# Draft playbook — INC-2026-0903

*This is a draft assembled from stored records. Nothing in it has been adopted, approved or signed off by anyone. Adoption is a registered action that goes through policy evaluation and leaves its own audit record; if this document were adopted, that record — not this file — would be the evidence of it.*

- **Incident:** `INC-2026-0903`
- **Document:** playbook (draft)
- **Generated:** 2026-10-30T05:29:19.495037+00:00
- **Source:** https://265d0hsmwa.execute-api.us-east-1.amazonaws.com/api/v1/incidents/INC-2026-0903/draft/playbook/export

## What this was *(draft)*

- ws-0148 is beaconing to a command-and-control host and has begun moving laterally: new SMB peers, then a scheduled task. (confidence 0.86)
  - *evidence:* `INC-2026-0903#hypothesis-0`, `SEC-0003-a`, `SEC-0003-b`, `SEC-0003-c`, `SEC-0003-d`

## How it unfolded *(draft)*

- network_flow:ws-0148->198.51.100.74:8443 — outbound every 60s ± 2s to a destination never seen before
  - *evidence:* `INC-2026-0903#chain-0`, `SEC-0003-a`, `SEC-0003-b`
- host:ws-0148 — SMB opened to two hosts never previously contacted
  - *evidence:* `INC-2026-0903#chain-1`, `SEC-0003-c`
- process:app-07/schtasks — scheduled task created on app-07 from a remote session
  - *evidence:* `INC-2026-0903#chain-2`, `SEC-0003-d`

## What to do *(draft)*

- 1. isolate_host — rollback: rejoin_network; authorisation: not scored for this incident yet
  - *evidence:* `INC-2026-0903#plan-1`
- 2. block_ip — rollback: unblock_ip; authorisation: not scored for this incident yet
  - *evidence:* `INC-2026-0903#plan-2`

## How to tell it worked *(draft)*

- network should read isolated after step 1
  - *evidence:* `INC-2026-0903#plan-1`
- edr should read reachable after step 1
  - *evidence:* `INC-2026-0903#plan-1`
- traffic_from_ip should read denied after step 2
  - *evidence:* `INC-2026-0903#plan-2`

## Provenance

Every assertion above cites the records it rests on; 10 distinct reference(s) in total.

Audit records for this incident, against which the above can be reconstructed:

- `2026-10-19T00:23:18.417144+00:00 · escalation · dharma — escalated — isolate_host scores 55 → senior approval`
- `2026-10-19T00:23:18.417137+00:00 · observation · agent:analyst — diagnosed — destination absent from backup inventory — the backup reading does not hold`
- `2026-10-19T00:23:18.417129+00:00 · observation · agent:sentinel — correlated — beacon, new SMB peers and remote task creation on one host within 90 minutes`
- `2026-10-18T23:53:18.416639+00:00 · observation · drishti — scheduled task created on app-07 by a remote session`
- `2026-10-18T23:43:18.416639+00:00 · observation · drishti — ws-0148 opened SMB to fs-02 and app-07, neither contacted before`
- `2026-10-18T22:34:58.416639+00:00 · hypothesis · buddhi — A backup agent is running on its schedule. (9%) · ruled out by SEC-0003-e, SEC-0003-c, SEC-0003-d`
- `2026-10-18T22:34:58.416639+00:00 · hypothesis · buddhi — ws-0148 is beaconing to a command-and-control host and has begun moving laterally: new SMB peers, then a scheduled task. (86%)`
- `2026-10-18T22:33:18.416639+00:00 · observation · drishti — connections every 60s ± 2s for 96 minutes — machine-timed, not human`
- `2026-10-18T22:24:58.416639+00:00 · observation · drishti — 198.51.100.74 is not in the backup infrastructure inventory`
- `2026-10-18T22:23:18.416639+00:00 · observation · drishti — outbound to 198.51.100.74:8443, a destination no host has used before`

*Exported documents do not update. An incident can reopen, a verification can land and an execution can be rolled back after this was written, and nothing on this page would show it. Check the references against the source before relying on it.*

*Adopting this would require the registered action `adopt_playbook`, which is scored and routed through policy evaluation like any other action. This file is not that.*