01 Scope & user
Are we dealing with a server or a workstation?
Sets the blast radius — a domain controller is not a kiosk. Hostname convention and OS build usually tell you fast.
Who was the user, and what is their permission level?
Standard user, local admin, or domain admin changes everything downstream. Check in PowerShell →
02 Alert context
What is the severity of the alert?
Take the tool's rating as a starting point, not the verdict. Low-sev alerts chain into real incidents.
What is CrowdStrike noting for MITRE Tactic & Technique?
The ATT&CK technique ID tells you what stage you're looking at. ATT&CK matrix →
Was anything blocked?
Blocked vs allowed decides urgency. A blocked payload is cleanup; an allowed one is a live problem.
03 Containment
Is something still running? Do I need to think about containment?
If the process is live or the host is beaconing, containment comes before deeper analysis. PS contain → · Bash contain →
04 Indicators & attribution
Any flags for indicators or known threat-actor groups?
A named group or a matched IOC shifts this from triage to IR fast. Check the intel tab and your feeds.
Do we recognize the file name or other processes involved?
Known-good, known-bad, or never-seen. LOLBins living off the land (
rundll32, mshta, regsvr32) are the ones to slow down on.05 Host behavior
Outbound active network connections seen?
Live C2 or exfil. PS network → · Bash network →
Suspicious command-line arguments?
-enc, base64, hidden window, DownloadString, IEX. The command line is where intent hides. Decode via 4104 →Odd parent / child process trees?
winword → powershell, or services.exe → cmd. The tree tells the story. Process tree →
06 Enrichment
Hash, IP, domain, URL analysis from OSINT?
Pivot on every indicator: VirusTotal, urlscan, AbuseIPDB. More tools on the home page →
07 Write-up · at a minimum
Key timestamps (UTC)
Always UTC. First activity, detection time, and when you actioned it — enough to rebuild the timeline.
What happened on the host (summary)
The two-to-three-sentence story. Host, process, command lines and behavior above give you the pieces — this ties them together.
What actions did you take?
Everything you did to the host or account — killed process, network-contained, disabled user, reset password. This is your accountability trail.
08 Write-up · nice to have
Root cause analysis
How did it get here in the first place? Phish, exposed service, removable media, supply chain. The RCA is what stops the repeat.
Forensic artifacts / screenshots
List what you captured and where it's attached — process tree grab, registry key, decoded script, PCAP. Note the file names since the ticket holds the images.
Scoping steps taken
Did you check whether other hosts or users saw the same thing? Say what you searched and what the blast radius turned out to be.
Next steps / recommendations for the next tier
What should Tier 2 / IR do next, and what would prevent a repeat. Hand off with a clear ask, not just a data dump.
Sandbox sample / analysis
If you detonated the sample, link the report and pull the highlights — dropped files, network, verdict.
Link to the detection
Deep-link to the alert in the console so the next person lands right on it.