Purpose


Provide a consistent response process for incidents involving:

  • AnyDesk, TeamViewer, HopToDesk, Quick Assist or similar tools

  • Fake IT/support calls

  • Social-engineering attacks

  • Suspicious remote-control sessions

  • Credentials disclosed to an unknown party

  • Unexpected MFA approvals

  • Suspicious software or commands executed on a company device

1. Roles and Ownership


IT Operations


IT Ops owns the initial response and immediate containment.


Responsibilities:


IT Ops should not attempt a deep forensic investigation independently.

Cybersecurity


Cybersecurity owns the security investigation and determination of compromise.


Responsibilities:

  • Review CrowdStrike/EDR telemetry

  • Investigate malicious processes/scripts

  • Review Entra sign-ins and identity activity

  • Investigate persistence

  • Review Microsoft 365 activity

  • Assess potential data exposure

  • Search for related indicators across the environment

  • Determine clean vs reimage

  • Determine Privacy/Legal escalation requirements

  • Approve removal of containment

IT Leadership


Notify IT leadership for:

  • P1 incidents

  • Multiple affected users/devices

  • Privileged/admin compromise

  • Significant business impact

  • Potential sensitive-data exposure

  • Confirmed data exfiltration

2. Severity


P1 – Critical


Use P1 when:

  • Attack is actively occurring across multiple systems

  • Multiple users/devices are affected

  • Administrator/privileged credentials are compromised

  • Lateral movement is suspected

  • Ransomware/destructive activity is detected

  • Significant or sensitive data appears to have been accessed/exfiltrated


Action: Immediate Cybersecurity + IT leadership escalation.

P2 – High


Use P2 when:

  • Unknown person obtained remote control

  • Credentials were disclosed

  • Unexpected MFA was approved

  • Unknown software/scripts were executed

  • Administrator privileges may have been provided

  • Suspicious sign-ins are identified

  • Persistence may exist


Action: Contain and immediately engage Cybersecurity.

P3 – Medium


Use P3 when:

  • Suspicious contact occurred but access was not granted

  • Remote software was downloaded but not used

  • Credentials/MFA were not provided

  • No evidence of malicious activity exists


Action: Investigate and document.

3. IT Ops – Initial Response


IT Ops should follow the separate:


IT Ops – Suspected Remote Access Incident: First 15 Minutes


At minimum:

  • Contact user

  • Determine what happened

  • End active attacker access

  • Contain device if appropriate

  • Protect user identity

  • Preserve evidence

  • Escalate to Cybersecurity

4. Immediate Endpoint Containment


If unauthorized remote control occurred:

  • Contain the device using CrowdStrike.


If CrowdStrike containment cannot be completed immediately:

  • Disconnect Ethernet

  • Disable Wi-Fi


Important


Do NOT:

  • Power off the device unless directed

  • Delete suspicious files

  • Clear browser history

  • Uninstall the remote-access application

  • Run cleanup tools

  • Reimage the workstation


These actions may destroy useful evidence.

5. Identity Containment


If credentials may have been exposed:

  • Reset user password

  • Revoke Entra/Microsoft 365 sessions

  • Review recent sign-ins

  • Review registered MFA/authentication methods

  • Remove unknown authentication methods

  • Temporarily block sign-in when active compromise is suspected


Require MFA re-registration when the existing MFA configuration cannot be trusted.

6. Cybersecurity Escalation Triggers


Immediately engage Cybersecurity when ANY of the following occurred:

  • Unknown party obtained remote control

  • Password was entered/shared

  • Unexpected MFA was approved

  • Commands/scripts were executed

  • Unknown software was installed

  • Administrator privileges were granted

  • Suspicious sign-ins were detected

  • Persistence is suspected

  • Company data may have been accessed

  • Multiple devices/users may be affected

7. Evidence Preservation


Collect and preserve where available:

  • User statement

  • Screenshots

  • Emails

  • Teams messages

  • Phone number/contact information used by attacker

  • Websites/URLs

  • Remote-access software name

  • Remote session ID

  • Installer files

  • Suspicious files

  • Browser download history

  • CrowdStrike telemetry

  • Windows logs

  • File hashes

  • Relevant timestamps


Document timezone when recording timestamps.

8. Build the Incident Timeline


Document:

  1. Initial contact

  2. User response

  3. Remote tool download

  4. Remote tool launch

  5. Remote-control connection

  6. Credential entry

  7. MFA activity

  8. Commands/scripts executed

  9. Software installed

  10. Files/applications accessed

  11. Network activity

  12. Containment

  13. Identity remediation


The goal is to understand exactly what occurred between initial contact and containment.

9. Endpoint Investigation – Cybersecurity


Review CrowdStrike/endpoint telemetry for:

  • Remote-access software execution

  • PowerShell

  • Command Prompt

  • Scripts

  • Child processes

  • Suspicious downloads

  • Temporary files

  • New executables

  • Network connections

  • DNS activity

  • Credential-access attempts

  • Privilege escalation

10. Persistence Review


Check for:

  • Scheduled Tasks

  • Windows services

  • Startup items

  • Registry Run/RunOnce entries

  • New local accounts

  • New local administrators

  • Additional remote-support tools

  • Browser extensions

  • Unknown scripts/executables

11. Entra / Microsoft 365 Investigation


Review:

  • Successful sign-ins

  • Failed sign-ins

  • Source IP addresses

  • Geographic locations

  • Device information

  • MFA events

  • Conditional Access results

  • Password changes

  • Authentication-method changes

  • Device registrations

  • Group membership changes

  • Privileged role assignments

12. Cloud Persistence Review


Exchange Online


Check:

  • Inbox rules

  • Mail forwarding

  • External forwarding

  • Delegates

  • Suspicious sent messages

  • Deleted messages


Entra / Microsoft 365


Check:

  • New OAuth consent

  • Enterprise applications

  • Authentication methods

  • Device registrations

  • Privileged assignments


Changing the password alone does not guarantee that cloud persistence has been removed.

13. Data Exposure Review


Review relevant Microsoft 365 audit activity.


OneDrive / SharePoint


Determine whether files were:

  • Viewed

  • Downloaded

  • Uploaded

  • Deleted

  • Shared externally


Exchange


Review:

  • Mailbox access

  • Sending activity

  • Forwarding

  • Inbox rules

  • Message deletion


Other Business Applications


Review access to systems such as:

  • Financial systems

  • HR applications

  • Administrative portals

  • POS/retail systems

  • Other systems accessible by the affected account

14. Scope Expansion / Threat Hunt


Search the environment for identified indicators:

  • IP addresses

  • Domains

  • URLs

  • File hashes

  • Remote-support session IDs

  • Remote-access applications

  • Suspicious filenames

  • Similar CrowdStrike detections

  • Related user accounts


Determine whether the incident affected additional users or devices.

15. Recovery Decision


Clean and Return


May be appropriate when:

  • Investigation explains all observed activity

  • No persistence was identified

  • No privileged execution occurred

  • Endpoint integrity can be confidently established


Reimage


Preferred when:

  • Administrator privileges were obtained

  • Unknown scripts/commands were executed

  • Persistence was identified

  • Security controls were disabled

  • Multiple unknown applications were installed

  • Endpoint integrity cannot be confidently established


Simple Rule


If we cannot confidently prove the device is clean, rebuild it.

16. Recovery Checklist


Before releasing the endpoint:

  •  Password secured

  •  Sessions revoked

  •  MFA validated

  •  Authentication methods validated

  •  Suspicious sign-ins investigated

  •  Mailbox rules/forwarding validated

  •  OAuth/application consent reviewed

  •  Endpoint investigation completed

  •  Persistence ruled out

  •  Malicious software removed or device reimaged

  •  CrowdStrike operational

  •  Data exposure assessment completed

  •  Cybersecurity approves recovery


Only then remove endpoint containment.

17. Privacy / Legal Escalation


Cybersecurity determines whether Privacy, Legal or senior leadership must be engaged.


Possible triggers:

  • Customer information accessed

  • Employee information accessed

  • Financial/payment data affected

  • Confidential business information exposed

  • Files downloaded/exfiltrated

  • Regulatory/contractual reporting may be required


IT Ops should escalate the facts and should not independently determine whether the event is legally considered a breach.

18. Incident Closure


Document in FreshService:

  • Incident summary

  • Severity

  • Root cause / likely cause

  • Timeline

  • Affected user(s)

  • Affected device(s)

  • Applications/systems affected

  • Indicators of compromise

  • Identity impact

  • Endpoint impact

  • Data-exposure determination

  • Containment actions

  • Investigation findings

  • Recovery actions

  • Business impact

  • Lessons learned

  • Follow-up actions and owners

19. User Education


After containment, review with the user:

  • Fake IT/support calls

  • Remote-access scams

  • Social-engineering warning signs

  • MFA approval risks

  • Approved IT support procedures

  • How to report suspicious activity immediately


The objective is prevention and education — not blame.

Quick Decision Matrix

What Happened? Required Response
Suspicious contact only Document and assess
Remote tool downloaded Endpoint review
Remote tool launched Endpoint + EDR review
Unknown party obtained remote control Contain + Cybersecurity
Password entered/shared Reset + revoke sessions
Unexpected MFA approved Revoke sessions + identity investigation
Unknown MFA method found Remove + re-secure MFA
Software installed Contain + Cybersecurity
Scripts/commands executed Cybersecurity investigation
Admin access provided High risk; consider reimage
Company data potentially accessed Data exposure assessment
Data exfiltration confirmed Cybersecurity + Privacy/Leadership escalation
Multiple users/devices affected P1 escalation
Endpoint integrity uncertain Reimage
No compromise found Document, recover and close

Core Rule


Remote control = contain the endpoint.
Credentials/MFA exposed = contain the identity.
Unknown commands/software = Cybersecurity investigation.
Possible company-data access = exposure assessment.
Cannot prove the endpoint is clean = rebuild it.