Incident Response Cheat Sheet: The First 60 Minutes

MAG212 CYBER · Cheat sheet

Incident response: the first 60 minutes

You think you have been breached. What you do in the next hour decides how much evidence survives, how far the attacker gets and how much it costs. Print this, fill in your contacts, and keep it somewhere you can reach when your normal systems cannot be trusted.

Jump to evidence commands

Five rules before you touch anything

Don’t switch it offPowering down destroys memory evidence. Disconnect from the network instead.

Assume email and chat are watchedCoordinate by phone or a separate, clean channel until you know what is compromised.

Write everything downTime, who, what you saw, what you did. Use UTC. Your notes become the incident record.

Contain before you cleanStop the spread first. Wiping and reinstalling too early erases what you need to find the way in.

Don’t pay or negotiate aloneFor ransomware, talk to legal counsel, your insurer and law enforcement before any contact with attackers.

Minute by minute

0–5 minDeclare

Confirm and declare an incident

Confirm the signal is real: alert, ransom note, unusual logins, user report.
Declare an incident and name one incident lead who makes decisions.
Start the incident log (time in UTC, observation, action, by whom).
Photograph screens that show ransom notes or error messages.

5–15 minScope

Find out what is affected

Which systems, accounts and data are involved? Which business services are down?
Is it still spreading? Check for new encrypted files, new admin accounts, unusual outbound traffic.
Identify the likely entry point: phishing email, exposed VPN or remote desktop, unpatched server, stolen password.
Check vendor advisories and CISA’s Known Exploited Vulnerabilities list for anything internet-facing you run.

15–30 minContain

Stop the spread, keep the evidence

Isolate affected machines from the network (unplug or EDR isolation). Leave them powered on.
Disable compromised accounts and revoke their active sessions and tokens.
Reset privileged passwords from a known-clean device, starting with domain and cloud admins.
Block known bad IPs, domains and file hashes at the firewall, mail gateway and EDR.
Collect volatile evidence before changing more: running processes, network connections, logged-in users (commands below).
Take snapshots of affected cloud VMs and export logs before they rotate.

30–45 minNotify

Bring in the right people

Brief management with facts only: what is known, what is not, next update time.
Call your cyber insurer early. Many policies require prompt notice and a pre-approved response firm.
Involve legal counsel to assess notification duties (for example GDPR’s 72-hour rule, or the SEC’s four-business-day rule for material incidents at US public companies).
Report to law enforcement: in the US, the FBI at ic3.gov and CISA at cisa.gov/report; in the UK, the NCSC at report.ncsc.gov.uk; elsewhere, your national CERT.
French-speaking countries: in France, any victim (individual, business or local authority) can get help 24/7 at 17cyber.gouv.fr, organisations can reach the national CERT-FR on 3218 (+33 9 70 83 32 18) or cert-fr@ssi.gouv.fr, and personal data breaches must be notified to the CNIL at notifications.cnil.fr; in Belgium, the Centre for Cybersecurity Belgium at notif.safeonweb.be; in Switzerland, the Federal Office for Cybersecurity (BACS) at bacs.admin.ch; in Canada, the Canadian Centre for Cyber Security at cyber.gc.ca.

45–60 minPlan

Plan recovery, not just cleanup

Verify your backups are intact and were not reachable by the attacker (offline or immutable copies).
Decide restore order by business priority: identity, email, core apps, then the rest.
Agree internal and customer messaging. One spokesperson, no speculation.
Set the next checkpoint time and keep the log going.

Collect evidence: copy-paste commands

Run from an admin prompt and save output to external media or a network share you control. Record the time you ran each one.

Windows (PowerShell, as admin)

# Network connections with owning process
netstat -ano > E:\IR\netstat.txt
# Running processes with users
tasklist /v > E:\IR\tasklist.txt
# Logged-on sessions
query user > E:\IR\users.txt
# DNS cache (recent lookups)
ipconfig /displaydns > E:\IR\dns.txt
# Export event logs before they roll over
wevtutil epl Security E:\IR\Security.evtx
wevtutil epl System E:\IR\System.evtx
# Scheduled tasks (common persistence)
schtasks /query /fo LIST /v > E:\IR\tasks.txt

Linux (as root)

# Network connections with processes
ss -tunap > /mnt/ir/ss.txt
# Process tree
ps auxf > /mnt/ir/ps.txt
# Recent and failed logins
last -F > /mnt/ir/last.txt
lastb -F > /mnt/ir/lastb.txt
# Logs from the last 6 hours
journalctl --since "6 hours ago" > /mnt/ir/journal.txt
# Cron and systemd persistence
crontab -l; ls -la /etc/cron.*
systemctl list-timers --all
# Hash any suspicious file
sha256sum /path/to/suspicious_file

Microsoft 365 / Entra ID (compromised user)

# Microsoft Graph PowerShell: sign the user out everywhere
Connect-MgGraph -Scopes "User.ReadWrite.All"
Revoke-MgUserSignInSession -UserId user@yourcompany.com
# Then: reset password, re-register MFA, and check for
# new inbox forwarding rules, app consents and OAuth grants

Hash files with our File Hash Checker and defang indicators before sharing them with the Decoder Toolbox.

Never do this

Run antivirus “clean” or wipe machines before evidence is collected.
Log in to a suspected machine with a domain admin account (it can expose those credentials).
Email the team about the incident from a mailbox that may be compromised.
Restore from backup before you know how the attacker got in.
Post about it publicly before legal and management agree on the message.

Your contact sheet (fill in and print)

Role	Name	Phone (out-of-band)
Incident lead	________________	________________
IT / security on call	________________	________________
Management decision maker	________________	________________
Legal counsel	________________	________________
Cyber insurer (policy no.)	________________	________________
Incident response firm	________________	________________
Hosting / cloud provider support	________________	________________

Keep a printed copy offline. During ransomware your contact list on the file server may be encrypted too.

Keep going

Security Self-AssessmentFind your weak spots before an attacker does. Email Header AnalyzerTrace where a phishing email really came from. Critical CVEs explainedFixed versions and checks for actively exploited flaws. Get the weekly briefingWhat to patch first, every week. Free.

This checklist is general guidance based on common incident response practice (for example NIST SP 800-61). It is not legal advice. Adapt it to your organisation, your contracts and the laws that apply to you, and involve qualified professionals for serious incidents.