COMMAND AND CONTROL Incident Response Playbook

CyberDefender 3 mins0

Below is a highly detailed, professional Command-and-Control (C2) Incident Response Checklist you can use during an investigation or active intrusion.

Phase 1 — Detection & Triage

Step 1.1 – Validate alert

  • Confirm traffic is not business-legitimate
  • Check frequency: Is it periodic?
  • Check associated process on the host

Step 1.2 – Scope identification

  • Identify all communicating hosts
  • Identify all contacted domains/IPs
  • Check for multiple protocols (HTTPS + DNS fallback)

Step 1.3 – Escalation

  • Escalate to Incident Response if:

  • Confirmed malicious traffic
  • Data staging or exfil detected
  • Persistent connections to foreign infrastructure

Phase 2 — Containment

Step 2.1 – Network containment

  • Block identified domains/IPs
  • Quarantine host via EDR
  • Disable outbound traffic that matches the pattern
  • Implement DNS sinkhole if needed

Step 2.2 – Host containment

  • Isolate host
  • Stop malicious processes but do not reboot
  • Disable unauthorized remote access software

Phase 3 — Investigation & Forensics

Step 3.1 – Collect host artifacts

  • Memory image (Volatility-compatible)
  • Autoruns, scheduled tasks, services
  • Network connections (netstat)
  • Prefetch, shimcache, amcache
  • Browser history / download artifacts

Step 3.2 – Collect network artifacts

  • Firewall logs
  • Proxy logs
  • Raw PCAP samples
  • TLS handshake metadata
  • DNS logs (queries + responses)

Step 3.3 – Malware analysis

  • Identify RAT or loader
  • Decode configs (URLs, sleep intervals, beacon keys)
  • Identify persistence & lateral movement attempts

Phase 4 — Eradication

Step 4.1 – Remove persistence mechanisms

  • Registry run keys
  • Scheduled tasks
  • Services / WMI persistence
  • Kernel drivers (if rootkit present)

Step 4.2 – Remove malware artifacts

  • Delete malicious binaries, scripts, DLLs
  • Disable malicious remote access software
  • Remove web shell or internal proxy if discovered

Step 4.3 – Patch and harden

  • Patch exploited vulnerabilities
  • Enable strict outbound filtering
  • Ensure EDR coverage on all endpoints

Phase 5 — Recovery

Step 5.1 – Credential resets

Reset:

  • Local admin accounts
  • Domain accounts associated with infected systems
  • Service accounts
  • API keys and cloud tokens

Step 5.2 – System restoration

  • Restore from clean backups if necessary
  • Validate no persistence remains

Phase 6 — Post-Incident Actions

Step 6.1 – Lessons learned

  • Identify detection gaps
  • Improve DNS/HTTP/S inspection
  • Update blocklists and hunt queries
  • Add new detections for specific C2 techniques

Step 6.2 – Documentation

  • IR report
  • IOC repository update
  • MITRE ATT&CK mapping update
  • Executive summary

CyberDefender