Network Breach Response Checklist
An attacker came in through the VPN or another edge device and moved inside. Thirty steps to triage the appliance, keep the evidence a reboot would destroy, isolate segments, evict the attacker from Active Directory and make sure they stay out.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
A working checklist for a network intrusion: triage the edge device, preserve volatile evidence before anything is rebooted, isolate segments, evict the attacker from Active Directory (tier-0 review, krbtgt double reset), block command-and-control in one coordinated move, rebuild rather than clean, and watch closely afterwards. Mark each step and generate a record of what was done, by whom and when.
Your context
1. Edge device triage
Most network intrusions now start at an internet-facing appliance: a VPN, firewall, load balancer or file-transfer gateway. Treat the device as a suspect, not as a sensor you can trust.
Check every internet-facing appliance against current vendor advisories and known-exploited vulnerability lists, and record firmware versions as foundNIST SP 800-61r3material
Run the vendor's integrity check (or an external one) and compare file hashes and running processes against a known-good buildmaterial
Confirm the management interface is not exposed to the internet, and list every admin account and API key on the device
Export the running configuration and diff it against the last known-good backup
Identify every other device of the same make and version, including spares, DR sites and devices run by a managed provider
2. Preserve volatile evidence before reboot
A reboot, patch or factory reset of an appliance usually destroys the attacker's in-memory tooling and recent logs. Capture first, then change things — unless damage is happening right now.
Capture memory and disk images (or the vendor's supported diagnostic snapshot) from compromised appliances and key servers before any reboot or patchmaterial
Pull firewall, VPN, proxy, DNS and authentication logs off the devices to a separate, write-protected store, and extend retentionmaterial
Preserve NetFlow / VPC flow logs and any packet captures covering the suspected window
Hash every evidence file, record who collected it and when, and keep a chain-of-custody logISO/IEC 27037
Record the time sources and time zones of every log source so events can be lined up
3. Isolate segments
Decide per segment: isolate now, contain and monitor, or fully disconnect. Isolating too early can tip off the attacker; too late lets them spread.
Make and record an isolation decision for each affected segment, with the reason and who approved itmaterial
Take the compromised edge appliance out of service or restrict it to a minimal, monitored function, with an alternative access path for staffmaterial
Restrict outbound internet from servers to only what they need (default-deny egress on the affected segments)
Set up an out-of-band channel for the response team (separate email/chat and accounts) on the assumption the attacker can read internal mail
If OT or plant networks connect to the affected IT segments, involve operations and decide on the IT/OT conduit with safety first
4. Active Directory / domain compromise
If the attacker reached a domain controller or a tier-0 account, assume they can create credentials at will until the eviction is complete.
Check for domain compromise: DCSync / replication requests from non-DCs, NTDS.dit access, new domain admins, changed AdminSDHolder or GPOsmaterial
Review tier-0: Domain/Enterprise/Schema Admins, built-in Administrators, DC computer objects, AD CS, Entra Connect / sync servers, backup servers, and anyone who can manage themmaterial
Reset all tier-0 and service-account passwords from a clean admin workstation, after attacker access is cut, in one coordinated windowmaterial
Reset the krbtgt account twice, waiting for replication and at least the maximum ticket lifetime (10 hours by default) between resetsmaterial
Hunt for persistence: scheduled tasks, services, GPO scripts, new trusts, SID history, certificate templates and rogue certificates, WMI subscriptions
Check the cloud identity side: sync accounts, federation settings, app registrations and privileged roles in your cloud directory
5. Command-and-control and eviction
Build an indicator list (IPs, domains, hashes, user agents, JA3/JA4 fingerprints) from the evidence and threat intelligence
Sweep EDR, DNS and proxy logs for the indicators across the whole estate, not only the known hosts
Block C2 at DNS, proxy and firewall in a single coordinated eviction, together with the credential resetsmaterial
Look for secondary access: other remote-access tools, new VPN accounts, cloud tunnels, scheduled beacons with long sleep times
6. Rebuild vs clean, and monitoring after
Rebuild compromised appliances and servers from known-good images, with new credentials and certificates, instead of cleaning them in placematerial
Replace certificates and private keys held on the compromised appliance (VPN, TLS, SAML signing) and revoke the old ones
Run enhanced monitoring for at least 30 days: high-fidelity alerts on tier-0 changes, the IOCs, new remote access and replication requestsmaterial
Have counsel assess notification duties if personal data on reached systems could have been accessed (for example GDPR: 72 hours to the supervisory authority after becoming aware)GDPR Art. 33
Hold a post-incident review and track fixes: edge patch SLA, MFA on remote access, admin tiering, egress filtering, log retentionNIST CSF ID.IM
What this template gives you
- Thirty response steps in six sections, from the first look at the edge appliance to the monitoring after eviction.
- Evidence comes before the patch: a reboot or factory reset of a compromised appliance usually wipes the in-memory webshell and recent logs.
- Domain compromise gets its own section: tier-0 review, coordinated password resets and the krbtgt double reset with the right wait between resets.
- Command-and-control is blocked in one planned eviction with the credential resets, not piecemeal — partial blocks warn the attacker.
- Mark each step To do, In progress, Done or Blocked; the summary flags material steps still open and whether evidence is secured.
Frequently asked questions
Should we patch and reboot the compromised VPN appliance straight away?
Not before you capture evidence, unless damage is happening right now. A reboot usually destroys in-memory tooling and recent logs, which you need to know what the attacker took and where they went. Restrict the device first (disable the portal or the management interface), capture memory, disk and logs using the vendor's supported process, then patch or rebuild.
Why reset krbtgt twice?
The domain keeps the current and the previous krbtgt key so that tickets keep working during a change. A forged ticket made with the old key stays valid until both keys have changed. Reset once, wait for replication and at least the maximum ticket lifetime (10 hours by default), then reset again. Resetting twice back-to-back works faster but breaks every existing session at once.
Should we rebuild or clean compromised servers and appliances?
Rebuild where you can. Cleaning in place only works if you know every change the attacker made, and in a network intrusion you rarely do. Rebuild from known-good images, apply configuration fresh rather than restoring a backup that may contain the attacker's changes, and replace any keys or certificates the device held.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.