02:14 on a Tuesday: LSASS, SMB and a Foreign Logon
At 02:14 on a Tuesday, EDR on an accounts-payable workstation raises a high-severity alert for LSASS access by a signed but unusual binary, followed 90 seconds later by creation of a scheduled task named WinUpdateCheck and outbound SMB to 12 hosts, three of which are file servers holding finance data. At 02:19 the same user account authenticates from an IP in another country. The user is travelling and says she is asleep in a hotel. EDR covers 780 of 800 endpoints; the remaining 20 are lab instruments and two backup proxies. The on-call analyst's draft plan is to power off the workstation, reset the user's password, and wait until 08:00 to convene the team. The domain controller, the backup server and the SIEM all sit in the same /24.
1. Evaluate the on-call analyst's draft plan and state what should happen instead.
Read the worked answer
The plan loses evidence, fails to contain, and waits too long.
- Powering off destroys volatile memory: injected code, the LSASS dump path, live network connections, unencrypted tooling. Use EDR network containment instead - the host stays live, memory can be captured, and command and control is cut.
- A password reset does not evict a session. Kerberos tickets, refresh tokens and established sessions survive it. Disable the account, revoke sessions and refresh tokens at the identity provider, reset the password, and rotate any cached credentials the account could reach.
- The scheduled task is persistence. Export the task XML, hash the binary, and sweep every host for the same task name and binary before declaring containment on one machine.
- Blast radius is already 13 hosts. Outbound SMB to 12 targets plus a foreign authentication five minutes later is not a single-endpoint incident; activate the IR plan, hunt the SMB targets, and check the domain controller and backup server for the same indicators.
Waiting until 08:00 on a possible domain-wide compromise is the most damaging decision in the draft.
2. Which hosts do you isolate, and how do you decide given the business impact?
Read the worked answer
Isolate the source workstation immediately; that decision is not close. For the 12 SMB targets, triage before containing:
- Evidence of execution - did the binary run there, was a service created, was the scheduled task registered, was there a file write or a new local administrator? Those get isolated now.
- Connection only - an SMB connection attempt may be a scan or a failed authentication. Correlate security-log 4624 and 4625 events with EDR telemetry and contain on any successful logon from the compromised account.
- Priority by role - the backup server isolates on suspicion, because ransomware operators target backups early and losing them turns a recoverable incident into an existential one. The file servers holding finance data are isolated or restricted to read-only with close monitoring; at 02:00 the business impact of that is low, which makes the decision easier.
- The domain controller is not isolated casually - that is an outage. Instead check for new accounts, GPO changes, krbtgt access and DCSync indicators, and be ready to pull it.
Record each decision and the evidence behind it; that record is what justifies the business impact afterwards.
3. What evidence do you preserve, and what are your first notifications?
Read the worked answer
Preserve before anything is reimaged, and notify in parallel rather than in sequence.
Evidence:
- A live memory image from the workstation, hashed, captured before containment is released.
- The scheduled task XML, the binary and its hash; raw EDR telemetry rather than the console summary; Windows event logs from the file servers and the domain controller.
- Identity provider and VPN authentication logs covering the foreign IP, plus the user's travel records to test her account of the night.
- Chain of custody: who collected what, when, with which tool, hash and storage location. Analysis runs on copies.
Notifications, in parallel:
- IR lead and CISO - invoke the plan, name an incident commander and a scribe.
- Legal counsel, engaged early so investigation can be directed under privilege and the regulatory clock assessed if finance or personal data is involved.
- Privacy office and cyber insurer per policy; law enforcement is a management decision taken with counsel, not an analyst's.
Do not contact the attacker, and do not reimage the host until IR and counsel agree the evidence is sufficient.