Incident Response

Scope

What this is: Responding to active cyber incidents through detection, rapid containment, eradication of threats, and recovery of services.

Competition relevance: Digital forensics and incident response, and defensive operations (blue team). Core skill for all defensive scenarios.

Why it matters: Rapid IR reduces impact of breaches. Competition scenarios simulate real incidents requiring immediate triage, containment, and documentation under time pressure.

WSOS 2026 alignment: This topic directly supports Section 8: Investigation and digital forensics (responding to active security incidents).

Competition area: Core to the digital forensics and incident response area and the defensive operations area, where you detect, contain, eradicate, and recover from active cyber incidents.

Offline competence: IR workflows require no special tools beyond system administration utilities. Firewall commands (iptables, netsh), account management (usermod, Disable-ADAccount), and log collection work offline. Maintain offline IR playbooks and checklists for common incident types.

---

Competency Matrix

Level	Expectation
Regional	Identify compromised accounts. Basic containment (block IP, disable user).
National	Full IR workflow. Evidence collection. Timeline analysis.
Squad/Team Selection	Advanced containment strategies. Business continuity during IR.

---

Technical Content

Triage Process

Initial assessment:

1. What happened? (alert description)
2. When? (timeline)
3. Which systems affected?
4. Ongoing or contained?

Priority determination:

Critical: Active data exfiltration, ransomware
High: Lateral movement, privilege escalation
Medium: Suspicious logins, scanning
Low: Failed attempts, reconnaissance

---

Containment Strategies

Network isolation:

# Block IP at firewall
iptables -A INPUT -s 192.168.1.100 -j DROP

# Windows Firewall
netsh advfirewall firewall add rule name="Block Attacker" dir=in action=block remoteip=192.168.1.100

Account lockdown:

# Disable compromised account
Disable-ADAccount -Identity compromised_user

# Force password reset
Set-ADUser -Identity compromised_user -ChangePasswordAtLogon $true

System quarantine:

# Disconnect from network (preserve evidence)
# Don't shut down (volatile memory lost)

---

Evidence Collection

Memory dump:

# Linux
sudo dd if=/dev/mem of=memory.dump bs=1M

# Windows (DumpIt, WinPMEM)
DumpIt.exe

Disk imaging:

# Create forensic image
dd if=/dev/sda of=disk.img bs=4M status=progress

Log collection:

# Windows Event Logs
wevtutil epl Security security.evtx
wevtutil epl System system.evtx

# Linux
cp /var/log/auth.log auth.log.evidence

---

Eradication

Remove malware:

# Kill malicious process
kill -9 <PID>

# Remove persistence
crontab -r
rm /etc/systemd/system/malware.service

Patch vulnerability:

• Apply security updates
• Fix configuration issues
• Change compromised credentials

---

Recovery

Restore services:

1. Verify malware removed
2. Restore from clean backup
3. Monitor for re-infection
4. Change all credentials

---

Competition Strategy & Marking

What gets marked:

• Rapid triage and containment actions (screenshots showing blocked IPs, disabled accounts)
• Evidence collection completeness (memory dumps, disk images, logs with hashes)
• Incident timeline documentation with timestamps
• Root cause identification and remediation steps
• Service recovery verification

Evidence and reporting requirements:

• Screenshot showing initial incident detection (alert, suspicious log entry)
• Screenshot showing containment actions (blocked IP, disabled account, isolated system)
• Timeline of incident events with timestamps (CSV or markdown table format)
• Evidence collection screenshots (memory dump commands, disk image with hash, log exports)
• Screenshot showing eradication (malware removed, persistence mechanisms deleted)
• Post-incident verification (clean scans, services restored, no re-infection)
• Written incident report with timeline, root cause analysis, and remediation steps
• Clear file naming: ir_detection_alert.png, ir_containment_firewall.png, ir_timeline.csv

Time allocation:

• Triage and initial containment: 5-10 minutes
• Evidence collection: 15-20 minutes
• Eradication: 10-15 minutes
• Recovery and verification: 10-15 minutes
• Total: Approximately 40-60 minutes for full IR cycle

Time-boxed drill suggestion: 60-minute incident response simulation: Given an alert of suspicious activity (e.g., unusual login from external IP, malware detection, data exfiltration attempt), perform rapid triage to assess scope, contain the incident (block IPs, disable accounts, isolate systems), collect evidence (memory dumps, logs), identify root cause, eradicate the threat (remove malware, close vulnerabilities), and document the full incident timeline with timestamps. This drill should be completable offline using local VMs and pre-configured incident scenarios.

---

False Flags / Wrong Paths

Common Traps

Time-consuming rabbit holes If a single approach takes more than the allocated time-box, reassess and try alternative methods or move to next task.

Over-complication Competition scenarios test core skills. If solution seems overly complex, look for simpler approach.

---

Practice Checklist

• Can complete core tasks without documentation
• Understand key concepts and techniques
• Can document findings with proper evidence format
• Can complete realistic scenarios within time limits

---

References

Primary references:

• WSOS 2026: the sections this page supports are listed under Scope
• Competition stage roadmap: See ../../00-roadmaps/[stage].md

Related topics in this knowledge base:

• Cross-reference related topics as appropriate

External resources (for offline preparation):

• Tool documentation: man pages, —help flags, /usr/share/doc
• Maintain offline copies of key references