🌐 Web Application Compromise
Exploitation of web application vulnerabilities such as injection flaws, authentication bypasses, or server-side request forgery leading to unauthorized access.
25 procedures8 lifecycle stages
Triage
(3 procedures)Containment
(2 procedures)Network Isolation of Compromised Systems
Network Isolation
30min
View procedure
Credential and Account Lockdown
Account Lockdown
45min
View procedure
Sponsored
Preservation
(3 procedures)Collection
(5 procedures)EDR Telemetry Collection
EDR Collection
120min
View procedure
M365 Unified Audit Log Collection
M365 UAL Collection
90min
View procedure
Identify Alternative Evidence When Primary Logs Are Missing
Missing Log Fallback
60min
View procedure
Collect and Analyze Web Server Logs for Web App Compromise
Web Server Logs
90min
View procedure
Coordinate Log Collection from Third-Party Vendors
Third-Party Logs
120min
View procedure
Analysis
(2 procedures)Eradication
(5 procedures)Remove Malware, Backdoors, and Persistence Mechanisms
Malware Removal
120min
View procedure
Comprehensive Persistence Mechanism Sweep
Persistence Hunt
120min
View procedure
Eradication Verification Checklist
Eradication Verification
90min
View procedure
Patch Exploited Vulnerabilities to Prevent Re-Compromise
Patch Vulnerability
60min
View procedure
Post-Incident Configuration Hardening
Config Hardening
180min
View procedure