Chapter 01
The search
- ✓Pin the fact, fix the window, walk backward, forward, and sideways
- ✓Where the truth lives: logon type, process tree, message id, cloud API
- ✓Patient zero is the first host you can prove, not the loudest
← All guides
🚨 Operations · 22 pages
Find the attacker from one fact, then contain them without wiping the proof.
The search method, the logs that tell the truth, initial access through ransomware and a stolen mailbox, and the report a manager can act on.
“Finding them is a direction: backward to the door, forward to what they touched, sideways to who else. Panic has no direction.”— Rishav Bhardwaj
Why you need this — honestly
- You can define the IR lifecycle and still not know which log to open second.
- You need to find patient zero, persistence, and lateral movement without guessing a name for the attacker.
- You want the containment order that actually removes them: tokens, sessions, password, rules, other hosts.
What's inside
Written in plain language. No jargon for the sake of jargon. Every section ends with something you can do, not just read.
Chapter 02
The paths
- ✓Phish, device code, VPN, stolen key, public app
- ✓Persistence that survives a password reset
- ✓Ransomware, BEC, insider, and a cloud key
Chapter 03
Proof
- ✓What containment does and does not do
- ✓Chain of custody in one sentence
- ✓A one-page report and a control, not a slogan
Perfect if you are…
SOC analysts on a bridgeIT leads who become IR at 2 a.m.Anyone who has to brief a manager
Related guides
Pair Incident Response with these — each is a separate instant-download PDF by Rishav Bhardwaj.
Incident Response Playbooks
Ransomware, phishing, insider threat & breach — templates you can run.
View guide →
The Cyber Roadmap
17 chapters — networking to SIEM, EDR, GRC, IR, and your first role.
View guide →
Deep Phishing Analysis
Headers, kits, device-code abuse & AiTM — like a real SOC lead teaches it.
View guide →
Malware Analysis Bible
Static, dynamic, behavioral — with a lab mindset that sticks.
View guide →
How to find the attacker and prove it
Start from one log. Walk backward to the door, forward to what they touched, and sideways to who else. This guide is that search, then containment that does not wipe the proof.
- Lifecycle, severity, and the four-sentence update
- The logs that tell the truth: logon type, process tree, message id, cloud API
- Phish, device code, lateral movement, ransomware, insider, and a stolen key
- What revoke, isolate, and rebuild each do and do not do
Common questions
- Is this a forensics lab manual?
- It is the shift method: which log to open, how not to destroy evidence, and how to write the report. Disk and memory work is named so you know when to stop and hand the image to IR.
Instant PDF download
Incident Response
$12.02
22 pages · 3–4 hours · one-time purchase
International checkout
After you continue to payment, on the Cashfree page please select PayPal (scroll to International Walletif you don't see it).
Prices on this site are in USD. Cashfree may show the equivalent in ₹ — that is normal; PayPal lets you pay from outside India.
✓ 7-day money-back guarantee · instant PDF delivery · no subscription
847 professionals already downloaded this
Want every guide? Complete bundle for $43.35 →
Want live guidance? Book a 1-on-1 with me →
About me
Rishav Bhardwaj — cybersecurity practitioner & author of Cyber Rishav
I've trained 200+ analysts, built blue-team programs inside real enterprises, and still sit in the work — SOC triage, cloud risk, GRC, and IR. These guides are the same structured thinking I use in programs and 1-on-1s, written so you can act this week, not someday.
CISSPCCSKSecurity+CEHISO 27001
Rishav Bhardwaj
Cybersecurity practitioner · Blue team
200+
Analysts coached
10K+
Enterprise seats in IR programs
12
Deep-dive guides
Every guide in this library is something I use when coaching analysts and building programs — not content farm filler. If it does not help you act this week, it does not ship.