The first hour decides how much an incident will cost. Most of the damage done in that hour does not come from the attacker. It comes from well-meant actions: a reboot, a clean-up, a restore from backup over the top of the evidence.
This checklist is for the people who notice the problem first. It takes no special tools.
1. Write down the time and what you saw
Before anything else, note the time, the machine, the account and what exactly looked wrong. Take a photo of the screen with a phone. Later nobody will remember whether the strange window appeared before or after the restart, and the timeline is built from exactly these details.
2. Isolate, do not switch off
Disconnect the machine from the network: pull the cable, turn off Wi-Fi, or isolate it in your EDR console. Leave it powered on.
Memory holds what the disk does not: running processes, network connections, encryption keys. Once the power is cut, that evidence is gone.
3. Do not log in as an administrator
It is tempting to log in to the affected machine with a domain administrator account "just to look". If the attacker is still there, you have handed over the most valuable password in the company. Use a local account, or do not log in at all.
4. Preserve before you clean
Do not reinstall, do not run a full antivirus clean-up, do not restore a backup over the affected system. If it is a virtual machine, take a snapshot. Make sure the logs of mail, VPN, firewall and domain controllers are not rotated away: extend their retention now.
5. Call over a channel the attacker cannot read
If mail may be compromised, do not discuss the incident by mail. Use the phone or a messenger that is not tied to the corporate accounts. The same goes for calling the response team.
6. One person decides
Name one coordinator. Everyone else reports to that person and does nothing to the affected systems without their word. Every decision is written down with a time.
If it is ransomware: do not negotiate and do not pay in the first hour, do not delete the encrypted files and keep the ransom note. All three are evidence, and some files can be recovered later.
What to prepare before it happens
| Prepare | Why |
|---|---|
| A printed contact list | The address book may be on the encrypted server |
| A named coordinator and a deputy | Nobody argues about who decides |
| A retainer with a response team | The response time is guaranteed, the paperwork is already signed |
| Log retention of 90 days or more | The attacker was usually inside long before you noticed |
An incident cannot be scheduled, but the first hour can be rehearsed. A tabletop exercise takes half a day and shows who does what while nothing is on fire yet.
