ATT&CK Reference
Portfolio

Alert triage playbooks

Common SOC alerts turned into repeatable workflows. Each playbook maps to ATT&CK techniques and tells you what to check before and after the alert.

  1. Suspicious PowerShell / script execution

    Trigger An endpoint telemetry alert for encoded PowerShell, script block logging, or an Office application spawning an interpreter.

    Data source EDR, Windows Event ID 4104, Sysmon process creation

    T1059 Command and Scripting InterpreterT1204 User ExecutionT1027 Obfuscated Files or Information

    Triage questions

    1. Is the parent process a mail client, browser, or document? That confirms delivery via user execution.
    2. Does the command line contain -enc, -w hidden, or a download cradle? Record the decoded payload.
    3. Did the same user or host run discovery commands (whoami, net, nltest) within minutes?

    Pivot back

    Initial Access

    How did the script reach the host? Check mail gateway and browser downloads.

    Pivot forward

    Execution

    What did the script do next? Look for scheduled tasks, WMI, or service creation.

    Escalate if

    • The script contacted an external host or downloaded a second-stage payload.
    • The same PowerShell session later accessed LSASS or created a new local account.
    • The activity occurred on a domain controller or privileged jump host.

  2. LSASS access / credential dumping

    Trigger A process accessed LSASS memory, created a minidump, or Sysmon Event ID 10 fired with suspicious access rights.

    Data source Sysmon Event ID 10, Windows Security 4656, EDR

    T1003 OS Credential DumpingT1055 Process InjectionT1562 Impair Defenses

    Triage questions

    1. Which process accessed LSASS and with what access rights (0x1010 / 0x1410)?
    2. Is the source process a known security tool, or an unexpected binary in temp/Downloads?
    3. Did the host also create a volume shadow copy or read NTDS.dit?

    Pivot back

    Execution

    What executed the dumper? Trace the parent process tree back to delivery.

    Pivot forward

    Lateral Movement

    Where did the stolen credentials or hashes get used next? Search Type 3 logons.

    Escalate if

    • The dumper ran on a domain controller or backup server.
    • You find Kerberoasting or AS-REP roasting activity in the same window.
    • The same account began authenticating from new ASNs or countries.

  3. Lateral movement via RDP / SMB

    Trigger An authentication alert for RDP or SMB from an unusual source workstation, or a service creation on a remote host.

    Data source Windows Security 4624/4625, 7045, VPN logs, EDR

    T1021 Remote ServicesT1570 Lateral Tool TransferT1550 Use Alternate Authentication Material

    Triage questions

    1. Is the source host one the user normally works from? Check asset inventory and recent VPN logins.
    2. Was the destination a server the user has no business accessing?
    3. Did the session coincide with file writes to ADMIN$ or C$ on the target?

    Pivot back

    Credential Access

    Where did the credentials or tickets used here come from? Check for prior LSASS or Kerberos abuse.

    Pivot forward

    Discovery

    What did the adversary look at next? Search for account, group, and trust enumeration.

    Escalate if

    • The source is a non-IT workstation accessing a domain controller or backup server.
    • Multiple hosts were touched in a short window from the same source.
    • A new account or service was created on the target during the session.

  4. New account created + privileged group add

    Trigger A local or domain account was created and immediately added to a privileged group, or MFA was registered after a risky sign-in.

    Data source Windows Security 4720/4732, Azure AD audit, IdP logs

    T1136 Create AccountT1098 Account ManipulationT1484 Domain or Tenant Policy Modification

    Triage questions

    1. Who requested the account or group change? Open a change ticket and verify approval.
    2. Was the account created outside normal business hours or from an unusual source host?
    3. Did the new account authenticate anywhere within minutes of creation?

    Pivot back

    Persistence

    Is this the only persistence mechanism? Check run keys, services, and cloud app consents.

    Pivot forward

    Privilege Escalation

    What did the new privileged account do next? Look for policy changes or sensitive access.

    Escalate if

    • The account was added to Domain Admins, Enterprise Admins, or a cloud global admin role.
    • The creation happened from a host with other suspicious activity in the same window.
    • No change ticket exists and the owning team does not recognize the request.

  5. Mass file archive / staging for exfiltration

    Trigger A host created a large encrypted archive in a temp directory, or an account opened thousands of files across shares.

    Data source EDR file events, file server audit, DLP, proxy

    T1560 Archive Collected DataT1039 Data from Network Shared DriveT1041 Exfiltration Over C2 Channel

    Triage questions

    1. Which process created the archive and what files were added?
    2. Is the account a normal user, a service account, or a server that should not be archiving data?
    3. Did the host then upload a similarly sized payload to an external destination?

    Pivot back

    Collection

    What data was staged? Identify sensitive shares or mailboxes accessed beforehand.

    Pivot forward

    Exfiltration

    Did the archive leave the network? Check proxy, firewall, and DLP logs for outbound uploads.

    Escalate if

    • The archive contains sensitive data, PII, or intellectual property.
    • A large outbound transfer to cloud storage or an unknown host followed the archive creation.
    • The same pattern is observed on multiple endpoints simultaneously.