🌐
Web Application Compromise
Exploitation of web application vulnerabilities such as injection flaws, authentication bypasses, or server-side request forgery leading to unauthorized access.
25 runbook nodes8 lifecycle stages covered
Triage
(3 nodes)Containment
(2 nodes)Preservation
(3 nodes)Collection
(5 nodes)EDR Telemetry Collection
P2EDR Collection
120min
View node
M365 Unified Audit Log Collection
P2M365 UAL Collection
90min
View node
Identify Alternative Evidence When Primary Logs Are Missing
P2Missing Log Fallback
60min
View node
Collect and Analyze Web Server Logs for Web App Compromise
P2Web Server Logs
90min
View node
Coordinate Log Collection from Third-Party Vendors
P3Third-Party Logs
120min
View node
Analysis
(2 nodes)Eradication
(5 nodes)Remove Malware, Backdoors, and Persistence Mechanisms
P1Malware Removal
120min
View node
Comprehensive Persistence Mechanism Sweep
P1Persistence Hunt
120min
View node
Eradication Verification Checklist
P1Eradication Verification
90min
View node
Patch Exploited Vulnerabilities to Prevent Re-Compromise
P2Patch Vulnerability
60min
View node
Post-Incident Configuration Hardening
P2Config Hardening
180min
View node