Someone Else Was Here First
On day three of an internal test you beacon from WS-0412, an in-scope marketing workstation. You find a scheduled task named 'AdobeUpdateTask' running C:\ProgramData\Adobe\svc.exe every four minutes, plus an outbound TLS connection roughly every 60 seconds to 198.51.100.77:443. The binary carries an invalid code-signing certificate, and the workstation's logged-on user is a helpdesk technician. Twenty minutes ago your own tooling wrote C:\ProgramData\run.exe and created a service named 'WinHelpSvc'. You also hold a screenshot of the user's browser on an internal HR dashboard showing 240 employee records with salary and national ID numbers. Report delivery is scheduled for nine days from now.
1. Sequence your immediate actions.
Read the worked answer
Contain your own footprint first, then preserve, then investigate, because anything you do next writes to the disk you are trying to preserve.
One: capture the exact path, creation time, service name and command line for your artefacts, record them as 'tester activity', then kill the C2 channel, delete the service and remove run.exe. Your artefacts must never be commingled with the adversary's in the same evidence set.
Two: do not remove AdobeUpdateTask or svc.exe, do not clean anything, do not run an antivirus scan; scanning modifies files and timestamps.
Three: preserve volatile state before any power change, including process list, network connections, the scheduled task XML, the service list, logged-on sessions, and file hashes with timestamps. Write to an external target, and if you can acquire memory, do it before anything that might prompt a reboot.
Four: investigate the binary and the C2 address offline, from the collected copies.
Also check whether the client's EDR already alerted on this. If their tooling saw it and nothing happened, that is a separate detection-and-response finding.
2. How and when do you notify the client?
Read the worked answer
Immediately and out of band. This is a suspected pre-existing compromise on an in-scope host, and a nine-day report cycle does not apply to it.
Call the named security contact within the hour, then follow up in writing stating exactly what you observed, when, on which host, the earliest artefact timestamp you can substantiate, and that you have not remediated anything. Ask whether they want you to keep working on WS-0412 at all; most clients will pull the host into incident response, which makes it out of scope for testing purposes and changes your plan for the remaining days.
Be careful with attribution language. You can say the task and binary timestamps predate your session, but 'pre-existing' should stay hedged until their IR team correlates with their own telemetry. Do not speculate about the actor.
Flag the access observation too: a helpdesk technician with an HR dashboard open suggests the account carries access well beyond its role. That is useful to the IR team and to your own findings, and it explains how the screenshot came to exist.
3. What do you do with the screenshot containing 240 employees' salary and national ID data?
Read the worked answer
This is a data protection event even though you did not seek it. The record is evidence, so keep it, but quarantine it.
Store the original in the encrypted evidence store with restricted access, label it sensitive personal data, and log who accesses it. Produce a redacted derivative for the report: crop or mask the table and the identifiers, describe the finding in words, for example that an HR dashboard exposing 240 employee records including salary and national ID was reachable from a helpdesk workstation, and reference the original by evidence ID only. Do not paste the image into the client-facing deck, a ticket, or an email.
Tell the client it exists, which fields it contains, and the record count, so they can make their own notification decision. The controller decides on breach notification, not you. Agree retention up front: return or destroy sensitive material on an agreed date after sign-off, and record the destruction. If your engagement letter never covered your own processing of incidental personal data, raise that now rather than at debrief.