— days until launch · 31 July 2026 · Founding seats are limited

Library

Playbooks & runbooks, written in production.

Incident response, exposure, threat-hunting and team-development playbooks across enterprise IT, cloud, OT/ICS, identity, supply chain, and more — a starting point for almost any scenario. The headline scenarios are free to walk at Community. Browse the whole catalogue below.

160 playbooks · methodology built in

Playbook library

160 in the catalogue

Incident84Exposure55Hunt12Team9

IDPlaybookAction

PB-CIRP-101

Phishing & Business Email Compromise

CIRPEnterprise IT

Walk →

PB-CIRP-103

Ransomware

CIRPEnterprise IT

Walk →

PB-CIC-001

Cyber Incident Commander

CICRole operating

Walk →

PB-EXR-401

Overprivileged Identity or Role

EXRConfiguration

Walk →

PB-HUNT-204

Living-off-the-Land Activity

HUNTEndpoint

Walk →

PB-EXR-101

Plaintext Credential Exposure

EXRCredentials

Walk →

160 playbooksFree at Community · headline set

Phishing and Business Email Compromise

Operator response for phishing reports and confirmed Business Email Compromise — twelve sub-scenarios from a single user report through to active wire fraud and tenant-wide account takeover.

Endpoint Malware Detection

Endpoint malware detection — single-host EDR alert through to confirmed multi-host implant. Twelve sub-scenarios; every CIRP that suspects payload execution routes here.

Ransomware

Operator response for human-operated ransomware (HumOR) — from precursor TTPs (VSS deletion, LSASS dumping, recovery tampering) through active encryption to post-impact extortion. Three stage variants (PRE-IMPACT / IN-PROGRESS / POST-IMPACT) drive containment posture.

Account Compromise / MFA Bypass

Operator response for account compromise where multi-factor authentication has been bypassed or defeated — Adversary-in-the-Middle (AiTM) token theft, MFA fatigue, password-spray, and device-code-flow abuse.

Data Exfiltration

Exfil-without-encryption response — quantify what left, where it went, and notify on regulatory clocks.

Insider Threat — Malicious

Confirmed malicious-insider response — coordinated with HR and Legal. Adversarial-employment posture from the start, with evidence discipline for disciplinary, tribunal, or law-enforcement use.

Privileged Account Abuse

Targeted misuse of standing administrative rights — break-glass abuse, service-account abuse, contractor admin misuse. Distinct from generic account takeover.

Lateral Movement Detection

Off-host pivot detection. RDP, SMB, WMI and WinRM lateral patterns — contain the spread before encryption or staging fires.

Destructive Malware / Wiper

Destructive malware / wiper response — non-recoverable by design. Containment is recovery-from-clean-source, not eviction. NotPetya / Olympic Destroyer / WhisperGate class.

Cryptominer Infection

Resource-hijack response for unauthorised cryptocurrency mining on endpoints, servers, containers, or cloud workloads. Light-track variant of PB-CIRP-102.

Web Shell on Internet-Facing Server

Web shell dropped on an internet-facing server after public-app exploitation — China Chopper, WSO, SharPyShell class. Isolate the host, capture the shell, hunt persistence and credential theft.

C2 Beaconing Detected (Cobalt Strike / Sliver / Generic)

Outbound C2 beacon confirmed. Profile the implant family (Cobalt Strike / Sliver / generic), isolate the host, hunt for peers on the same beacon profile.

LOLBin Abuse on Endpoint (PowerShell / WMIC / Certutil)

Living-off-the-land binary abuse on endpoint — standing-alert response for rundll32 / regsvr32 / mshta / certutil / bitsadmin / wmic / powershell chains. Capture the chain, classify the stage, contain, block fleet-wide.

Credential Dumping (LSASS / SAM / DCSync / NTDS.dit)

Operator response for credential-dumping — LSASS access, SAM/SYSTEM hive copy, NTDS.dit extraction, DCSync from a non-DC, DPAPI / browser secret theft. Pre-encryption credential access is the highest-confidence ransomware precursor; treat every confirmed dump as imminent.

Pass-the-Hash / Pass-the-Ticket Lateral Movement

NTLM hash replay or Kerberos ticket replay across hosts. MDI-driven detection; reconstruct lateral path; contain; rotate KRBTGT twice; validate AD recovery.

Browser Compromise / Session-Token Theft

Infostealer-driven browser compromise — Lumma, Redline or Vidar harvests saved credentials and session cookies; actor replays tokens against SaaS to bypass MFA. Track the host, rotate the credentials, kill the sessions.

Active Directory Enumeration / Attack-Path Discovery

Adversary mapping the directory with BloodHound, SharpHound, PowerView or AdFind. Detect the recon, contain the source host and identity, hunt for what came next.

Email-Delivered Malware (Macro / LNK / ISO / HTML Smuggling)

Email-delivered malware response — the deliverable-variant playbook for macro, OneNote, ISO/IMG, LNK, and HTML-smuggling payloads. Walks the email reconstruction in parallel with endpoint containment.

Web-Application Exploitation (SQLi / SSRF / Deserialisation)

Application-layer compromise — SQLi, SSRF, deserialisation, XXE. Reconstructs the request chain post-WAF-bypass, scopes data impact, contains the host, removes the vulnerable endpoint from the internet.

VPN / Remote-Access Concentrator Compromise (Ivanti / Fortinet / Citrix)

Internet-edge remote-access concentrator compromise — Ivanti Pulse / Connect Secure, Fortinet FortiGate / FortiOS SSL-VPN, Citrix NetScaler / ADC / Gateway. CVE-driven, pre-auth, frequently mass-exploited.

AWS Account Compromise

AWS control-plane compromise — IAM key leak, console takeover, federated-role abuse and root-account abuse. Triages, contains and recovers AWS identities, sessions and resources.

M365 / Entra ID Compromise

Tenant-wide M365 / Entra ID compromise response — four sub-scenarios spanning Global Admin takeover, mass-mailbox-rule deployment, service-principal credential injection, and conditional-access tampering.

OAuth / SaaS Token Abuse

Illicit-consent grants and refresh-token replay across M365, Google Workspace, Slack, GitHub and Atlassian — bounds the OAuth blast radius and revokes the persistence layer.

Cloud Storage Data Leak (S3, Azure Blob, GCS)

Object-storage exposure has become an IR — confirmed external access, scrape evidence, or data on the internet. Scope the leak, contain access, assess the privacy-breach footprint, notify.

Showing 24 of 160 matching playbooks. The headline scenarios are free to walk at Community; Pro unlocks the wider catalogue.