Skip to content

Latest commit

 

History

History
72 lines (69 loc) · 14 KB

RS0002.md

File metadata and controls

72 lines (69 loc) · 14 KB

Identification

ID: RS0002

Gather information about a threat that has triggered a security incident, its TTPs, and affected assets.

Response Actions

ID Name Description
RA2001 List victims of security alert List victims of a security alert
RA2002 List host vulnerabilities Get information about a specific host existing vulnerabilities, or about vulnerabilities it had at a particular time in the past
RA2003 Put compromised accounts on monitoring Put (potentially) compromised accounts on monitoring
RA2101 List hosts communicated with internal domain List hosts communicated with an internal domain
RA2102 List hosts communicated with internal IP List hosts communicated with an internal IP address
RA2103 List hosts communicated with internal URL List hosts communicated with an internal URL
RA2104 Analyse domain name Analyse a domain name
RA2105 Analyse IP Analyse an IP address
RA2106 Analyse uri Analyse an URI
RA2107 List hosts communicated by port List hosts communicating by a specific port at the moment or at a particular time in the past
RA2108 List hosts connected to VPN List hosts connected to a VPN at the moment or at a particular time in the past
RA2109 List hosts connected to intranet List hosts connected to the internal network at the moment or at a particular time in the past
RA2110 List data transferred List the data that is being transferred at the moment or at a particular time in the past
RA2111 Collect transferred data Collect the data that is being transferred at the moment or at a particular time in the past
RA2112 Identify transferred data Identify the data that is being transferred at the moment or at a particular time in the past (i.e. its content, value)
RA2113 List hosts communicated with external domain List hosts communicated with an external domain
RA2114 List hosts communicated with external IP List hosts communicated with an external IP address
RA2115 List hosts communicated with external URL List hosts communicated with an external URL
RA2116 Find data transferred by content pattern Find the data that is being transferred at the moment or at a particular time in the past by its content pattern (i.e. specific string, keyword, binary pattern etc)
RA2117 Analyse user-agent Analyse an User-Agent request header for indications of suspicious activity
RA2118 List Firewall rules List firewall rules
RA2201 List users opened email message List users that have opened am email message
RA2202 Collect email message Collect an email message
RA2203 List email message receivers List receivers of a particular email message
RA2204 Make sure email message is phishing Make sure that an email message is a phishing attack
RA2205 Extract observables from email message Extract observables from an email message
RA2206 Analyse email address Analyse an email address
RA2301 List files created List files that have been created at a particular time in the past
RA2302 List files modified List files that have been modified at a particular time in the past
RA2303 List files deleted List files that have been deleted at a particular time in the past
RA2304 List files downloaded List files that have been downloaded at a particular time in the past
RA2305 List files with tampered timestamps List files with tampered timestamps
RA2306 Find file by path Find a file by its path (including its name)
RA2307 Find file by metadata Find a file by its metadata (i.e. signature, permissions, MAC times)
RA2308 Find file by hash Find a file by its hash
RA2309 Find file by format Find a file by its format
RA2310 Find file by content pattern Find a file by its content pattern (i.e. specific string, keyword, binary pattern etc)
RA2311 Collect file Collect a specific file from a (remote) host or a system
RA2312 Analyse file hash Analise a hash of a file
RA2313 Analyse Windows PE Analise MS Windows Portable Executable
RA2314 Analyse macos macho Analise macOS Mach-O
RA2315 Analyse Unix ELF Analise Unix ELF
RA2316 Analyse MS office file Analise MS Office file
RA2317 Analyse PDF file Analise PDF file
RA2318 Analyse script Analyse a script file (i.e. Python, PowerShell, Bash scripts etc)
RA2319 Analyse jar Analyse a JAR file
RA2320 Analyse filename Analyse a filename
RA2401 List processes executed List processes being executed at the moment or at a particular time in the past
RA2402 Find process by executable path Find a process that is being executed at the moment or at a particular time in the past by its executable path (including its name)
RA2403 Find process by executable metadata Find a process that is being executed at the moment or at a particular time in the past by its executable metadata (i.e. signature, permissions, MAC times)
RA2404 Find process by executable hash Find a process that is being executed at the moment or at a particular time in the past by its executable hash
RA2405 Find process by executable format Find a process that is being executed at the moment or at a particular time in the past by its executable format
RA2406 Find process by executable content pattern Find a process that is being executed at the moment or at a particular time in the past by its executable content (i.e. specific string, keyword, binary pattern etc)
RA2501 List registry keys modified List registry keys modified at a particular time in the past
RA2502 List registry keys deleted List registry keys that have been deleted at a particular time in the past
RA2503 List registry keys accessed List registry keys that have been accessed at a particular time in the past
RA2504 List registry keys created List registry keys that have been created at a particular time in the past
RA2505 List services created List services that have been created at a particular time in the past
RA2506 List services modified List services that have been modified at a particular time in the past
RA2507 List services deleted List services that have been deleted at a particular time in the past
RA2508 Analyse registry key Analyse a registry key
RA2601 List users authenticated List users authenticated at a particular time in the past on a particular system
RA2602 List user accounts List user accounts on a particular system