Incident Response Runbook: The Summoning of the Alter

owner: “Malware Research Lab” classification: “RESTRICTED” tags: [“incident-response”, “malware”, “forensics”, “evidence-preservation”]

1. Purpose

This runbook governs the Summoning of the Alter — the end-to-end process from sample intake through detonation, evidence preservation, and case closure. It is the primary operational document for the Malware Research Alter.

2. Scope

Applies to all dynamic malware analysis operations conducted within the Syn_OS Alter environment, including:

• Sample acquisition and intake
• Chamber provisioning and detonation
• Evidence collection and attestation
• Forensic analysis and threat intelligence enrichment
• Case closure and evidence sealing

3. Prerequisites

• Chamber node provisioned (see Node Provisioning Runbook)
• Credentials rotated and valid (see Credential Rotation Runbook)
• Tetragon daemon healthy and gRPC accessible on port 54321
• TPM2 device available (or software fallback configured)
• Evidence vault mounted and WORM-capable
• Tailscale ACLs current

4. Procedure

4.1 Sample Intake

1. Receive sample via air-gap mediator (airgap-mediator.sh receive --source <path> --dest /quarantine/incoming)
2. Compute SHA256, record in chain of custody
3. Assign case ID: MAL-YYYY-NNNN
4. Store in encrypted ZIP (password: infected) at /quarantine/MAL-YYYY-NNNN/

4.2 Chamber Provisioning

1. Submit sample to pool:

   chamber-pool.sh submit /quarantine/MAL-YYYY-NNNN/sample.bin high "windows,apt"

2. Monitor pool status until job claimed:

   chamber-pool.sh status <job-id>

4.3 Detonation & Observation

1. Worker picks up job, provisions chamber with unique resources
2. Sample executes in OverlayFS chamber with eBPF telemetry (Tetragon) and PCAP capture
3. Observation window: 300s default (configurable via CHAMBER_DURATION)
4. Automatic memory dump on process termination

4.4 Evidence Collection

1. Chamber produces artifacts in /root/detonation/<job-id>/:

   • detonation_report.json (eBPF telemetry)
   • detonation_capture.pcap (network traffic)
   • memory_dumps/ (gcore dumps)

2. Collector copies artifacts to evidence vault:

   archive-evidence.sh --case MAL-YYYY-NNNN \
     --pcap /root/detonation/<job-id>/detonation_capture.pcap \
     --report /root/detonation/<job-id>/detonation_report.json \
     --memory /root/detonation/<job-id>/memory_dumps

4.5 Attestation & Sealing

1. Generate TPM2 quote for evidence package:

   attest-evidence.sh MAL-YYYY-NNNN quote

2. Sign manifest with FIDO2/GPG:

   sign-evidence.sh MAL-YYYY-NNNN sign --fido2

3. Apply WORM lock:

   evidence-immutable.sh MAL-YYYY-NNNN lock

4.6 Analysis & Enrichment

1. Extract IOCs:

   extract-iocs.sh --case MAL-YYYY-NNNN

2. Generate YARA rules:

   gen-yara.sh --input MAL-YYYY-NNNN --output /rules/MAL-YYYY-NNNN.yar

3. Enrich IOCs with threat intel:

   enrich-iocs.sh MAL-YYYY-NNNN/iocs.json --out MAL-YYYY-NNNN/iocs.enriched.json

4. Run ATT&CK tagging:

   attack-tagger.sh --case MAL-YYYY-NNNN

4.7 Case Closure

1. Verify all artifacts sealed and attested
2. Update case metadata: status: closed
3. Archive to cold storage (offline)
4. Notify stakeholders

5. Rollback Procedures

Failure Point	Rollback Action
Chamber provisioning fails	chamber-pool.sh cleanup 0, re-submit
Detonation hangs	chamber-pool.sh worker times out (CHAMBER_JOB_TIMEOUT), auto-cleanup
Evidence corruption	Restore from WORM archive, re-attest
TPM2 unavailable	Fallback to software attestation, note in case log

6. Contacts

Role	Contact	Escalation
Alter Keeper	@alter-keeper	Immediate
Warden of the Wire	@wire-warden	15 min
Evidence Archivist	@evidence-archivist	1 hour

7. References

• Node Provisioning Runbook
• Credential Rotation Runbook
• Threat Model
• Audit Checklist