Inside the Cyber War Room: Walking Through the Incident Response Lifecycle in a Real-World Breach

It's 2:14 AM on a Tuesday. Your phone screen blasts bright blue, vibrating furiously on your nightstand. It's PagerDuty. You roll over, blink away the sleep, and check the alert:

Mass file modification on FS-EAST-02 followed by Shadow Copy deletion.

Two minutes later, you're in the virtual war room. The SOC analyst on shift is watching domain controllers lock up one by one. Network shares are turning into .locked extensions, and the ransomware note sitting on desktop screens demands 40 Bitcoin.

This isn't a textbook exercise. This is a real-world breach, and right now, the only thing standing between your organization and total operational destruction is your Incident Response (IR) framework , and how well your team can execute it under extreme pressure.

Here is what actually happens inside the war room when a major breach hits, how to navigate the IR lifecycle step-by-step, and how to use these concepts to crush your CompTIA Security+.

NIST vs. SANS: Choosing Your Battle Map

Before diving into the fight, you need a mental map of the terrain. Industry standards rely primarily on two IR frameworks: NIST SP 800–61 Rev. 2 and the SANS Institute 6-Step Model.

Both share the exact same tactical goals, but they chunk their phases differently.

NIST condenses Containment, Eradication, and Recovery into a single fluid phase, emphasizing that IR is an iterative loop rather than a straight line.

SANS breaks them into individual distinct steps, which many analysts find easier to memorize for certifications.

Step-by-Step Walkthrough: The HealthTech Solutions Breach

Let's ground this in a real scenario.

• Target: HealthTech Solutions (e-commerce healthcare provider)
• The Threat: Ransomware deployment via adversary-in-the-middle (AiTM) VPN bypass.
• The Clock: T-0 is 02:00 AM.

Phase 1: Preparation (Before the Storm)

Incident response doesn't start when the alarm rings; it starts months prior.

HealthTech had three key foundational controls in place before T-0:

• Logging Pipeline: Centralized Syslog forwarding local host logs, firewall state tables, and EDR agents into Splunk.
• Storage Resilience: Immutable, air-gapped offsite S3 backup buckets with Object Lock enabled (preventing attackers from deleting backups even with Admin rights).
• Escalation Roster: A clear On-Call Cyber Incident Response Team (CSIRT) contact tree mapping out SOC Leads, Sysadmins, PR/Legal, and Executive Leadership.

Phase 2: Detection & Analysis (02:14 AM — 03:00 AM)

The SOC analyst triggers an alert showing suspicious command-line execution (vssadmin.exe delete shadows /all /quiet) on an endpoint server.

[SIEM Alert - High Severity]
Timestamp: 2026-09-03T02:12:44.001Z
Host: SEC-FINANCE-01
User: HEALTHTECH\j.doe_admin
Process: C:\Windows\System32\cmd.exe /c vssadmin.exe delete shadows /all /quiet
Parent Process: C:\Windows\System32\powershell.exe
Destination IP: 185.220.101.5 (Known Tor Exit Node)

[SIEM Alert - High Severity]
Timestamp: 2026-09-03T02:12:44.001Z
Host: SEC-FINANCE-01
User: HEALTHTECH\j.doe_admin
Process: C:\Windows\System32\cmd.exe /c vssadmin.exe delete shadows /all /quiet
Parent Process: C:\Windows\System32\powershell.exe
Destination IP: 185.220.101.5 (Known Tor Exit Node)

Command Breakdown

• C:\Windows\System32\cmd.exe /c Launches the Windows Command Prompt, executes the string of commands that follows (/c), and immediately closes the prompt window.
• vssadmin.exe Runs the Volume Shadow Copy Service administrative tool, a built-in Windows utility used to manage system backup copies (Shadow Copies).
• delete shadows Instructs the service to delete Volume Shadow Copies—which store historical snapshots of your files, system settings, and previous versions of data.
• /all Specifies that every shadow copy on all volumes/drives across the entire machine should be deleted.
• /quiet Executes the deletion silently in the background without prompting the user for confirmation (e.g., asking "Are you sure? [Y/N]").

Connecting the Dots:

1. Initial Access: Analysis of VPN logs reveals user j.doe authenticated from a foreign IP at 01:45 AM. The user was hit with an AiTM phishing attack hours earlier that captured both their password and session cookie, completely bypassing push-notification MFA.
2. Lateral Movement: The attacker leveraged harvested domain admin credentials from memory (LSASS dump) to move laterally via Server Message Block (SMB / Port 445) across FS-EAST-02 and financial endpoints.
3. C2 Traffic: Wireshark packet captures confirm encrypted outbound Beaconing over HTTPS (Port 443) to external IP 185.220.101.5.

Phase 3: Containment, Eradication & Recovery (03:00 AM — 08:00 AM)

1. Short-Term Containment

• Isolate Network Segments: EDR agents automatically isolate SEC-FINANCE-01 and FS-EAST-02 from the network at the host level while preserving volatile memory (RAM) for forensic capture.
• VLAN Quarantine: Core network engineers drop the infected subnet into a blackhole/quarantine VLAN via managed switch ports to stop lateral propagation over SMB.

2. Eradication

• Kill Session Tokens & Credentials: AD Admins execute a force password reset twice across all Domain Admin accounts (invalidating the Kerberos krbtgt password hash to prevent Golden Ticket attacks).
• Revoke VPN Sessions: Active session keys are purged at the firewall boundary; conditional access rules are updated to require FIDO2 hardware keys (WebAuthn) instead of push notifications.
• Malware Removal: EDR remediation tasks purge malicious persistence keys established in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

3. Recovery

• Rebuild vs. Restore: Infected endpoint images are completely wiped and redeployed via baseline PXE boot templates.
• Data Recovery: File shares are restored from the immutable off-site S3 backups validated against pre-breach timestamps (01:00 AM snapshot).
• System Monitoring: Restored hosts run elevated EDR logging in "blocking mode" for 72 hours before being re-introduced to production traffic.

Phase 4: Post-Incident Activity (Day 2 & Beyond)

Within 48 hours, the CSIRT Lead hosts the Lessons Learned (Post-Mortem) meeting.

1. Root Cause Analysis (RCA): The entry point was an unphishable-vulnerable MFA implementation on the legacy VPN portal.
2. Action Items: Transition all remote access controls to FIDO2 WebAuthn keys; enforce device-compliance checks (Host Attestation) prior to VPN authorization.
3. Regulatory Reporting: Because HealthTech handles healthcare data, Legal files formal disclosures with federal regulators and notifies affected customers within mandatory statutory windows (e.g., HIPAA / GDPR guidelines).

The Technical Deep Dive: Investigating the Entry Point

When analyzing host activity during an incident, knowing where to look in Windows Event Logs or CLI is essential. Here is the actual forensic artifact path from SEC-FINANCE-01:

1. Windows Event ID 4624 (Successful Logon)

Look for Logon Type 10 (Remote Desktop) or Logon Type 3 (Network / SMB Access) originating from non-standard internal addresses or unexpected VPN IP pools:

<EventData>
  <Data Name="SubjectUserName">SYSTEM</Data>
  <Data Name="TargetUserName">j.doe_admin</Data>
  <Data Name="LogonType">3</Data>
  <Data Name="WorkstationName">WORKSTATION-X</Data>
  <Data Name="IpAddress">10.2.14.88</Data>
  <Data Name="IpPort">51204</Data>
</EventData>

<EventData>
  <Data Name="SubjectUserName">SYSTEM</Data>
  <Data Name="TargetUserName">j.doe_admin</Data>
  <Data Name="LogonType">3</Data>
  <Data Name="WorkstationName">WORKSTATION-X</Data>
  <Data Name="IpAddress">10.2.14.88</Data>
  <Data Name="IpPort">51204</Data>
</EventData>

2. Emergency Host Isolation Command (PowerShell)

If an EDR agent is unresponsive, you can rapidly isolate a host at the OS level using native netsh commands or EDR CLI binaries:

# Block all inbound/outbound traffic except to the IR Incident Handler IP
netsh advfirewall firewall add rule name="IR_ISOLATION_IN" dir=in action=block
netsh advfirewall firewall add rule name="IR_ISOLATION_OUT" dir=out action=block
netsh advfirewall firewall add rule name="IR_ALLOW_HANDLER" dir=out action=allow remoteip=10.100.0.50

# Block all inbound/outbound traffic except to the IR Incident Handler IP
netsh advfirewall firewall add rule name="IR_ISOLATION_IN" dir=in action=block
netsh advfirewall firewall add rule name="IR_ISOLATION_OUT" dir=out action=block
netsh advfirewall firewall add rule name="IR_ALLOW_HANDLER" dir=out action=allow remoteip=10.100.0.50

Security+ Exam Cheat Sheet

If you are studying for CompTIA Security+ (SY0–701) , pay close attention to these high-frequency concepts directly illustrated by this scenario:

• Containment vs. Eradication:

Containment stops the attack from spreading (e.g., pulling a network cable, applying a VLAN lock, or isolating a host via EDR). It does not remove the malware.

Eradication neutralizes the threat permanently (e.g., deleting malware binaries, purging malicious scheduled tasks, revoking compromised AD user accounts).

• Volatile Memory Preservation (Order of Volatility):

Always capture RAM before rebooting or powering off an infected machine. Rebooting destroys critical forensic evidence stored in volatile memory (like injection payloads, unencrypted process artifacts, and live C2 socket connections). Order: CPU Cache/Registers → RAM → Network State → Disk/Storage → Optical/Backups.

• Chain of Custody:

When preserving forensic evidence (disk images, memory dumps), log who collected it, when it was collected, the exact hash value (SHA-256) at capture, and where it was securely stored. If the hash changes, the evidence is legally tampered with.

• Adversary-in-the-Middle (AiTM) vs. Traditional Phishing:

Standard OTP/Push MFA can be bypassed using proxy frameworks (like Evilginx) that sit between the victim and the legitimate login portal to capture session cookies. Mitigation: FIDO2 / WebAuthn hardware security keys.