Live Response

Scope

What this is: Performing emergency response on live, running systems during active incidents to contain threats and preserve evidence.

Competition relevance: Digital forensics and incident response, and defensive operations (blue team). Critical skill for active incident scenarios.

Why it matters: Live response requires balancing containment speed with evidence preservation. Competition scenarios simulate active attacks requiring immediate response.

WSOS 2026 alignment: This topic directly supports Section 8: Investigation and digital forensics (performing emergency response on live, running systems during active incidents).

Competition area: Core to the digital forensics and incident response area and the defensive operations area, where you perform rapid containment and evidence collection on systems under active attack.

Offline competence: Live response uses built-in system utilities. Network isolation commands (iptables, netsh, physical disconnect), process management (kill, taskkill), and memory acquisition tools (LiME, WinPMEM) work offline. Maintain offline live response checklists and USB toolkit.

Competency Matrix

Level	Expectation
Regional	Basic firewall rules. Disable accounts.
National	Emergency patching. Network segmentation. Service isolation.
Squad/Team Selection	Business continuity during response. Minimal service disruption.

---

Technical Content

Firewall Changes

Block malicious IP:

# Linux iptables
iptables -A INPUT -s 192.168.1.100 -j DROP
iptables-save > /etc/iptables/rules.v4

# UFW
ufw deny from 192.168.1.100

# Windows
netsh advfirewall firewall add rule name="Block Attacker" dir=in action=block remoteip=192.168.1.100

Block outbound to C2:

iptables -A OUTPUT -d 203.0.113.1 -j DROP

# Windows
netsh advfirewall firewall add rule name="Block C2" dir=out action=block remoteip=203.0.113.1

---

Network Isolation

Isolate compromised host:

# Disconnect network interface (Linux)
ip link set eth0 down

# Windows
netsh interface set interface "Ethernet" admin=disable

VLAN segmentation:

• Move compromised host to quarantine VLAN
• Apply restrictive ACLs

---

Emergency Patching

Apply critical patch:

# Linux
apt update && apt install -y package-name

# Windows (if WSUS unavailable)
# Download patch manually, apply
wusa.exe patch.msu /quiet /norestart

---

Service Isolation

Stop compromised service:

systemctl stop apache2
systemctl disable apache2

Kill malicious process:

ps aux | grep malware
kill -9 <PID>

---

Competition Strategy & Marking

What gets marked:

• See specific task requirements

Evidence and reporting requirements: Evidence and reporting requirements:

• Screenshot showing live system state before response (netstat -an, ps aux / tasklist, open files with lsof / handle)

• Screenshot showing containment actions taken (network isolation command, firewall rule blocking attacker IP)

• Memory dump collected with verification (screenshot showing acquisition tool output, file size, and hash)

• Screenshot showing volatile data captured (active network connections, running processes, logged-in users)

• Timeline documenting all response actions with precise timestamps

• Verification screenshot showing containment effectiveness (no malicious network traffic post-isolation, malicious processes terminated)

• Written explanation of response actions, rationale for each step, and evidence preservation considerations

• Clear file naming: live_before_netstat.png, live_isolation.png, live_memory_dump_hash.txt

• Act quickly (containment first)

• Document all actions (screenshots)

• Balance security vs availability

• Time limit: Live response is time-critical (30 minutes max)

Time-boxed drill suggestion: 30-minute live response emergency drill: Given a running system with active simulated malware, perform emergency live response: document volatile system state (netstat, ps, open files), identify malicious processes and network connections, isolate system from network without powering off, terminate malicious processes, collect live memory dump with verification hash, preserve evidence with proper chain of custody, and document all actions with timestamps. This drill should be completable offline using local VMs with pre-staged malware samples or simulated threats.

---

False Flags / Wrong Paths

Common Traps

Time-consuming rabbit holes If a single approach takes more than the allocated time-box, reassess and try alternative methods or move to next task.

Over-complication Competition scenarios test core skills. If solution seems overly complex, look for simpler approach.

---

Practice Checklist

• Can complete core tasks without documentation
• Understand key concepts and techniques
• Can document findings with proper evidence format
• Can complete realistic scenarios within time limits

---

References

Primary references:

• WSOS 2026: the sections this page supports are listed under Scope
• Competition stage roadmap: See ../../00-roadmaps/[stage].md

Related topics in this knowledge base:

• Cross-reference related topics as appropriate

External resources (for offline preparation):

• Tool documentation: man pages, —help flags, /usr/share/doc
• Maintain offline copies of key references