Active Adversary Playbook
Responding to a live human operator in your network — intelligence gathering before containment, the controlled observation window, and simultaneous eviction when you're ready to move.
Your threat hunting team finds a Cobalt Strike beacon. The last command executed on the beacon was 2 hours ago: net group "Domain Admins" /domain. The attacker is doing reconnaissance — they haven't deployed ransomware yet. This is the most dangerous and most opportunity-rich moment in any incident. You can observe them for 30-60 minutes and learn exactly what they're targeting. Or you can contain immediately and prevent any further damage. The wrong choice in either direction is catastrophic: wait too long and they exfiltrate the crown jewels or deploy ransomware; move too early and you miss the full scope and they re-establish access through a backdoor you didn't know about. This playbook explains how to navigate this decision.
Observe vs. Contain Decision Framework
| Factor | Favor controlled observation | Favor immediate containment |
|---|---|---|
| Current attacker activity | Reconnaissance/lateral movement — not actively exfiltrating or deploying destructive tools | Active exfiltration of sensitive data, or pre-ransomware staging detected |
| Scope confidence | Less than 50% confident you know the full scope — observation will reveal more | High confidence you have full scope — observation adds minimal new information |
| Known attacker TTP | Unknown attacker — observation reveals TTPs for future hunting | Known ransomware operator — their next step is predictable (deploy ransomware) |
| Time since beacon first active | Recent beacon (hours-days) — attacker hasn't had time to establish many backdoors yet | Long-lived beacon (>2 weeks) — attacker has had extensive time to establish redundant persistence |
| Legal / regulatory sensitivity | Not handling highly regulated data (PII/PHI/PCI on exposed systems) | Active access to highly regulated data systems — every minute of observation is a minute of potential breach |
Controlled Observation Protocol
If you decide to observe, do it with discipline: set a time limit, define the stop condition (what triggers immediate containment), and have the containment action staged and ready to execute in under 60 seconds.
Controlled Observation Protocol
═══════════════════════════════════════════════════════════════════
PRE-OBSERVATION SETUP (before letting attacker continue):
├── All containment actions staged and ready to fire simultaneously
│ (EDR bulk isolation list ready, network blocks ready to deploy)
├── All IR team members briefed on their specific containment task
├── SIEM real-time monitoring on attacker's known C2 and host activity
└── Designated decision-maker on call for immediate stop decision
OBSERVATION WINDOW: max 60 minutes
IMMEDIATE STOP CONDITIONS (trigger containment if any occur):
├── Attacker begins file access on sensitive data repository
├── Attacker begins deploying new tools to additional hosts
├── Attacker begins pre-ransomware staging (copying/staging files)
├── Attacker runs commands suggesting they've detected the IR team
│ (searching for incident-related file names, looking for new processes)
└── Timer expires
WHAT TO DOCUMENT DURING OBSERVATION:
├── Every command executed (from EDR command line telemetry)
├── Every host connected to (lateral movement scope)
├── Every file accessed or created
└── C2 communication patterns (beaconing frequency, domain/IP)
AT STOP: simultaneous containment (see Ch06 simultaneous containment)
The Eviction Sequence
When you're ready to evict an active adversary, the sequence is simultaneous and complete. Partial eviction gives them time to burn the environment.
# STEP 1: Pre-stage — gather all device IDs before taking any action
# (Any action you take during staging tips off the attacker)
# CrowdStrike — resolve all hostnames to device IDs (do this silently)
$compromisedHosts = @(
"LAPTOP-JSMITH", "SERVER-FILES01", "SERVER-DC02", "LAPTOP-MWILLIAMS"
)
# Store device IDs in memory — don't trigger any action yet
# STEP 2: Pre-stage network blocks (prepare but don't commit)
# Document: firewall rule commands, DNS sinkhole entries, VLAN changes
# Have a second engineer ready to execute each in parallel
# STEP 3: Coordinate — T-5 minute brief
Write-Host "=== T-5 MINUTES — Final Brief ===" -ForegroundColor Red
Write-Host "PERSON A: CrowdStrike bulk isolation — ready to execute"
Write-Host "PERSON B: Firewall C2 block — ready to commit"
Write-Host "PERSON C: Identity team — account disables queued"
Write-Host "PERSON D: DNS sinkhole — ready to apply"
Write-Host ""
Write-Host "On my mark — SIMULTANEOUS EXECUTION"
Write-Host "MARK at $(Get-Date).AddMinutes(5)"
# STEP 4: MARK — All actions fire simultaneously
# Person A: EDR bulk isolation
# Person B: Firewall block
# Person C: Account disable + token revoke
# Person D: DNS sinkhole
# Post-execution: confirm within 2 minutes
# EDR console: check isolation status
# Firewall: verify rule applied
# AD: confirm accounts disabledPost-Eviction Actions
Eviction is not eradication. The eviction cuts the active adversary's access. Eradication (Ch10-Ch12) removes everything they left behind.
| Time after eviction | Action |
|---|---|
| T+0 | Confirm all beacons are silent — EDR shows no C2 traffic from contained hosts |
| T+30 min | Hunt for additional beacons on non-contained hosts — did the eviction reveal any new C2? |
| T+2 hours | Begin persistence hunt on all contained hosts (Ch10 checklist) |
| T+4 hours | Scope validation — compare DC logs against contained host list, any missed hosts? |
| T+24 hours | Full eradication validation (Ch12 checklist) |
| T+72 hours | Threat intelligence: attributed TTP to known group? Update SIEM with attacker-specific detections |
Even when you contain immediately, you've just collected the most valuable intelligence available about this specific attacker in your specific environment. The commands they ran, the tools they used, the accounts they targeted, the data they looked for — all of this is now in your EDR telemetry. Treat it as a research gift. The post-eviction threat intelligence work — mapping observed TTPs to MITRE ATT&CK, identifying the threat group, writing specific detections for their tools — directly improves your ability to detect the same actor if they return. Most IR teams do this investigation for containment and forensics purposes but never codify it as new detection rules. Don't let that intelligence expire unbuilt.
Q & A
Q: During the observation window, the attacker runs a command that looks like they're searching for specific files. How do you know whether to stop the observation immediately?
Stop immediately if: the file search is clearly targeting sensitive data repositories (finance shares, HR documents, PII databases) AND the attacker is actively reading or copying, not just enumerating. A directory listing of sensitive folders is concerning but not yet data exfiltration. A large file copy to an external IP is exfiltration — stop immediately. If you're unsure, apply the precautionary principle: when in doubt, contain. The observation window's purpose is to reveal scope, not to watch data leave. Any action that causes direct harm is worth stopping even if it means ending the observation early.
Q: The attacker appears to have detected the IR team and has gone quiet — the beacon stopped beaconing. What does this mean and what do you do?
When a sophisticated attacker goes quiet after IR activity starts, they typically: (1) switch to a backup C2 channel (different protocol, different domain), (2) go into low-and-slow mode — reducing beacon frequency to avoid detection, (3) prepare for destructive action (pre-stage ransomware or data deletion tools), or (4) start lateral movement to a host outside your current scope. The correct response: immediately switch from observation mode to full containment. The intelligence opportunity is gone. Contain all known compromised hosts simultaneously, run the full secondary compromise hunt (Ch11), and treat "silence" as "escalated threat posture." Do not interpret silence as the attacker leaving — experienced IR practitioners call this "the quiet before the ransomware."