02:10 Alert: Shared Admin Account and a Locked File Server
At 02:10 the SOC receives an EDR alert: a shared help-desk account authenticated to 14 servers in four minutes and then ran an encoded PowerShell command. The account, svc-helpdesk, holds local administrator rights on every Windows server, and its password has been on a team wiki page for years. At 02:40 a file server shows about 300 files renamed with a .locked extension and a ransom note. Backups run nightly to a NAS that is joined to the same domain; the last restore test was five months ago and passed. The EHR runs on a separate VLAN but authenticates against the same Active Directory. It is 03:05. The elective surgery list starts at 07:30 and 40 inpatients are on networked infusion pumps. Cyber insurance requires notice within 72 hours. The IT director, who is the senior person available, asks whether to disconnect the site from the internet immediately.
1. Set out your containment sequence and justify the order. How do you answer the IT director's question about pulling the internet connection?
Read the worked answer
Order: identity, then lateral movement, then data - without taking clinical systems down.
- Identity. Disable svc-helpdesk and kill its sessions; the account is the attacker's keys to 14 servers. Rotate its password and every other credential on that wiki page, and hunt for other shared admin accounts.
- Lateral movement. Isolate the file server at the switch port or through EDR network containment, not by powering it off - memory holds the binary, keys and process tree that explain entry.
- Directory. Check DC logs for that account. If a DC is compromised, assume the AD database is too: reset krbtgt twice with an interval, force privileged credential rotation, treat every domain-joined host as suspect.
- Segmentation. Block SMB and RDP between workstation VLANs; confirm EHR VLAN rules.
- Evidence. Start a timeline immediately.
On the internet question: do not unilaterally disconnect. It does not protect the infusion pumps, which sit on their own network, but it does break EHR interfaces and pharmacy orders - a patient-safety decision, not an IT one. Present the trade-off to clinical leadership and act on their call, with the option to disconnect specific egress paths instead.
2. What is your position on restoring from backup tonight?
Read the worked answer
Do not restore yet, for two reasons. The NAS is domain-joined, so the credentials that reached 14 servers probably reach the backups; and restoring into an uneradicated environment simply re-encrypts the data. First check whether NAS shares were touched and whether the backup catalogue is intact.
Treat the domain-joined copy as untrusted until proven otherwise. Identify an offline or immutable copy - tape, object storage with immutability, or a copy behind separate credentials - and test restoring one non-critical server, timing it. A five-month-old test proves nothing about today's data volumes or the current backup chain.
Order: contain and eradicate, rebuild the file server from a known-good image, restore data from a verified copy, scan before reconnecting, then bring departments back in priority order agreed with clinical leadership. Restore the EHR only with its own verified backups and vendor support. If no clean copy exists, say so now, at 03:30, rather than at 07:00.
3. Who decides on notification, and what should happen in the first few hours?
Read the worked answer
The IT director at 03:00 is the right person to start the call tree, not to make the notification decision.
Immediately: declare a major security incident; notify the CIO/CISO or deputy and the on-call executive; call the insurer's incident-response line, since most policies require their panel for forensics and early contact preserves coverage; engage legal counsel now, because the 72-hour insurance notice and any regulatory breach notification are legal judgements informed by forensics.
The assessment question is whether protected health information was accessed or exfiltrated. Renaming files is not itself exfiltration, but the encoded PowerShell and 14-server access mean you cannot rule it out. Forensics on the file server and DC logs decide it.
Decision rights: the executive, advised by legal, owns the notification call; clinical leadership owns what staff and patients are told; IT owns containment and evidence. Document what was known and when - regulators and insurers will ask.