The Contained but Not Eradicated Intruder
An intrusion is confirmed on a database server. The team has blocked the attacker's known C2 IP at the firewall and disabled the compromised service account. However, the attacker used a valid domain admin credential that has not yet been rotated, and the EDR shows periodic outbound connections to a second IP that was not on the original blocklist. The database holds customer records and is subject to a 72-hour breach notification clock that starts when the organization 'reasonably believes' a breach occurred. The team estimates eradication will take 3-5 days because the domain admin credential is used by several legacy applications that must be migrated first. The CISO asks: are we contained, and can we start the notification clock?
1. Is the environment contained? Justify your answer against the definition of containment.
Read the worked answer
No - the environment is not contained. Containment means the attacker can no longer act or move; here they still can.
- A valid domain admin credential is an active capability. Blocking one C2 IP and disabling one service account does not remove the attacker's ability to authenticate and move laterally. Until that credential is rotated or its use is constrained, the attacker retains domain-wide reach.
- The second outbound IP is evidence of an unblocked channel. Periodic connections to an IP not on the blocklist indicate the attacker has alternate infrastructure; blocking only known indicators is whack-a-mole, not containment.
- The 3-5 day eradication estimate is itself a containment problem. If eradication requires migrating legacy apps off the credential, the team needs an interim containment strategy (network segmentation, restricting the credential's use, monitoring for its use, isolating the database server) rather than waiting days with an open door.
So the honest answer to the CISO is: partially contained at the perimeter, not contained at the identity layer. The team should state what is and is not closed, and what interim controls will close the gap.
2. How should the CISO think about starting the 72-hour notification clock?
Read the worked answer
The clock is triggered by reasonable belief that a breach occurred, not by completion of eradication. The reasoning:
- Customer records are involved and the attacker had domain admin access. That is enough to support a reasonable belief of unauthorized access to personal data, which starts the clock regardless of whether eradication is finished.
- Waiting for eradication to 'confirm' the breach is a common and dangerous error. It can push the organization past the 72-hour window and create a separate compliance failure on top of the incident.
- The CISO should convene legal/privacy counsel now to make the reasonable-belief determination, document it, and begin the notification process in parallel with eradication. Notification content can be refined as facts develop; the deadline cannot.
- Document the timeline of when the belief formed and why, because regulators and courts will ask.
The judgement: notification and eradication are parallel tracks, not sequential. Containment status affects the content of notification, not whether the clock starts.
3. What interim containment measures would you recommend while the domain admin credential is migrated off legacy apps?
Read the worked answer
Interim measures should reduce the credential's blast radius without waiting for the multi-day migration:
- Restrict the account's logon scope - deny interactive and remote logon where not required, limit to specific hosts, and apply tiered-admin controls so it cannot be used from workstations.
- Segment the database server and the legacy application hosts from the rest of the network; enforce deny-by-default between segments.
- Monitor aggressively for use of the credential - alert on any authentication with it, especially from unusual sources, and on the second C2 IP.
- Rotate the credential where feasible in stages, updating the highest-risk consumers first, and use a privileged access management tool to broker its use if available.
- Hunt for persistence the attacker may have established (scheduled tasks, services, new accounts) so eradication is not merely credential rotation.
- Set a hard review date before the migration completes to reassess whether the interim controls are holding.
The point is to convert an open-ended 'we'll be contained in 3-5 days' into a defined, monitored interim posture.