From b2d2a42a9a5fdfe98dd75d5cb602522d47ba9517 Mon Sep 17 00:00:00 2001 From: Ivan Godwin Date: Sat, 15 Aug 2026 15:17:28 -0700 Subject: [PATCH] Add sec-google-evidence runbook: account state capture + re-entry check Numbered field checklist for a consumer Google account, usable in two situations: capturing state before touching anything, and verifying nobody regained access after a password reset. Deliberately terse -- steps only, no rationale prose. This is worked standing up in someone's office, where explanatory text between steps makes the next action harder to find. Covers ground sec-google-compromise.md Phase 0 does not: the Takeout export history, which is the bulk-exfiltration path for a Google account and produces affirmative evidence in an account tier with no audit log; recovering Google's own security mail from Trash and Spam via in:anywhere; pending-but-unconfirmed forwarding addresses; the native filter XML export instead of a screenshot; and attacker-enrolled passkeys. Also records that Gmail keeps only ~10 recent-activity entries, so signing out and back in destroys evidence -- capture in one sitting. Placeholders only. Co-Authored-By: Claude Opus 5 --- README.md | 1 + sec-google-evidence.md | 111 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 112 insertions(+) create mode 100644 sec-google-evidence.md diff --git a/README.md b/README.md index 3609060..fb0863d 100644 --- a/README.md +++ b/README.md @@ -73,6 +73,7 @@ run time — never commit filled-in values. | [`od-backup-verify.md`](od-backup-verify.md) | Open Dental — verify a backup by test-restoring into an isolated Hyper-V VM (health checklist) | | [`od-backup-schedule.md`](od-backup-schedule.md) | Open Dental — schedule the backup + off-site upload and monitor it (dead-man's-switch heartbeat) | | [`sec-google-compromise.md`](sec-google-compromise.md) | Incident response — suspected compromise of a **consumer** Google/Gmail account (AiTM session theft; no Workspace admin console) | +| [`sec-google-evidence.md`](sec-google-evidence.md) | Google/Gmail account — evidence capture before changes + re-entry check after a password reset (numbered, field-usable) | | [`scripts/cg-disable.ps1`](scripts/cg-disable.ps1) | Disable Credential Guard, then reboot (prompts to confirm) | | [`scripts/od-cfg-acl.ps1`](scripts/od-cfg-acl.ps1) | Grant Users Modify on FreeDentalConfig.xml (Option B of od-cfg-persist) | | [`scripts/od-db-backup.ps1`](scripts/od-db-backup.ps1) | Cold backup: stop MySQL/MariaDB, copy whole data dir + OpenDentImages, always restart (od-db-backup) | diff --git a/sec-google-evidence.md b/sec-google-evidence.md new file mode 100644 index 0000000..fe347a3 --- /dev/null +++ b/sec-google-evidence.md @@ -0,0 +1,111 @@ +# Runbook: Google account — evidence capture + re-entry check + +**Applies to:** A consumer Google/Gmail account, before or after containment. No Workspace admin console required. +**Use it for:** (a) capturing account state **before** you change anything, and (b) checking whether anyone got back in **after** a password reset. +**Companion:** [`sec-google-compromise.md`](sec-google-compromise.md) — full containment procedure. + +**Placeholders:** + +| Placeholder | Meaning | +|---|---| +| `` | The Google account under review | +| `` | Date/time of the password reset — the re-entry baseline | +| `` | Earliest known date of compromise | +| `` | Folder for screenshots, e.g. `Desktop\Account Records` | + +**Rules:** + +- Sign in **once**. Gmail keeps ~10 recent-activity entries; re-authenticating pushes older ones off. +- Screenshot everything, including empty results. +- Change nothing until Part C. +- **Anything dated after `` that isn't you = they got back in.** + +--- + +## Part A — do first + +**1.** gmail.com → bottom of inbox → "Last account activity" → **Details** +→ screenshot `01-signin-list` (scroll, second shot if needed) +→ **Look for: access after ``.** + +**2.** myaccount.google.com → Security → Recent security activity → See all +→ screenshot `02-security-activity` +→ **Look for: anything after ``.** + +**3.** Security → Your devices → **Manage all devices** +→ screenshot `03-devices` +→ **Look for: any session you didn't sign in.** + +--- + +## Part B — export check + +**4.** takeout.google.com → **Your exports** / Manage exports +→ screenshot `04-takeout` — **screenshot it even if empty.** +→ Takeout copies the whole mailbox in one archive. It is the bulk-exfiltration path. + +**5.** Gmail search: `in:anywhere from:google.com` +→ screenshot results `05-google-alerts` +→ open + screenshot each: Security alert · New sign-in · password changed · "Your data is ready to download" +→ `in:anywhere` includes Trash and Spam, where these are usually deleted to. + +**6.** Gmail search: `in:anywhere after:` +→ screenshot `06-since-reset` + +Don't delete anything. Don't empty Trash. + +--- + +## Part C — persistence + +**7.** myaccount.google.com/permissions +→ screenshot list `07-oauth` +→ open each grant → screenshot **name + scopes + date authorized** `07b…` +→ **then remove every grant you cannot positively attribute.** +→ **Authorized on/after `` = attacker-created.** +→ OAuth grants survive password resets and session revocation. + +**8.** Gmail → gear → See all settings: +- **Forwarding and POP/IMAP** → screenshot `08-forwarding` — note any **pending/unconfirmed** address +- **Filters and Blocked Addresses** → screenshot `09-filters` → select all → **Export** → save the XML +- **Accounts and Import** → screenshot `10-accounts` — Send mail as · Grant access to your account + +**9.** myaccount.google.com/signinoptions/passkeys → screenshot `11-passkeys` +→ **Any passkey you didn't enroll → remove.** + +**10.** Security → 2-Step Verification → screenshot `12-2sv` +→ Recovery phone + recovery email → screenshot `13-recovery` + +**11.** myaccount.google.com/apppasswords → screenshot `14-apppasswords` +→ **revoke all.** App passwords bypass 2-Step Verification. + +--- + +## Before you leave + +- [ ] Nothing deleted, Trash not emptied +- [ ] `` left on the machine +- [ ] Time finished written down +- [ ] Screenshots not emailed + +--- + +## Results + +| Step | Finding | Screenshot | +|---|---|---| +| 1 | | | +| 2 | | | +| 3 | | | +| 4 | | | +| 5 | | | +| 6 | | | +| 7 | name / scopes / **authorized date:** | | +| 8 | | | +| 9 | | | +| 10 | | | +| 11 | | | + +--- + +Menu wording drifts; the `myaccount.google.com/...` links are the durable part. If a path doesn't match, navigate from **myaccount.google.com → Security** and record the path you used.