Analyze security breach, assess risks, and execute containment plan
Review all forensic data before beginning your response
You are a Junior Cybersecurity Analyst in TechNova's Security Operations Center (SOC). The Senior Analyst is on vacation, and the CISO needs an immediate threat assessment and containment plan. Your responsibilities: (1) Classify the threat using MITRE ATT&CK framework, (2) Assess risk to critical assets using Impact × Likelihood scoring, (3) Build NIST-compliant incident response plan, (4) Define forensic investigation approach.
Success Criteria: Contain the threat before data exfiltration occurs, preserve forensic evidence, minimize business disruption, and prevent reinfection. Speed matters—attackers are active in the environment right now.
TechNova is a B2B SaaS platform providing project management and collaboration tools to mid-market companies. Founded in 2016, TechNova has grown to 500 employees across engineering (220), sales/marketing (150), customer success (80), and corporate functions (50). The company generates $45M ARR with 2,400 enterprise customers.
Technology Stack:
ALERT CATEGORY 1: Compromised Email Accounts (12 accounts)
| Employee Email | Department | Phishing Email Sent To | Email Content |
|---|---|---|---|
| [email protected] | Sales | 45 external contacts | "Urgent: New Compensation Policy" + malicious link to fake TechNova portal (technova-portal[.]com) |
| [email protected] | Marketing | 38 external contacts | Same content, same malicious link |
| [10 additional accounts] | Sales/Marketing | ~400 total recipients | Identical phishing campaign |
Analysis: Attackers gained access to 12 employee email accounts (likely through credential stuffing or password reuse from prior breaches). Used accounts to send convincing phishing emails to TechNova's customer base and partners. This is a business email compromise (BEC) attack designed to steal credentials from TechNova's customers and damage reputation.
ALERT CATEGORY 2: Failed Login Attempts - HR Database (34 attempts)
| Source IP | Country | Username Targeted | Attempts | Time Window |
|---|---|---|---|---|
| 185.220.101.47 | Russia | db_admin, hr_admin, root | 18 | 08:47-09:12 (25 min) |
| 116.62.18.234 | China | hr_admin, backup_user | 12 | 08:52-09:18 (26 min) |
| 179.43.155.92 | Brazil | root, postgres | 4 | 09:05-09:11 (6 min) |
Analysis: Coordinated credential stuffing attack targeting HR database containing 500 employee records with SSN, banking information, and salaries. Attackers used lists of common usernames and passwords (likely obtained from public data breaches). Attack failed due to strong database passwords, but demonstrates attackers know TechNova's internal architecture. HIGH PRIORITY - If successful, attackers would have access to sensitive PII.
ALERT CATEGORY 3: Suspicious Executable Downloads (3 files)
| Filename | Size | Upload Time | Uploaded By | EDR Detection |
|---|---|---|---|---|
| Q4_Financial_Report.exe | 2.8 MB | 09:23 AM | [email protected] | Flagged: Ransomware indicators (Lockbit 3.0 signature) |
| HR_Handbook_2024.exe | 1.4 MB | 09:25 AM | [email protected] | Flagged: Obfuscated PowerShell dropper |
| Client_Contracts.exe | 3.1 MB | 09:27 AM | [email protected] | Flagged: Credential harvester + keylogger |
Analysis: Three employees downloaded and executed malicious files disguised as legitimate business documents. CrowdStrike Falcon detected and quarantined files before execution, but this indicates a spear-phishing campaign successfully delivered malware to employee workstations. Files show hallmarks of ransomware staging—attackers are preparing for data encryption. CRITICAL PRIORITY - If ransomware deploys, entire company could be locked out of systems.
Map observed attacker behaviors to industry-standard threat taxonomy:
| MITRE Tactic | Technique ID | Technique Name | Evidence in TechNova Incident |
|---|---|---|---|
| Initial Access | T1566.002 | Phishing: Spearphishing Link | 12 compromised email accounts sent phishing emails; 3 employees downloaded malicious executables |
| Initial Access | T1078 | Valid Accounts | 34 failed login attempts using real employee usernames (credential stuffing) |
| Execution | T1204.002 | User Execution: Malicious File | Employees executed .exe files disguised as business documents |
| Persistence | T1078.003 | Valid Accounts: Local Accounts | Attackers attempting to establish persistent access via compromised credentials |
| Credential Access | T1110.004 | Brute Force: Credential Stuffing | 34 automated login attempts on HR database from 3 external IPs |
| Collection | T1005 | Data from Local System | 2.3 GB uploaded from 2 workstations—likely harvesting files for exfiltration |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | 2.3 GB data uploaded to 104.21.35.88 (Cloudflare CDN, possible C2 infrastructure) |
| Impact | T1486 | Data Encrypted for Impact | Ransomware indicators in Q4_Financial_Report.exe (Lockbit 3.0 signature) |
TechNova's Crown Jewels (in priority order):
| Asset | Data Stored | Current Risk Level | Impact if Compromised |
|---|---|---|---|
| Customer Database | 285K customer records: names, emails, payment info, usage data | HIGH | Regulatory fines (GDPR, CCPA), customer churn, class-action lawsuit, reputation damage. Estimated cost: $15-25M |
| HR System (BambooHR) | 500 employee records: SSN, banking details, salaries, performance reviews | HIGH | Identity theft for employees, regulatory fines, employee morale collapse. Estimated cost: $2-5M |
| Source Code Repository | Proprietary SaaS platform code, algorithms, API keys, infrastructure configs | MEDIUM | Competitive disadvantage, exposure of vulnerabilities, IP theft. Estimated cost: $5-10M |
| Customer File Storage (S3) | Customer-uploaded documents, contracts, project files (2.8 TB) | HIGH | Customer data breach, loss of trust, contractual liability. Estimated cost: $3-8M |
| Internal Email (Microsoft 365) | Business communications, customer emails, internal strategy discussions | MEDIUM | BEC attacks, competitive intelligence leak, customer relationship damage. Estimated cost: $1-3M |
Risk Scoring Methodology:
| Asset | Impact (1-5) | Likelihood (1-5) | Risk Score | Priority |
|---|---|---|---|---|
| HR System | 5 | 5 | 25 | CRITICAL - 34 active attack attempts |
| Customer File Storage | 5 | 5 | 25 | CRITICAL - 2.3 GB already exfiltrated from S3 |
| Customer Database | 5 | 4 | 20 | HIGH - Attackers probing, no breach yet |
| Internal Email | 4 | 5 | 20 | HIGH - 12 accounts already compromised |
| Source Code Repository | 4 | 3 | 12 | MEDIUM - Attack failed due to 2FA |
STAGE 1: DETECTION & ANALYSIS (Currently in this phase)
STAGE 2: CONTAINMENT (Immediate priority - next 4 hours)
STAGE 3: ERADICATION (Post-containment - 24-48 hours)
STAGE 4: RECOVERY (48-72 hours post-containment)
STAGE 5: POST-INCIDENT ACTIVITY (Ongoing)
SIEM Queries (Splunk):
EDR Forensics (CrowdStrike Falcon):
Email Header Analysis:
Threat Intelligence Enrichment:
INTERNAL COMMUNICATIONS (Immediate - within 4 hours):
EXTERNAL COMMUNICATIONS (If data breach confirmed - 72 hours):
LEGAL/PR CONSIDERATIONS:
Identify attack type, map to MITRE ATT&CK, and assess scope
Industry-standard framework for classifying adversary tactics and techniques. Enables defenders to:
The 2.3 GB data exfiltration is the most critical finding because it represents a double-extortion ransomware attack—attackers are stealing data BEFORE encrypting it. This is significant for three reasons. First, the exfiltration occurred between 10:05-10:20 AM, after CrowdStrike Falcon quarantined the ransomware executables at 09:23-09:27 AM. This proves the attackers had established a separate persistence mechanism (likely through the 12 compromised email accounts), meaning the ransomware was just one attack vector, not the only one. The attackers maintained access even after their malware was blocked, demonstrating sophistication and preparation. Second, 2.3 GB is substantial—it could contain the entire customer database (285K records), sensitive HR data, or proprietary source code. This volume suggests targeted data theft, not opportunistic file grabbing. The attackers knew what they wanted and had time to stage it for exfiltration. Third, and most critically, double-extortion fundamentally changes the threat model. Traditional ransomware relies on encryption: pay the ransom or lose access to your data. Companies with good backups can refuse to pay. But when attackers exfiltrate data first, they can threaten to publicly release it even if TechNova restores from backups. This means TechNova faces regulatory fines (GDPR, CCPA), customer lawsuits, and reputation damage regardless of whether systems are restored. The attackers have leverage even if we successfully defend against the ransomware. This is why exfiltration is more dangerous than encryption alone—it creates liability that can't be solved with backups or disaster recovery.
Score threats using Impact × Likelihood and prioritize response
Effective triage requires quantifying risk to make data-driven decisions:
Focus resources on highest-risk assets first, even if other issues seem more visible.
First 60 minutes prioritized action list:
Priority 1 - HR System (Risk Score 25, active attack): Immediately block all three attacking IP addresses (185.220.101.47, 116.62.18.234, 179.43.155.92) at the perimeter firewall and create a deny rule for the entire /24 subnet of each IP to prevent attackers from simply changing to a nearby address. Then enable AWS Security Group rule to restrict SSH access to HR database server (10.0.2.15) to ONLY the internal IT team's IP range (e.g., 10.0.1.0/24). This stops the 34 active login attempts immediately while preserving access for legitimate administrators. Expected outcome: Terminate active attack in progress, prevent any future attempts from same threat actor infrastructure. This is highest priority because attackers are actively trying to breach the system containing employee SSNs and banking information.
Priority 2 - Customer File Storage (Risk Score 25, active exfiltration): Immediately isolate the two compromised workstations (10.0.5.42 and 10.0.5.67) by disabling their network interfaces via CrowdStrike Falcon remote agent or physically disconnecting network cables if remote access fails. Then enable CloudTrail logging alerts for any S3 GetObject or ListBucket API calls from these IP addresses and block their IAM credentials. This stops the ongoing 2.3 GB data exfiltration that's actively occurring. Expected outcome: Halt data theft in progress, prevent attackers from accessing additional files in S3 bucket. This is second priority because data is actively being stolen right now—every minute of delay means more data loss.
Priority 3 - Internal Email (Risk Score 20, 12 compromised accounts): Force immediate password reset on all 12 compromised email accounts via Microsoft 365 admin console, then enable mandatory MFA (Microsoft Authenticator app) before allowing re-login. Simultaneously revoke all active OAuth tokens for these accounts to terminate any persistent sessions attackers might have. Expected outcome: Kick attackers out of email accounts, prevent continued phishing campaign or lateral movement. This is third priority because while serious, the phishing emails have already been sent—containment now limits future damage.
Priority 4 - Customer Database (Risk Score 20, not yet under attack): Enable AWS RDS database activity monitoring (DAM) with real-time alerting for any SELECT queries that return >1000 rows (indicator of bulk data extraction). Then rotate the database master password and update it in application configurations. Expected outcome: Early warning system if attackers shift focus to customer database, plus credential rotation removes any leaked credentials from circulation. This is fourth priority because there's no evidence of active attack yet—we're being proactive rather than reactive here.
Build NIST-compliant response plan with containment, eradication, and recovery phases
Structured approach to handling security incidents:
PHASE 1: SHORT-TERM CONTAINMENT (0-4 hours, immediate actions)
Timeline: Execute by 3:00 PM today (4 hours from now, 11:18 AM current time)
Objective: Stop active attacks and data exfiltration while preserving forensic evidence
Actions: (1) Network isolation: Physically disconnect or disable network adapters on 2 compromised workstations (10.0.5.42, 10.0.5.67) to halt 2.3 GB data exfiltration. Do NOT power off systems—preserve memory for forensic analysis. (2) Firewall blocking: Create deny rules for 3 attacking IPs (185.220.101.47, 116.62.18.234, 179.43.155.92) and the C2 server IP (104.21.35.88) at perimeter firewall. (3) Email lockdown: Force password reset on 12 compromised email accounts via M365 admin panel; revoke all active OAuth tokens; enable mandatory MFA before re-access. (4) Database access restriction: Modify AWS Security Group for HR database (10.0.2.15) to allow SSH only from IT admin subnet (10.0.1.0/24), blocking all external access. (5) Evidence preservation: Take memory dumps from 2 compromised workstations using CrowdStrike Falcon; export SIEM logs from past 7 days to external storage; screenshot all alert dashboards.
Responsible Teams: SOC (lead), IT Operations (network changes), CISO (authorization for aggressive actions)
Success Criteria: Zero ongoing data exfiltration confirmed via netflow monitoring; no new failed login attempts on HR database; no new phishing emails sent from compromised accounts; all forensic evidence securely preserved
PHASE 2: LONG-TERM CONTAINMENT (4-24 hours, strengthen defenses)
Timeline: Complete by 11:00 AM tomorrow
Objective: Harden environment to prevent reinfection and lateral movement while preparing for eradication
Actions: (1) MFA deployment: Enable mandatory MFA on all critical systems—AWS console, HR database SSH access, GitHub Enterprise, VPN login, customer database admin panel. Use Duo Security for centralized MFA management. (2) EDR expansion: Deploy CrowdStrike Falcon to remaining 40% of endpoints (200 devices) without coverage; prioritize finance, HR, and executive workstations. (3) Network segmentation: Create VLAN for HR/finance systems (10.0.2.0/24); implement firewall rules requiring VPN + MFA for access from general employee network (10.0.5.0/24). (4) SIEM enhancement: Increase Splunk log retention from 7 days to 90 days; enable real-time alerting for: failed login attempts >3 in 10 min, large data transfers >100MB outbound, process execution of .exe files from user download folders. (5) Email security upgrade: Configure Proofpoint to quarantine all emails with executable attachments (.exe, .scr, .bat); enable Advanced Threat Protection for URL rewriting and sandbox analysis.
Responsible Teams: IT Security (lead), Network Engineering (segmentation), IT Operations (MFA rollout)
Success Criteria: 100% of critical systems require MFA; all endpoints have EDR deployed and reporting to console; network segmentation tested and validated; SIEM alerting confirmed operational
PHASE 3: ERADICATION (24-48 hours, remove attacker presence)
Timeline: Complete by 11:00 AM in 2 days
Objective: Remove all attacker access, malware, and persistence mechanisms from environment
Actions: (1) Workstation reimaging: Wipe and rebuild 2 compromised workstations (10.0.5.42, 10.0.5.67) from gold image; reinstall applications; restore user data from pre-infection backup. (2) Comprehensive credential rotation: Force password reset for ALL 500 employees (not just 12 compromised accounts)—use automated script via Active Directory; rotate ALL AWS IAM access keys and secret keys; change database master passwords for customer DB, HR DB, and all application databases. (3) Malware removal: Use CrowdStrike Falcon to scan all 500 endpoints for IOCs associated with Lockbit 3.0 ransomware; quarantine any additional malware discovered; verify clean status via secondary scan with Microsoft Defender. (4) Backdoor hunting: Review all scheduled tasks, startup items, and services across Windows/Mac/Linux systems for persistence mechanisms; check for webshells in web server directories; audit AWS IAM for unauthorized roles or users. (5) Log analysis: Complete forensic timeline using SIEM—identify first compromise, lateral movement, data accessed; confirm no additional compromised accounts beyond original 12.
Responsible Teams: SOC (forensic analysis), IT Operations (credential rotation, system rebuilds), Security Engineering (backdoor hunting)
Success Criteria: All affected systems rebuilt and validated clean; 100% credential rotation complete; no persistence mechanisms detected; forensic timeline complete documenting full attack chain
PHASE 4: RECOVERY (48-72 hours, restore operations)
Timeline: Complete by 11:00 AM in 3 days
Objective: Return systems to production with enhanced monitoring and user training
Actions: (1) System restoration: Return 2 rebuilt workstations to users after mandatory security training; restore email access for 12 affected users after MFA enrollment and password change verified. (2) Enhanced monitoring: Deploy 30-day intensive monitoring—flag any login from affected user accounts, any access to S3 buckets from new IPs, any process execution matching ransomware IOCs. Create dedicated Splunk dashboard for incident-related alerts. (3) User training: Mandatory 30-minute security awareness training for all 500 employees covering: phishing recognition, password hygiene, MFA usage, suspicious file identification. Track completion via LMS. (4) External communication: If data breach confirmed (2.3 GB exfiltration contained PII), send notification emails to affected customers within 72 hours per GDPR/CCPA; offer 1 year credit monitoring; publish transparency report on TechNova blog. (5) Validation testing: Conduct penetration test from external firm to verify remediation effective; attempt to replicate original attack vectors; validate MFA enforcement and network segmentation.
Responsible Teams: IT Operations (restoration), HR (training coordination), Legal/PR (external comms), CISO (validation testing)
Success Criteria: All affected users back in production; zero reinfection indicators detected; 100% employee training completion; external validation (pentest) confirms controls effective; customer/regulatory notifications sent if required
Define investigation approach and identify process improvements
Effective forensics answers five questions:
EXECUTIVE SUMMARY: TechNova Security Incident - January 5, 2024
Incident Overview: On January 5 at 07:42, TechNova detected a sophisticated multi-vector cyberattack targeting our customer data, HR systems, and internal infrastructure. The attack involved 12 compromised employee email accounts sending phishing campaigns, 34 automated login attempts on our HR database from foreign IPs (Russia, China, Brazil), three ransomware executables delivered to employee workstations, and 2.3 GB of data actively exfiltrated to external servers. This represents an advanced persistent threat (APT) with hallmarks of organized cybercrime, not opportunistic hacking. The attack was contained within 4 hours before catastrophic data breach occurred, but the incident exposed significant security gaps requiring immediate investment.
Scope of Compromise: 12 employee email accounts (sales/marketing teams) were compromised and used to send ~400 phishing emails to TechNova customers and partners, creating reputation risk and potential customer credential theft. Three employees downloaded ransomware executables (Lockbit 3.0 variant), but CrowdStrike Falcon quarantined malware before execution—this was our primary successful defense. Most concerning: 2.3 GB of data was exfiltrated from 2 workstations to attacker-controlled servers between 10:05-10:20 AM. Forensic analysis is ongoing to determine exact data stolen, but risk includes customer contracts, internal documents, and potentially source code. HR database containing 500 employee SSNs and banking information was targeted but NOT successfully breached due to strong passwords and firewall rules. Customer database (285K records) was NOT directly attacked but remains at risk if attackers maintained persistent access.
Financial Impact Assessment: Direct costs: $350K incident response (internal labor + external forensics firm + legal counsel), $50K CrowdStrike EDR deployment to remaining endpoints, $200K mandatory security awareness training for all employees. Potential costs if data breach confirmed: $2-5M regulatory fines (GDPR/CCPA violations if customer PII was exfiltrated), $1-3M customer credit monitoring and notification, $5-15M in customer churn and reputation damage, potential class-action lawsuit exposure. Total estimated exposure: $8-23M if worst-case breach confirmed. Insurance covers up to $10M under cyber policy (minus $250K deductible). Avoided costs through successful containment: $50M+ if ransomware had encrypted all systems and customer database had been stolen—our response prevented catastrophic outcome.
Root Cause Analysis: Three critical security gaps enabled this attack: (1) No MFA on VPN or most internal systems—attackers used stolen credentials (likely from third-party breaches) to access email accounts and attempt database logins. MFA would have blocked 100% of credential-based attacks. (2) Incomplete EDR deployment—only 60% of endpoints had CrowdStrike Falcon; the 40% gap included workstations that downloaded malware. EDR on those systems would have provided earlier detection. (3) Insufficient email security—Proofpoint basic plan doesn't sandbox attachments or rewrite URLs; advanced plan ($15K/year) would have detected malicious executables before delivery. (4) Weak network segmentation—HR/finance systems on same network as general employees, allowing lateral movement if attacker gained workstation access. (5) Inadequate SIEM logging—7-day retention insufficient for forensic investigation; couldn't trace full attack timeline because logs expired.
Response Effectiveness: What worked: SOC detected initial phishing within 33 minutes; CrowdStrike Falcon successfully quarantined ransomware before execution; strong database passwords prevented HR system breach; rapid containment (4 hours) stopped data exfiltration before terabytes were stolen. What didn't work: No automated alerting on large data transfers—2.3 GB exfiltration occurred undetected for 15 minutes until manual review; no MFA meant compromised credentials granted full access; 40% EDR gap allowed malware delivery to go unmonitored initially; SIEM log retention too short to reconstruct full attack timeline (attackers likely had access days/weeks before we detected them).
Strategic Recommendations: Immediate investments (0-30 days, $500K budget): (1) Deploy MFA across ALL systems (VPN, AWS, M365, GitHub, databases)—$50K implementation + $10K/year licenses. This single control would have prevented 80% of this attack. (2) Complete CrowdStrike Falcon deployment to 100% of endpoints—$50K for remaining 200 licenses. (3) Upgrade Proofpoint to Advanced Threat Protection tier—$15K/year for sandbox analysis and URL rewriting. (4) Increase SIEM retention to 90 days and add real-time alerting for large data transfers—$30K Splunk license upgrade. Medium-term investments (30-90 days, $300K): Implement Zero Trust network architecture with micro-segmentation isolating HR/finance systems; hire additional SOC analyst to provide 24/7 coverage (currently 8am-6pm only); conduct third-party penetration test to validate remediation. Long-term strategy (6-12 months): Security awareness training program with quarterly phishing simulations; formal incident response retainer with external firm for future events; consider cyber insurance policy limit increase from $10M to $25M given growing threat landscape. Total investment: $800K in Year 1, $150K annually thereafter. This is 1.8% of revenue but prevents $20M+ downside risk.
Review your cybersecurity performance
Calculating...