godwinsystems/rb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move runbooks into domain directories

Browse Source 
od-db-backup.md becomes od/db-backup.md -- the hyphen becomes a slash, so
the fetch command is exactly as long to type as before. That mattered: the
length of a hand-typed command is the constraint this repo is organized
around, and a reorganization that lengthened it would have been a net loss.

Scripts deliberately stay flat in scripts/ with their domain prefix.
Everything executable in one directory is the set worth reading before it
runs, and nesting five files by domain would add characters without adding
clarity.

Updates every reference: README Contents (now grouped by directory), the
layout section, both fetch examples, inter-runbook links, and the .NOTES
headers in all five scripts. Verified every markdown link resolves on disk
and that Contents and the filesystem agree in both directions.

Records the naming rule in CONTRIBUTING so the next file lands correctly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
This commit is contained in:
Ivan Godwin
2026-09-02 23:15:48 -07:00
parent f2a979f047
commit cb0c5b4614
14 changed files with 91 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sec/google-evidence.md
+114
View File
@@ -0,0 +1,114 @@
# Runbook: Google account — evidence capture + re-entry check
> For qualified IT professionals, on systems they are authorized to administer.
> Provided as-is, without warranty — verify it fits your environment. See LICENSE.
**Applies to:** A consumer Google/Gmail account, before or after containment. No Workspace admin console required.
**Use it for:** (a) capturing account state **before** you change anything, and (b) checking whether anyone got back in **after** a password reset.
**Companion:** [`sec/google-compromise.md`](google-compromise.md) — full containment procedure.
**Placeholders:**
| Placeholder | Meaning |
|---|---|
| `<ACCOUNT>` | The Google account under review |
| `<RESET_TIME>` | Date/time of the password reset — the re-entry baseline |
| `<COMPROMISE_START>` | Earliest known date of compromise |
| `<EVIDENCE_DIR>` | Folder for screenshots, e.g. `Desktop\Account Records` |
**Rules:**
- Sign in **once**. Gmail keeps ~10 recent-activity entries; re-authenticating pushes older ones off.
- Screenshot everything, including empty results.
- Change nothing until Part C.
- **Anything dated after `<RESET_TIME>` that isn't you = they got back in.**
---
## Part A — do first
**1.** gmail.com → bottom of inbox → "Last account activity" → **Details**
→ screenshot `01-signin-list` (scroll, second shot if needed)
→ **Look for: access after `<RESET_TIME>`.**
**2.** myaccount.google.com → Security → Recent security activity → See all
→ screenshot `02-security-activity`
→ **Look for: anything after `<RESET_TIME>`.**
**3.** Security → Your devices → **Manage all devices**
→ screenshot `03-devices`
→ **Look for: any session you didn't sign in.**
---
## Part B — export check
**4.** takeout.google.com → **Your exports** / Manage exports
→ screenshot `04-takeout` — **screenshot it even if empty.**
→ Takeout copies the whole mailbox in one archive. It is the bulk-exfiltration path.
**5.** Gmail search: `in:anywhere from:google.com`
→ screenshot results `05-google-alerts`
→ open + screenshot each: Security alert · New sign-in · password changed · "Your data is ready to download"
→ `in:anywhere` includes Trash and Spam, where these are usually deleted to.
**6.** Gmail search: `in:anywhere after:<RESET_TIME date>`
→ screenshot `06-since-reset`
Don't delete anything. Don't empty Trash.
---
## Part C — persistence
**7.** myaccount.google.com/permissions
→ screenshot list `07-oauth`
→ open each grant → screenshot **name + scopes + date authorized** `07b…`
→ **then remove every grant you cannot positively attribute.**
→ **Authorized on/after `<COMPROMISE_START>` = attacker-created.**
→ OAuth grants survive password resets and session revocation.
**8.** Gmail → gear → See all settings:
- **Forwarding and POP/IMAP** → screenshot `08-forwarding` — note any **pending/unconfirmed** address
- **Filters and Blocked Addresses** → screenshot `09-filters` → select all → **Export** → save the XML
- **Accounts and Import** → screenshot `10-accounts` — Send mail as · Grant access to your account
**9.** myaccount.google.com/signinoptions/passkeys → screenshot `11-passkeys`
→ **Any passkey you didn't enroll → remove.**
**10.** Security → 2-Step Verification → screenshot `12-2sv`
→ Recovery phone + recovery email → screenshot `13-recovery`
**11.** myaccount.google.com/apppasswords → screenshot `14-apppasswords`
→ **revoke all.** App passwords bypass 2-Step Verification.
---
## Before you leave
- [ ] Nothing deleted, Trash not emptied
- [ ] `<EVIDENCE_DIR>` left on the machine
- [ ] Time finished written down
- [ ] Screenshots not emailed
---
## Results
| Step | Finding | Screenshot |
|---|---|---|
| 1 | | |
| 2 | | |
| 3 | | |
| 4 | | |
| 5 | | |
| 6 | | |
| 7 | name / scopes / **authorized date:** | |
| 8 | | |
| 9 | | |
| 10 | | |
| 11 | | |
---
Menu wording drifts; the `myaccount.google.com/...` links are the durable part. If a path doesn't match, navigate from **myaccount.google.com → Security** and record the path you used.