Security playbooks for modern operators.
Two field-ready collections from the GreyNOC detection-engineering team — eighteen detection & response playbooks spanning initial access to impact, and twenty covering the post-quantum / E2EE cryptographic transition and AI-system security — structured for operators responsible for detection, investigation, containment, and recovery.
Built for operators accountable for the outcome.
Every playbook follows the same 13-section format: overview, MITRE ATT&CK mapping, detection strategy, key indicators, sample logic, example data, investigation steps, false positives, tuning, response actions, escalation criteria, analyst-notes template, and summary.
Behavior over signature
Detections are framed by what the attacker actually does — fan-out, periodicity, sequence — not by IOCs that rotate.
Portable logic
Sample rules are JSON-shaped pseudocode, ready to translate to KQL, SPL, EQL, Sigma, or your platform of choice.
Operationally honest
False positives, tuning paths, and escalation criteria sit alongside the detection logic. Nothing ships without them.
Detection & Response
18 playbooks · initial access → impactPassword Spraying
Low-volume, high-fan-out authentication abuse against identity providers — visible only when failures aggregate across the user dimension.
Brute Force Attack
High-volume password guessing against a single account or service. Noisy, but still a top vector for SSH, RDP, and VPN concentrators.
Distributed Port Scan
Multi-source coordinated reconnaissance that evades per-IP thresholds. Detection has to pivot to the destination dimension.
Credential Stuffing
Leaked-credential replay against web and SaaS logins — high-volume, automation-driven, and low per-account failure.
Impossible Travel
Geographic-velocity impossibilities fused with sign-in risk features into a single composite identity signal.
Privilege Escalation
Elevation across identity, endpoint, and cloud — role grants, token abuse, and local privilege exploits.
Suspicious PowerShell
Encoded, in-memory, and oddly-parented PowerShell abuse — the workhorse of hands-on-keyboard intrusions.
Malware Beaconing
Periodic C2 check-in traffic surfaced by geometry: periodicity, shape, and destination character over payload.
AI / Automated Agent Abuse
Adversary automation and abuse of owned AI features and agents — mapped to MITRE ATLAS as well as ATT&CK.
Coordinated Multi-Stage Attack
Kill-chain correlation that links weak, individually-benign signals across entities into one incident.
Phishing
Malicious email delivery — credential lures, AiTM/MFA-bypass kits, quishing, and post-delivery retro-hunting.
Business Email Compromise
Post-compromise mailbox abuse — inbox rules, auto-forwarding, delegate additions, and malicious OAuth consent.
Lateral Movement
Host-to-host propagation surfaced by first-time authentication edges and Windows logon-type anomalies.
AD Credential Theft
Kerberoasting, AS-REP roasting, DCSync, and LSASS dumping against Active Directory.
Persistence Mechanisms
Footholds that survive reboot — scheduled tasks, services, run keys, WMI subscriptions, and rogue accounts.
Web Shell
Implants dropped in the webroot after exploitation of a public-facing app — process lineage and traffic anomalies.
Data Exfiltration
Staging and theft — archive bursts, egress-volume anomalies, and cloud or alternative-protocol transfers.
Ransomware
Recovery-inhibition precursors and mass-encryption impact. Detect early, or measure the damage.
AI · Post-Quantum · E2EE
20 playbooks · crypto transition, AI security & authorized testingCryptographic Inventory & PQC Readiness
CBOM discovery, AI/LLM-assisted code auditing, and crypto-agility scoring for the PQ migration.
Harvest-Now-Decrypt-Later Exposure
Bulk-capture detection and prioritization of long-shelf-life data at risk from future decryption.
Hybrid TLS / KEM Downgrade
PQ key-exchange stripping, negotiation downgrade, and middlebox tampering of hybrid handshakes.
E2EE Messaging Protocol Security
Double Ratchet, PQXDH, PQ3, and MLS — key-transparency and man-in-the-middle detection.
PQ Signature & Token Integrity
ML-DSA / SLH-DSA / FN-DSA across JWT, SAML, and X.509 — algorithm-confusion defense.
AI-Augmented Detection & Guardrails
LLM-assisted triage with pipeline-poisoning and prompt-injection defense, mapped to MITRE ATLAS.
Bug Bounty: PQC/E2EE Methodology
Authorized recon → crypto-surface mapping → validation → reporting, bound by rules of engagement.
Bug Bounty: Crypto Implementation Defects
Authorized hunting of migration, downgrade, and oracle defect classes in crypto implementations.
PQ VPN, IPsec & SSH Migration
Hybrid PQ key exchange for IKEv2/IPsec, OpenSSH, and WireGuard — tunnel inventory, downgrade detection, migration.
PQ PKI & Certificate Lifecycle
ML-DSA CA hierarchies, composite/hybrid certs, CT-log mis-issuance monitoring, and revocation at PQ scale.
PQ Code Signing & Firmware Integrity
LMS/XMSS firmware signing and ML-DSA software supply chain — the signatures that can't wait for the CRQC.
PQ E2EE for Real-Time Media
WebRTC/DTLS-SRTP, SFrame, and MLS calls — downgrade, key-substitution, and ghost-participant detection.
Crypto-Agility & PQ Migration Ops
Running the migration: agility architecture, wave rollout, rollback gates, and the algorithm-break runbook.
Quantum Risk Governance & Compliance
Mosca's inequality, CNSA 2.0 / NSM-10 mandates, and evidence-backed compliance reporting.
Bug Bounty: AI & LLM Attack-Surface Methodology
Trust-boundary mapping, canary and trial-ledger harness, and the security-vs-model-safety routing decision.
Bug Bounty: LLM Application-Layer Defects
Prompt injection, retrieval scope, output handling, session isolation, and app-level authorization.
Bug Bounty: AI Supply Chain & Model Artifacts
Artifact provenance, registry and namespace abuse, build pipelines, and classical-only signing gaps.
Bug Bounty: Agentic Systems, Tools & the MCP Boundary
Tool-metadata poisoning, confused-deputy delegation, connector scope, and autonomy limits.
Bug Bounty: Model Behavior & Safety-Boundary Testing
Routing to model-safety channels, eval-grade measurement, and proving a control failure without producing harm.
Bug Bounty: Inference Infrastructure & Multi-Tenant Isolation
Serving control plane, tenant routing, cache leakage, quota controls, and inference-path transport.