SHEET 07 / INCIDENT
Stop the change, preserve evidence, restore from something known.
Do not start by deleting random files. Record what is happening, restrict access and decide which copy and credentials can still be trusted.
01
Contain
Put the affected service behind a controlled response, revoke exposed sessions and avoid using a potentially compromised device for password changes.
02
Preserve evidence
Save timestamps, logs, suspicious files and a copy of the affected state before cleanup if that can be done safely.
03
Recover and close the entry point
Restore from a verified clean source, update components, rotate credentials and fix the vulnerability that allowed the change.