Skip to main content
Join DiscordFind My Path
Find My Path

Project 03

Account Compromise Playbook

Run a fictional compromised-account incident and write the playbook it produces.
Start the walkthrough
Difficulty
Easy
Time
4 to 6 hours
On a résumé
Good first project

Why this one is worth your hours

Shows you can make time-pressured decisions and record them so others can follow.

A weekend of work. Start here if you have never published a project.

What you walk away with

  • NIST SP 800-61
  • CISA tabletop package
  • Markdown
  • Timeline spreadsheet

Those names go on your résumé line, and every one of them is something an interviewer can ask you about, so use them honestly.

Give it a name of its own

“Account Compromise Playbook” describes the work. It is not the name. Pick one of these, or invent your own, then use it everywhere: the repository, the README title and the résumé.

  • Firebreak
  • Containment
  • Blue Hour
  • Cold Start
  • Runbook Zero

The framework you follow

  • NIST SP 800-61

    Structure the write-up around detection, containment, eradication, recovery, lessons.

  • CISA tabletop packages

    Borrow the scenario injects that keep the exercise realistic.

How to follow a framework, honestly

A framework is a checklist someone argued about for years. You do not read all of it. You use the part that matches your project.

  1. Take one section. Open the framework and find the section that covers your project. Read only that.
  2. Quote the requirement. Put the requirement in your README in its own words, one or two lines, with a link.
  3. Map your steps to it. Beside each step you take, name the item it satisfies. This is what makes the work checkable.
  4. Record where you differ. You will skip something because it needs a budget or a team. Write that down and why. It reads as judgment, not as a gap.

Naming a framework you followed and showing where you diverged is worth more in an interview than listing five you have only heard of.

Do the work

Keep a note file open. One line per step: what you ran, what came back, what you decided.

  1. Write a one-paragraph scenario: a shared club account posting links nobody approved.
  2. List the signs that confirm compromise, and what you still do not know.
  3. Decide containment steps and note what each one disrupts.
  4. Work through recovery: sessions, recovery settings, connected apps.
  5. Record every decision on a timeline with the time and the reason.
  6. Finish with what you would change to prevent a repeat.

What ends up in the repository

  • The playbook, step by step
  • The exercise timeline with reasoning
  • A short lessons-learned section

Put it on GitHub

This is the part people skip, and it is the part a reviewer actually opens. Eight steps, about twenty minutes the first time.

  1. Create the repository

    github.com → New repository

    Name it the project name you picked. Add a README and an MIT licence. Keep it public.

    Note it down Write the chosen name in your notes. It goes on your résumé later, unchanged.

  2. Bring it to your machine

    git clone https://github.com/you/arkham.git
cd arkham

    The terminal prints Cloning into 'arkham'. You now have a folder with one README in it.

    Note it down If it asks for a password, set up a personal access token or SSH key once and never again.

  3. Make room for evidence

    mkdir evidence notes scripts
printf 'data/\n*.pcap\n' > .gitignore

    Three empty folders and a .gitignore, so raw captures and downloaded datasets never get committed.

    Note it down Never commit real data, keys or anything with someone's name in it.

  4. Write the README before the work

    open README.md

    Goal, environment, what I did, evidence, findings, limitations. Headings first, blanks underneath.

    Note it down Writing the headings first tells you what to collect while you work, instead of after.

  5. Take notes as you go

    notes/log.md

    One line per action: the time, what you ran, what came back, what you decided.

    Note it down This is where your numbers come from. In three days you will not remember why you ruled something out.

  6. Commit in small pieces

    git add .
git commit -m "Add triage table for alerts 1 to 6"

    Each commit is a checkpoint with a message you can read back months later.

    Note it down One commit per step of the project. An interviewer can scroll your commits and see how you worked.

  7. Push it up

    git push

    Refresh the page on github.com and your README is the front page of the project.

    Note it down Check it in a private window. If it 404s, the repository is still private.

  8. Finish it properly

    git tag v1.0
git push --tags

    Screenshots in evidence/, the real numbers filled into the README, a tagged version.

    Note it down Copy the repository link into your résumé line and click it once before you send it.

  • Small commits beat one giant upload; the history is part of the evidence.
  • Every screenshot needs a caption saying what it proves.
  • If something did not work, keep it and say so. Reviewers trust write-ups that admit limits.

The résumé line

Project name | tools, datasets and frameworks | link

Example, with your own name and your own numbers

FirebreakNIST SP 800-61, CISA tabletop package, Markdown, Timeline spreadsheet, NIST SP 800-61GitHub

Ran a simulated account compromise from detection to recovery in 45 minutes; logged 14 timestamped decisions and produced a 6-step containment playbook revised after a tabletop with 3 students.

The numbers come from your notes, not from this page. Count as you work, keep every figure checkable in your report, and hyperlink the last part to the repository.

Next

  • Ransomware Tabletop

    Run a discussion exercise with injects and capture the decisions people struggle with.

All 30 projects About Incident Response