LockBit Claim vs. EDR Silence on a Segmented Finance VLAN
At 06:40 on Monday, a threat-intel feed reports that a LockBit affiliate has listed a 40 GB data theft claim against Northwind Financial on its leak site, with a 72-hour deadline. Northwind has 1,800 endpoints, CrowdStrike Falcon, Suricata at the internet edge, NetFlow, and a 60-host finance VLAN (10.20.0.0/24) with no direct internet access. Falcon shows no ransomware detections. However, FIN-WS-17 and FIN-WS-22 both spawned PowerShell from Excel at 02:13 and 02:17, wrote to the finance NAS over SMB, and sent 14 MB through the authenticated proxy to 185.199.108.153 over HTTPS. Proxy logs show user-agent 'Mozilla/5.0' with no browser process on the host. Helpdesk has a ticket: a finance analyst opened Invoice_2024.xlsm at 02:05. No files are encrypted, and backups are immutable but only for 14 days. The CISO wants to know whether this is an active intrusion, a false claim, or extortion, and how far to contain before the London market opens at 08:00.
1. State the three most likely hypotheses and the specific evidence that would raise or lower each. What would you query first in Falcon and proxy logs, and why?
Read the worked answer
Hypotheses.
- Active intrusion with staging and possible exfiltration, with ransomware not yet deployed. The Excel-to-PowerShell chain, SMB writes to the NAS, and proxy POST are consistent with a loader or affiliate hands-on-keyboard activity.
- Commodity macro infection or red-team test that has not reached ransomware, with the leak-site claim being opportunistic or false.
- Insider or finance workflow using an unapproved macro, with the external POST being unrelated vendor traffic.
Evidence that raises hypothesis 1. PowerShell command line containing encoded content, download cradle, certutil, rclone, 7z, or archive creation; PowerShell spawned by Excel with a suspicious macro; writes to multiple finance shares; proxy POST bytes inconsistent with normal finance traffic; destination IP not in approved vendor inventory; same file hash on other hosts.
Evidence that lowers it. The macro is signed and approved, the PowerShell is a known finance add-in, the destination resolves to an approved SaaS tenant, and the proxy user-agent matches a browser process that Falcon recorded.
First queries. In Falcon event search, query event_simpleName=ProcessRollup2 for FIN-WS-17 and FIN-WS-22 from 01:55 to 02:30, filtering on ParentBaseFileName=EXCEL.EXE and returning CommandLine, ImageFileName, UserName, SHA256, and ParentProcessId. Pivot to NetworkConnectIP4 for 185.199.108.153 and DnsQueryRequest for the same hosts. In proxy logs, pull the full URL, method, request bytes, response bytes, authenticated user, TLS SNI, and user-agent, then compare against the user's 30-day baseline. The absence of encryption does not close the case; theft can precede encryption or replace it.
2. Given the 08:00 deadline, what containment and evidence-preservation actions do you take on the two hosts and the finance VLAN? What do you not do, and why?
Read the worked answer
Contain the two hosts first, not the whole VLAN. Use Falcon network containment on FIN-WS-17 and FIN-WS-22 to cut C2 and lateral movement while keeping the endpoints alive for memory and disk collection. Preserve volatile evidence before any reboot: Falcon triage package, running processes, network connections, PowerShell operational logs, prefetch, scheduled tasks, and the Excel file plus macro source. If the machine cannot be contained without disruption, capture memory first, then isolate.
Scope the VLAN before 08:00. Search all 60 finance hosts for the same Excel hash, the same parent-child process pattern, SMB writes to the NAS in the same window, and proxy posts to the same IP or JA3. Pull NAS SMB session logs and file audit events for the two hosts. Add a temporary Suricata alert for the destination IP and for the Excel-to-PowerShell pattern where telemetry allows it.
Do not shut down the VLAN or reimage immediately. A broad shutdown may destroy evidence and stop the business; reimaging before collection loses memory and macro artifacts. Do not contact the attacker or pay. Reset credentials only after identifying which accounts were used; revoke active sessions for the two users and the service accounts seen on those hosts. If VLAN-wide lateral evidence appears, segment the finance VLAN at the switch rather than waiting for 08:00, and notify the CISO with the trade-off.
3. What would change your assessment to confirmed exfiltration and trigger regulatory notification?
Read the worked answer
Confirmed exfiltration requires evidence that data left the environment, not just that a connection existed. Raise confidence if proxy logs show successful HTTPS POSTs with large request bodies from the two hosts, Falcon shows archive creation or file reads from finance shares immediately before the POST, and the destination is not an approved vendor. A 14 MB transfer can be plausible for compressed customer or payroll extracts, so size alone is not exculpatory.
Correlate content and context. Check whether the macro or PowerShell accessed files containing personal or financial data, whether 7z or rar wrote a password-protected archive, and whether the NAS audit log shows bulk reads. Review the leak-site claim for a sample that matches Northwind file naming or a hash. If TLS inspection or proxy metadata shows only a small beacon, call it intrusion with possible staging, not confirmed theft.
Notification is a legal and privacy decision, not a hunter-only call. Escalate to legal and privacy with a timeline and data-type assessment. If confirmed exfiltration includes regulated financial or personal data, start the incident response and notification workflow under policy and applicable law. If the claim is false but the host is compromised, still handle it as an incident; the absence of encryption does not make it benign.