Phishing-Led Endpoint Compromise on a Friday
At 10:05 on Friday, EDR alerts on FIN-LT-022, a finance laptop at a 200-person SaaS company. WINWORD.EXE spawned powershell.exe with an encoded command, created a scheduled task named Updater, and opened a connection to 203.0.113.45:443. The user opened Invoice_2024.docm from a lookalike vendor domain 40 minutes earlier. The CFO received the same email and has not opened it. EDR supports network isolation but not memory capture; the laptop has 16 GB RAM and BitLocker. The user is not a local admin. Customer contract data is in SharePoint, and the company processes EU employee data. It is a US company with no EU entity. Legal asks whether to notify. The SOC has two analysts on shift and a four-hour containment SLA.
1. State your first five actions in order for the next 30 minutes. For each, say what evidence or capability it preserves or destroys.
Read the worked answer
- Isolate FIN-LT-022 via EDR network containment, not shutdown. This cuts C2 and lateral movement while preserving RAM, scheduled task state, and the encoded command. 2. Capture volatile evidence: EDR process tree, command line, parent PID, network connections, scheduled task XML, and a memory image if the tooling can do it remotely. Powering off would destroy the memory-resident payload and the decoded script. 3. Preserve the phishing email: full headers, message ID, URLs, attachment hash, and recipient list from the mail gateway. Do not let the user delete it; place a hold. 4. Check the CFO's mailbox for delivery and click/open telemetry; if opened, isolate that device too. 5. Reset the user's credentials and revoke sessions/tokens after evidence capture, and block 203.0.113.45 and the sender domain at egress and mail.
Trade-offs: containment may alert the attacker and cause them to accelerate, but 40 minutes of execution and a scheduled task justify it. Capturing memory before credential reset preserves proofs; resetting first may destroy session evidence. Notify the on-call lead and legal, but do not wipe the laptop.
2. How would you scope the incident and decide whether the CFO's mailbox is compromised? List the specific artifacts and queries.
Read the worked answer
Scope by searching the mail gateway for the sender domain, subject, attachment hash, and Message-ID across all mailboxes; count delivered, opened, and clicked. Search EDR/Sysmon for WINWORD.EXE spawning powershell.exe, scheduled task 'Updater', and connections to 203.0.113.45 across all endpoints, not just finance. Search SIEM for the same encoded command fragment and for 4698/4688 events.
To assess the CFO: check message trace and Defender for Office 365 safe-links/attachment verdicts, mailbox audit logs for forwarding rules, sign-in logs for new devices or locations, and Entra ID for MFA changes. If the CFO opened the attachment, treat the mailbox as compromised until proven otherwise; check for inbox rules that delete or forward, OAuth consent grants, and sent items. Pull the laptop's task scheduler and autoruns if opened. Evidence to preserve: email headers, attachment, EDR raw telemetry, MFT/timeline, and mailbox audit records. The absence of a click is not proof; the CFO may have opened it on mobile, so check mobile device sign-ins too.
3. Advise legal on notification. Address contract, GDPR, and the facts you still need before deciding.
Read the worked answer
Legal should be told: this is a confirmed endpoint compromise with possible credential theft, but customer data exfiltration is not yet established. Contract: review the customer contract's breach-notification clause; it may require notice within 24-72 hours of confirmation, not suspicion, and may require forensic cooperation. GDPR: the company is US-only with no EU establishment, but Article 3 may still apply if it offers goods/services to EU data subjects or monitors them; EU employee data processed in the US can trigger applicability. Do not assume no EU entity means no GDPR.
Facts needed before deciding: whether the attacker accessed SharePoint, whether the account had access to customer contract data, whether data left the network, and whether EU personal data was in scope. Preserve logs and avoid definitive statements. If GDPR applies, the 72-hour clock starts when the controller becomes aware, not when the forensic report is finished. Recommend outside counsel and cyber-insurance notification. For customers, prepare a holding statement and notify only if contract or confirmed data access requires it. Do not notify all customers on day one based on a single EDR alert.