igodwin
f2a979f047
The repo is public and files are fetched by raw URL, so a reader who lands on one runbook never sees the README -- the repo's context does not travel with the file. Each .md now carries two lines under the title, each .ps1 the equivalent at the end of its .NOTES block. Deliberately two lines, not a paragraph. These files are read through `| more` on a client console mid-incident, and the top of the file is where the procedure-specific warnings live -- never a live chart, stop the service before copying, confirm authorization before acting. A legal preamble above those competes with them and trains people to skip past. Wording aims at a stranger who found the repo, not at the quality of the procedure: these double as documented-procedure evidence for E&O, and language implying the content is unreliable works against that. MIT rather than no license: the warranty and liability disclaimer is the part that does the work, and leaving it unlicensed makes reuse ambiguous rather than disclaimed. Also fixes 5 stale ops/rb URLs in scripts/*.ps1 that the previous commit missed -- it only swept the .md files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
4.0 KiB
Runbook: Google account — evidence capture + re-entry check
For qualified IT professionals, on systems they are authorized to administer. Provided as-is, without warranty — verify it fits your environment. See LICENSE.
Applies to: A consumer Google/Gmail account, before or after containment. No Workspace admin console required.
Use it for: (a) capturing account state before you change anything, and (b) checking whether anyone got back in after a password reset.
Companion: sec-google-compromise.md — full containment procedure.
Placeholders:
| Placeholder | Meaning |
|---|---|
<ACCOUNT> |
The Google account under review |
<RESET_TIME> |
Date/time of the password reset — the re-entry baseline |
<COMPROMISE_START> |
Earliest known date of compromise |
<EVIDENCE_DIR> |
Folder for screenshots, e.g. Desktop\Account Records |
Rules:
- Sign in once. Gmail keeps ~10 recent-activity entries; re-authenticating pushes older ones off.
- Screenshot everything, including empty results.
- Change nothing until Part C.
- Anything dated after
<RESET_TIME>that isn't you = they got back in.
Part A — do first
1. gmail.com → bottom of inbox → "Last account activity" → Details
→ screenshot 01-signin-list (scroll, second shot if needed)
→ Look for: access after <RESET_TIME>.
2. myaccount.google.com → Security → Recent security activity → See all
→ screenshot 02-security-activity
→ Look for: anything after <RESET_TIME>.
3. Security → Your devices → Manage all devices
→ screenshot 03-devices
→ Look for: any session you didn't sign in.
Part B — export check
4. takeout.google.com → Your exports / Manage exports
→ screenshot 04-takeout — screenshot it even if empty.
→ Takeout copies the whole mailbox in one archive. It is the bulk-exfiltration path.
5. Gmail search: in:anywhere from:google.com
→ screenshot results 05-google-alerts
→ open + screenshot each: Security alert · New sign-in · password changed · "Your data is ready to download"
→ in:anywhere includes Trash and Spam, where these are usually deleted to.
6. Gmail search: in:anywhere after:<RESET_TIME date>
→ screenshot 06-since-reset
Don't delete anything. Don't empty Trash.
Part C — persistence
7. myaccount.google.com/permissions
→ screenshot list 07-oauth
→ open each grant → screenshot name + scopes + date authorized 07b…
→ then remove every grant you cannot positively attribute.
→ Authorized on/after <COMPROMISE_START> = attacker-created.
→ OAuth grants survive password resets and session revocation.
8. Gmail → gear → See all settings:
- Forwarding and POP/IMAP → screenshot
08-forwarding— note any pending/unconfirmed address - Filters and Blocked Addresses → screenshot
09-filters→ select all → Export → save the XML - Accounts and Import → screenshot
10-accounts— Send mail as · Grant access to your account
9. myaccount.google.com/signinoptions/passkeys → screenshot 11-passkeys
→ Any passkey you didn't enroll → remove.
10. Security → 2-Step Verification → screenshot 12-2sv
→ Recovery phone + recovery email → screenshot 13-recovery
11. myaccount.google.com/apppasswords → screenshot 14-apppasswords
→ revoke all. App passwords bypass 2-Step Verification.
Before you leave
- Nothing deleted, Trash not emptied
<EVIDENCE_DIR>left on the machine- Time finished written down
- Screenshots not emailed
Results
| Step | Finding | Screenshot |
|---|---|---|
| 1 | ||
| 2 | ||
| 3 | ||
| 4 | ||
| 5 | ||
| 6 | ||
| 7 | name / scopes / authorized date: | |
| 8 | ||
| 9 | ||
| 10 | ||
| 11 |
Menu wording drifts; the myaccount.google.com/... links are the durable part. If a path doesn't match, navigate from myaccount.google.com → Security and record the path you used.