Playbook 002: Confirmed Suspicious Activity (Escalation & Containment)

January 26, 2026

Playbook 002: Confirmed Suspicious Activity (Escalation & Containment)

This playbook builds directly on Playbook 001.

You open it only after you’ve determined that activity is likely not normal — even if you’re not 100% certain it’s malicious.

That uncertainty is expected.

Purpose

To guide your response when:

Activity is ongoing and
Normal explanations no longer fit and
Inaction could increase risk

This playbook focuses on controlled escalation, not panic response.

Trigger (When to Use This Playbook)

Open this playbook when one or more of the following is true:

Repeated abnormal behavior across multiple time windows
A system attempts lateral movement across VLANs
Multiple alerts correlate to the same source
A system behaves outside its defined role
Blocking one path causes the behavior to shift elsewhere

This is your signal that something is actively trying — not just misbehaving.

Context (Confirm the Scope)

Before acting, clearly define how big the problem is.

Write down:

Affected systems
- One host or many?
- Workstation, server, or management system?
Affected layers
- Network only?
- Identity (accounts)?
- Endpoint behavior?
- Logging visibility?
Trust boundaries crossed
- User → server?
- Server → management?
- Lab → external?

This prevents overreaction and underreaction.

Actions (Escalated but Controlled)

Step 1: Increase Visibility

Before blocking anything new:

Expand SIEM time range
Look for failed attempts as well as successful ones
Check for authentication anomalies
Look for similar behavior from other systems

You are answering:

“Is this isolated, or spreading?”

Step 2: Contain at the Lowest Effective Layer

Containment should match the problem.

Preferred order:

Network rules (block specific traffic)
Account controls (disable or restrict)
VLAN isolation
System isolation

Avoid:

Rebuilding systems
Powering off hosts
Deleting evidence

Containment is about control, not cleanup.

Step 3: Preserve Evidence Explicitly

Do this before remediation.

Take VM snapshots
Export relevant logs
Record:
- What you saw
- When you saw it
- What changed after containment

This step turns incidents into lessons instead of mysteries.

Step 4: Stabilize the Environment

Once behavior stops:

Verify no new alerts appear
Confirm normal services are still functional
Watch for delayed or secondary activity

You are not “done” yet — you are steady.

Step 5: Decide on Recovery

Ask:

Can this system be trusted as-is?
Is forensic learning more valuable than speed?
Is rebuild necessary, or optional?

Recovery options:

Restore from snapshot
Patch and harden
Credential resets
Full rebuild (last resort)

Make this a deliberate choice, not a reflex.

Outcome (What Success Looks Like)

You’re finished when:

Suspicious activity has stopped
Impact is limited
Visibility is intact
Evidence is preserved
A clear next step is documented

Certainty is not required.
Control is.

After-Action Review (Mandatory, Even in a Lab)

Answer honestly:

What triggered escalation?
What signals mattered most?
What slowed you down?
Where did you hesitate?
What should Playbook 001 or 002 clarify?

Update both playbooks if needed.

That loop is intentional.

How Playbook 001 and 002 Work Together

Think of them like gears:

Playbook 001 = Detection & Orientation
Playbook 002 = Escalation & Control

You should always enter through Playbook 001.
Playbook 002 is earned through evidence, not fear.

Why This Second Playbook Matters for Beginners

Most new operators fail in one of two ways:

They freeze and do nothing
They overreact and destroy evidence

This playbook teaches a third path:

Observe
Contain
Learn
Improve

That’s the core skill this lab is designed to build.

*Key Takeaway's

You don’t need perfect certainty to act.
You need structure, proportional response, and documentation.

These playbooks give you all three.

Virtology