{
    "id": "playbook--unauthorized-access",
    "name": "Unauthorized Access Response",
    "version": "2.0",
    "mitre": "TA0001/T1133",
    "trigger": {
        "event_type": "unauthorized_login",
        "severity": ["high", "critical"]
    },
    "steps": [
        {
            "id": "step-1",
            "name": "Capture current state",
            "action": "exec",
            "command": "who; w; last -i | head -20; ss -tnp state established"
        },
        {
            "id": "step-2",
            "name": "Identify unauthorized session",
            "action": "exec",
            "command": "last -i | grep -v 'reboot\\|wtmp' | head -10",
            "depends_on": "step-1"
        },
        {
            "id": "step-3",
            "name": "Kill unauthorized session immediately",
            "action": "exec",
            "command": "pkill -u $$unauthorized_user$$ -9 && echo \"KILLED sessions for: $$unauthorized_user$$\"",
            "depends_on": "step-2",
            "on_failure": "step-3b"
        },
        {
            "id": "step-3b",
            "name": "Kill session via TTY (fallback)",
            "action": "exec",
            "command": "who | grep $$unauthorized_user$$ | awk '{print $2}' | xargs -I{} sudo pkill -t {} && echo \"KILLED via TTY\""
        },
        {
            "id": "step-4",
            "name": "Lock account",
            "action": "exec",
            "command": "sudo usermod -L $$unauthorized_user$$ && sudo chage -E 1970-01-01 $$unauthorized_user$$ && echo \"LOCKED account: $$unauthorized_user$$\"",
            "depends_on": "step-3",
            "on_failure": "step-4b"
        },
        {
            "id": "step-4b",
            "name": "Lock account (passwd fallback)",
            "action": "exec",
            "command": "sudo passwd -l $$unauthorized_user$$ && echo \"LOCKED via passwd: $$unauthorized_user$$\""
        },
        {
            "id": "step-5",
            "name": "Block source IP",
            "action": "exec",
            "command": "sudo iptables -A INPUT -s $$source_ip$$ -j DROP && sudo iptables -A OUTPUT -d $$source_ip$$ -j DROP && echo \"BLOCKED source: $$source_ip$$\"",
            "depends_on": "step-1"
        },
        {
            "id": "step-6",
            "name": "Destroy persistence mechanisms",
            "action": "exec",
            "command": "crontab -r -u $$unauthorized_user$$ 2>/dev/null; truncate -s 0 /home/$$unauthorized_user$$/.ssh/authorized_keys 2>/dev/null; find /home/$$unauthorized_user$$ -name '*.sh' -mtime -1 -delete 2>/dev/null; find /tmp /var/tmp -uid $(id -u $$unauthorized_user$$) -delete 2>/dev/null; echo \"PERSISTENCE cleared for: $$unauthorized_user$$\"",
            "depends_on": "step-4"
        },
        {
            "id": "step-7",
            "name": "Generate incident report",
            "action": "write",
            "template": "incident_report",
            "depends_on": "step-6"
        }
    ],
    "learning": {
        "on_success": "SIEMPRE: Acceso no autorizado — matar sesión + bloquear cuenta + bloquear IP + destruir persistencia en un solo pass",
        "on_failure": "NUNCA: Bloquear cuenta sin primero matar la sesión activa — el atacante sigue dentro"
    }
}