Prepare
Could we respond tonight?
Tools staged, retainers signed, and logs you can still reach if the directory goes down.
Every breach leaves evidence.
Finding it is the job.
Then make sure it never happens twice.
Most of this work starts on someone else's worst day. A ransom note on a file server. A payment sent to an account that isn't the supplier's. A cloud key in a public repository. The job is the same every time: find out what really happened, get the attacker out completely, bring the business back in the right order, and close the door they came through.
Evidence lives in layers.
Collect it in the order it disappears. Then make every piece defensible.
-
Screen
What the operator saw
A remote session can cache tiles of the operator's screen on the machine it came from.
-
Input
What a person did
Logon types, shell history, and folder-browsing records that outlive the folders themselves.
-
Memory
What only exists now
Injected code, live connections and keys often live nowhere else. Kill the process and they're gone.
-
Storage
What they tried to delete
Deleted rarely means destroyed. File tables, change journals and execution caches rebuild a file's whole life.
-
Power
What one switch erases
Pulling the plug loses memory and can lock encrypted disks. Isolate the network, keep the machine running.
-
Custody
What makes it hold up
Hash at collection and at every handover. One undocumented gap can undermine every finding built on it.
A password reset is not an eviction.
Contain the whole identity, or the attacker keeps a key.
- Active sessions
- Refresh tokens
- MFA methods
- Recovery options
- OAuth consents
- App passwords
- Inbox rules
- Mail forwarding
- Registered devices
- Admin roles
Recovery is an attack surface too: verify help-desk resets through a channel the caller doesn't control.
Taking a domain back.
Once an attacker owns the directory, rebuilding servers changes nothing. Eviction is a sequence.
Never fight back from a dirty machine.
Build clean admin workstations from offline media before you touch anything else.
Find privilege three ways.
Protected-account flags, nested top-tier groups and risky domain permissions. Group lists alone miss delegated rights.
Tier zero is bigger than your domain controllers.
Certificate services, federation, directory sync, backups and hypervisor management can all hand out the keys to everything.
Hunt what survives a reset.
The protected-account template is reapplied hourly, so a backdoor planted there comes back.
Two resets. One long wait.
Reset the ticket-signing account twice, confirming replication and waiting out the maximum ticket lifetime (10 hours by default) in between. Forged tickets die; real logons don't.
Prove it's over.
Re-run the attack-path assessment against your baseline. If a path remains, you aren't finished.
They steal before they encrypt.
Encryption is the last move, not the first. By then they've usually been inside for days.
- Way in
Something mundane
A phish, MFA push fatigue, an unpatched edge device or a password recycled from an old breach.
- Look around
Map the estate
Directory queries, network scans and the victim's own remote tools. It looks like admin work.
- Credentials
Take the keys
Credential memory scraped, service tickets cracked offline, directory replication faked.
- Spread
Move quietly
Remote desktop, remote services and admin shares, often on legitimate tools.
- Safety net
Break recovery
Backup consoles and shadow copies are hit before the main event.
- Leverage
Take the data
Bulk uploads to cloud storage. A clean restore won't undo this.
- Impact
Encrypt everything
Often out of hours, often the hypervisor. One host, every server.
- Response
Walk back to the front door.
Trace impact back to first access. Restore before closing the way in, and you'll do this twice.
Six phases.
One loop.
Identify
What do we actually know?
Keep observed, inferred and unknown apart. Missing logs are a limitation, not an alibi.
Contain
How do we stop the spread?
Scope quietly, then hit every foothold at once. If encryption is live, isolate first and capture memory alongside.
Eradicate
Is every foothold gone?
Attackers plant spares. One missed backdoor undoes the cleanup, so rebuild wherever trust is gone.
Recover
Is it actually clean?
Clean means before the breach, not before the encryption. Test restores before you need them.
Learn
What changes now?
Blameless, within weeks. Compare the first chance to detect with the moment you did.
Identity first. Everything else waits.
Recovery order is set by trust, not by whoever shouts loudest.
Unverified backups are the attacker's backups. Restore into isolation, then patch and reset before reconnecting.
Every owner says their system is critical. Real traffic shows the true dependencies.
- Identity, rebuilt or proven clean first
- Name resolution and addressing then
- Security tooling and backup consoles then
- The minimum the business needs then
- Everything else last
Know normal. Find evil.
Good response leaves better detection behind.
Hunt behaviours, not hashes.
One query for unusual access to credential memory outlives every renamed tool.
Beacons have a rhythm.
Measure how regular callbacks are, not where they go.
Every hunt ends as a rule.
Otherwise you run it by hand forever.
Silence is a signal.
Alert when a log source stops talking.
Specific beats clever.
A rule that fires a thousand times a day is switched off by lunch.
AI is now part of the attack surface.
Agents hold credentials, call tools and follow instructions. Treat them as privileged users.
Capability is the blast radius.
What an agent can do sets the damage. Irreversible actions need explicit approval and hard limits.
Instructions ride inside data.
One hidden line in a PDF is enough. Everything an agent reads is untrusted.
Filters guess. Boundaries don't.
Keep secrets and authorisation in code the model can't see.
Every output is untrusted input.
Validate it before it reaches anything that renders, queries or runs it.
Retrieval reveals oversharing.
Enforce the user's permissions before a passage reaches the prompt.
Preserve, then roll back.
Hash the weights, config and data first. An old model with a poisoned index isn't recovery.
It isn't over until the lesson is.
Blameless, within weeks, while memories are fresh. Find the root cause, then rehearse with the people who'd really be in the room.
- Rebuild the timeline from first access to recovery.
- Turn every technique that went unalerted into a detection.
- Fix the playbooks that didn't survive contact.
- Give every action an owner and a date.
- Exposed cloud keys
- Keys pushed to a public repository are found by scanners within minutes. Revoke first, then review everything the key did since it was created.
- Push fatigue
- A run of sign-in prompts the user didn't start, then a single approval. Treat that approval as a compromise.
- Beaconing
- Small outbound connections to one destination at a steady interval, with a little jitter, through the day and night.
- Persistence
- Every operating system has ways to start code automatically: services, scheduled jobs, startup items, new SSH keys. Compare them with a known-good baseline.
- Going quiet
- A cleared log, a stopped agent or a host that falls silent is a finding, not a fault. Logs only help if collection was on beforehand.
- Burned secrets
- Anything the attacker could read is exposed. Rotate the passwords, keys, tokens and certificates within their reach, not just the account they used.
- Breach notification
- Under GDPR, the regulator expects notice within 72 hours of awareness where feasible, not after the investigation. Other regions and sectors run their own clocks.
Every kind of bad day.
- Ransomware
- Double extortion
- Business email compromise
- Invoice fraud
- Directory takeover
- Cloud identity compromise
- Password spraying
- Session hijacking
- Leaked cloud keys
- OAuth consent abuse
- Supply chain compromise
- Edge appliance zero-day
- Insider data theft
- Help-desk vishing
- Webshells
- Wiper attacks
- Cryptojacking
- Container escape
- DNS hijacking
- OT network pivot
- Lost devices
- Prompt injection
- Exposed storage
- DDoS extortion