LSASS Access and SMB Lateral Movement at 02:14

1. Verify and scope from EDR telemetry. Pull the process tree, command lines, parent process, scheduled-task creation, and the 14 SMB destinations. Confirm whether the domain-admin use is a real interactive logon, a service, or a scheduled task. This determines whether this is one workstation or a domain-wide event.

2. Contain WKS-4471 with EDR network isolation, not a shutdown. Isolation stops SMB lateral movement while preserving volatile memory and the live EDR session. Shutting down or reimaging destroys memory-resident evidence and may tip off the attacker. In parallel, ask the identity team to disable the shared domain-admin account and reset its password, but preserve logs first.

3. Escalate to the on-call IR lead and start triage on the 14 contacted hosts. Check for the same unsigned binary, scheduled tasks, and SMB sessions. Because 300 legacy medical devices have no EDR, ask network operations to isolate their VLAN if the 14 hosts include any of them.

Preserve memory immediately after isolation, then collect disk evidence. Do not reboot. The backup completion at 01:50 is useful for recovery, but verify the backup itself was not accessible from the compromised account.

A shared account destroys attribution. You cannot assume only the help-desk technician on WKS-4471 is involved; all four technicians, their workstations, and any jump hosts they used must be treated as potentially compromised. The account also has domain-admin rights, so the scope may include domain controllers, scheduled tasks, services, and Group Policy.

Containment steps:

• Disable the shared account and force a password reset, but first capture current sessions and logon events.
• Revoke Kerberos tickets. If a domain-admin credential was used after the suspected compromise, plan a double krbtgt reset with replication waits, because a Golden Ticket may exist.
• Audit domain controllers for event IDs 4624, 4672, 4768, and 4769, and review scheduled tasks and services created in the last 24 hours.
• Triage all four technicians' endpoints and any shared IT jump server.
• Replace the shared account with named privileged accounts and a PAM workflow.

The initial EDR alert is now a domain-level incident, not a single-endpoint malware case.

Recommend a short delay for evidence capture, not an indefinite hold. Reimaging destroys memory, volatile network state, and local artifacts that show initial access and whether data was staged. The machine is already isolated, so the immediate lateral-movement risk is contained. Capture memory first, then a disk image or at least a forensic triage package, then rebuild. If the IR lead has confirmed active ransomware staging or a domain-wide destructive payload, containment and rebuild can take priority, but still capture volatile data if it takes only minutes.

Business context matters: 6,000 endpoints and a flat network mean the attacker could move quickly, and the 300 legacy medical devices are a soft target. Recommend isolating those devices' VLAN, checking the 14 SMB targets, and validating the 01:50 backup before restore. Reimaging one workstation does not fix the shared domain-admin exposure. Get IR-lead approval for the evidence step and document the decision, including any legal or regulatory hold.