Classic phishing steals credentials. AiTM proxies the real login in real time - Marcus authenticates including MFA, but the attacker's proxy captures the session cookie. That cookie is replayed without credentials or MFA. Key lesson: user self-released this email from quarantine. DMARC worked - user override defeated it. Document this as a process gap. This is also why FIDO2/passkeys are the only MFA that defeats AiTM - they bind the challenge to the origin domain, so the proxy can't relay it.

Resetting Marcus's password won't remove the attacker's session - you must revoke all Entra tokens. Also: the OAuth app registered at 09:08 persists even after token revocation. It's a second persistence mechanism that must be removed separately. This two-step persistence (token + OAuth app) is standard attacker practice to survive remediation. Walk through the Sessions tab - ask students: "How do you tell which session is the attacker's without geolocation?"

Walk through the timeline chronologically. The key detection opportunity is at 08:47:45: chrome.exe renderer spawning cmd.exe. This is almost never legitimate - browser renderers operate in sandboxed processes and should never interact with the shell. PowerShell script block logging would have captured the decoded payload. The Registry Run key in HKCU (user space) is chosen to avoid needing admin rights - the dropper runs entirely as marcus.chen with no privilege escalation.

Isolate first - cuts all network paths simultaneously. Then revoke tokens. Then kill the process. If you kill C2 first, the attacker may trigger a secondary persistence mechanism. The browser→cmd→powershell chain is a classic click-to-execute dropper - chrome renderers should never spawn cmd.exe. That's your smoking gun in the process tree. Also: network isolation happens at the EDR agent level, so even if FINANCE-WS-07 is plugged in, it can't route traffic to the internet or the internal network during isolation.

Walk through each phase left-to-right. This incident touches 9 tactics and 10 techniques - it's a comprehensive campaign, not a smash-and-grab. Focus on the detection gap conversation: the attacker used Tor (T1090.003) throughout, so IP-based blocking was difficult. The persistence via OAuth app (T1098.001) is particularly important because it survives all identity remediation except explicit app removal.

Filter by the malicious session IP (185.220.101.47) to isolate only attacker actions. The OAuth app at 09:08 is critical - it persists after token revocation and must be removed separately. File access events show exactly what was read. Download events show exfil. The UAL is your forensic record of everything the attacker did inside M365 under Marcus's identity. Click "Exfil" filter to see the full exfiltration picture.

Each IOC is a jumping-off point. The phishing IP may have hit other employees. The C2 IP connects to other hosts. The encoded PowerShell pattern is a dropper signature - hunt it across all endpoints. Every additional hit expands your blast radius assessment and may change the incident from "one user" to "domain-wide." The hunt on 45.142.212.100 reveals a second C2 channel on OKAFOR-WS-01 - the incident scope widens significantly.

Click "Reveal Next Why" to walk through the chain step-by-step. The critical insight is that there are TWO independent root causes - either one being in place would have prevented the breach. This is a defense-in-depth lesson: security is about layers. Emphasize: "The user clicked" is NEVER a root cause. The question is always "what control should have caught this even if the user clicked?"