igodwin
f2a979f047
The repo is public and files are fetched by raw URL, so a reader who lands on one runbook never sees the README -- the repo's context does not travel with the file. Each .md now carries two lines under the title, each .ps1 the equivalent at the end of its .NOTES block. Deliberately two lines, not a paragraph. These files are read through `| more` on a client console mid-incident, and the top of the file is where the procedure-specific warnings live -- never a live chart, stop the service before copying, confirm authorization before acting. A legal preamble above those competes with them and trains people to skip past. Wording aims at a stranger who found the repo, not at the quality of the procedure: these double as documented-procedure evidence for E&O, and language implying the content is unreliable works against that. MIT rather than no license: the warranty and liability disclaimer is the part that does the work, and leaving it unlicensed makes reuse ambiguous rather than disclaimed. Also fixes 5 stale ops/rb URLs in scripts/*.ps1 that the previous commit missed -- it only swept the .md files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
115 lines
4.0 KiB
Markdown
115 lines
4.0 KiB
Markdown
# Runbook: Google account — evidence capture + re-entry check
|
|
|
|
> For qualified IT professionals, on systems they are authorized to administer.
|
|
> Provided as-is, without warranty — verify it fits your environment. See LICENSE.
|
|
|
|
**Applies to:** A consumer Google/Gmail account, before or after containment. No Workspace admin console required.
|
|
**Use it for:** (a) capturing account state **before** you change anything, and (b) checking whether anyone got back in **after** a password reset.
|
|
**Companion:** [`sec-google-compromise.md`](sec-google-compromise.md) — full containment procedure.
|
|
|
|
**Placeholders:**
|
|
|
|
| Placeholder | Meaning |
|
|
|---|---|
|
|
| `<ACCOUNT>` | The Google account under review |
|
|
| `<RESET_TIME>` | Date/time of the password reset — the re-entry baseline |
|
|
| `<COMPROMISE_START>` | Earliest known date of compromise |
|
|
| `<EVIDENCE_DIR>` | Folder for screenshots, e.g. `Desktop\Account Records` |
|
|
|
|
**Rules:**
|
|
|
|
- Sign in **once**. Gmail keeps ~10 recent-activity entries; re-authenticating pushes older ones off.
|
|
- Screenshot everything, including empty results.
|
|
- Change nothing until Part C.
|
|
- **Anything dated after `<RESET_TIME>` that isn't you = they got back in.**
|
|
|
|
---
|
|
|
|
## Part A — do first
|
|
|
|
**1.** gmail.com → bottom of inbox → "Last account activity" → **Details**
|
|
→ screenshot `01-signin-list` (scroll, second shot if needed)
|
|
→ **Look for: access after `<RESET_TIME>`.**
|
|
|
|
**2.** myaccount.google.com → Security → Recent security activity → See all
|
|
→ screenshot `02-security-activity`
|
|
→ **Look for: anything after `<RESET_TIME>`.**
|
|
|
|
**3.** Security → Your devices → **Manage all devices**
|
|
→ screenshot `03-devices`
|
|
→ **Look for: any session you didn't sign in.**
|
|
|
|
---
|
|
|
|
## Part B — export check
|
|
|
|
**4.** takeout.google.com → **Your exports** / Manage exports
|
|
→ screenshot `04-takeout` — **screenshot it even if empty.**
|
|
→ Takeout copies the whole mailbox in one archive. It is the bulk-exfiltration path.
|
|
|
|
**5.** Gmail search: `in:anywhere from:google.com`
|
|
→ screenshot results `05-google-alerts`
|
|
→ open + screenshot each: Security alert · New sign-in · password changed · "Your data is ready to download"
|
|
→ `in:anywhere` includes Trash and Spam, where these are usually deleted to.
|
|
|
|
**6.** Gmail search: `in:anywhere after:<RESET_TIME date>`
|
|
→ screenshot `06-since-reset`
|
|
|
|
Don't delete anything. Don't empty Trash.
|
|
|
|
---
|
|
|
|
## Part C — persistence
|
|
|
|
**7.** myaccount.google.com/permissions
|
|
→ screenshot list `07-oauth`
|
|
→ open each grant → screenshot **name + scopes + date authorized** `07b…`
|
|
→ **then remove every grant you cannot positively attribute.**
|
|
→ **Authorized on/after `<COMPROMISE_START>` = attacker-created.**
|
|
→ OAuth grants survive password resets and session revocation.
|
|
|
|
**8.** Gmail → gear → See all settings:
|
|
- **Forwarding and POP/IMAP** → screenshot `08-forwarding` — note any **pending/unconfirmed** address
|
|
- **Filters and Blocked Addresses** → screenshot `09-filters` → select all → **Export** → save the XML
|
|
- **Accounts and Import** → screenshot `10-accounts` — Send mail as · Grant access to your account
|
|
|
|
**9.** myaccount.google.com/signinoptions/passkeys → screenshot `11-passkeys`
|
|
→ **Any passkey you didn't enroll → remove.**
|
|
|
|
**10.** Security → 2-Step Verification → screenshot `12-2sv`
|
|
→ Recovery phone + recovery email → screenshot `13-recovery`
|
|
|
|
**11.** myaccount.google.com/apppasswords → screenshot `14-apppasswords`
|
|
→ **revoke all.** App passwords bypass 2-Step Verification.
|
|
|
|
---
|
|
|
|
## Before you leave
|
|
|
|
- [ ] Nothing deleted, Trash not emptied
|
|
- [ ] `<EVIDENCE_DIR>` left on the machine
|
|
- [ ] Time finished written down
|
|
- [ ] Screenshots not emailed
|
|
|
|
---
|
|
|
|
## Results
|
|
|
|
| Step | Finding | Screenshot |
|
|
|---|---|---|
|
|
| 1 | | |
|
|
| 2 | | |
|
|
| 3 | | |
|
|
| 4 | | |
|
|
| 5 | | |
|
|
| 6 | | |
|
|
| 7 | name / scopes / **authorized date:** | |
|
|
| 8 | | |
|
|
| 9 | | |
|
|
| 10 | | |
|
|
| 11 | | |
|
|
|
|
---
|
|
|
|
Menu wording drifts; the `myaccount.google.com/...` links are the durable part. If a path doesn't match, navigate from **myaccount.google.com → Security** and record the path you used.
|