not recovered, perform remote wipe
  10. Monitor for suspicious activity post-incident
  11. Notify stakeholders and management
  12. Document the incident and lessons learned

Response Actions

  • Lock or wipe the device remotely
  • Revoke all active sessions
  • Disable user account if required
  • Reset passwords for critical accounts
  • Block compromised device in MDM
  • Monitor for unusual login attempts
  • Notify management and IT security
  • Document and track the incident
  • Escalate if sensitive data is at risk
Resource Center

Downloadable Forms

Print-ready templates for evidence collection and handling. Download, print, and complete by hand for casework.

📋

Digital Forensics Collection Checklist

EVIDENCE COLLECTION · 3 PAGES · PDF
Download
🔗

Chain of Custody Form

EVIDENCE HANDLING · 1 PAGE · PDF
Download