Skip to main content

☠ Adversary Presence

Presence on CVA/H​

  • Start packet capture (if possible)
  • Report to MEL
  • If physical system:
    • Configure private VLAN/port isolation on switchport of infected system
    • Configure switchport of infected system to DMZ VLAN
    • Notify all crew members via out-of-band comms for IOCs to check for to scope infection
    • Check systems for IOCs
    • Notify HHQ of event via classified means, request direction to engage MCA or collect information
  • If directed to collect:
    • Deploy host-based capabilities to identified system
    • Collect artifacts and activity of MCA to analyze
    • Report to HHQ for further direction
  • If directed to engage:
    • Block network activity at DIP and MP net systems
    • Collect artifacts and activity of MCA to analyze
    • Remove threat and validate infection cleared

Presence on DAL Asset​

  • Report to MEL
  • Check systems for IOCs
  • Follow PAAs/PCAs pertaining to MCA engagement
  • If no PAA/PCA in Tactical Plan Communication Contracts for MCA, notify HHQ of event via classified means, request direction to engage MCA or collect information
  • If directed to collect:
    • Deploy host-based capabilities to identified system
    • Collect artifacts and activity of MCA to analyze
    • Report to HHQ for further direction
  • If directed to engage:
    • Block network activity at MP net systems
    • Collect artifacts and activity of MCA to analyze
    • Remove threat and validate infection cleared