Solid playbook, the ctime vs mtime timestomping point alone is worth bookmarking.

One thing I'd add right at the top, before any of the /proc work: the opening scenario mentions an SSH session "from an IP address block in a country where your engineering team has zero presence," but that judgment call is doing a lot of work and it's worth making it explicit rather than trusting the alert. A quick geolocation + ASN lookup on the source IP tells you fast whether you're looking at a residential ISP in an unexpected country (bad sign) or just a known corporate VPN exit / cloud NAT range that happens to geolocate oddly (false alarm). ipgeolocation.io's free tier is enough for this, one call gives you country, ASN and organization/network type, so you're not burning time on /proc forensics for what turns out to be a coworker on a company VPN.

Worth wiring straight into the alert itself so the country/ASN shows up before anyone even opens a terminal.