Who you gonna call?
Nine and a half alerts no security analyst wants to see

I have this one earworm whenever I built a certain type of alert.

Even now, the refrain pops up immediately. Please don't ask me why my brain built this link, but it's so apt.

It is the part of the refrain "Who you gonna call?" and then the sound of this unmistakable siren.

(I apologize in advance for a possible earworm.)

These nine and a half rules in the SIEM triggered the reflex.

Even though I have written some things in a very humorous way, I hope you never have to see these alerts.

And more importantly, that you have these alerts.

Someone is building mail infrastructure that looks like yours. An MX record on a typo domain, that is weaponizing.

This should not be a problem for you, because you surely block lookalike domains from outside.

But what about your customers and suppliers? If they now receive an email from "your company" with "new" bank details.

Devices that are not in inventory. Either maintenance is done somewhere with a contaminated client, or shadow IT with a certain "extra" checks in.

Both mean: as long as the malware is deleted/blocked right away, a "relaxed" search for the cause. But if the malware has been reported "not cleaned", it gets hectic.

A PLC has no reason to explore the Internet. Something in manufacturing wants to phone home. And we all know it's not E.T.

On top of that, it is the part of the network where you patch the least, see the least, and are least allowed to shut anything down.

Unfortunately, not a spontaneous vacation for the admin. The password and probably the second factor are no longer his. And whoever has Intune can ... well, I leave that to your imagination. My guess is a script for all managed devices of the company. The script probably includes some kind of "encryption service".

Question: is this a new cloud service that was purchased and nobody was informed? Or is it the exfiltration before the encryption. The preparation for double extortion, while you are reading the alert. What makes this alert so relaxed: the GBs are already on their way.

A client has just picked up all the password hashes of the domain, including krbtgt. The one and only Golden Ticket is now available for your personal threat actor. If true positive, then it is "goodbye, plans for the next few weeks". First, reset krbtgt twice and renew all credentials. If in doubt, rebuild the domain. Hopefully you have a good incident response plan and have tested it before.

This alert triggers the same reflex as 4.a. Only the attacker is already sitting on the DC and doing credential dumping. It is not just one account that is compromised. No, it's the company. What does your security zone say? Is the directory service also used for production? And here we are again with the good incident response plan.

The attacker removes the shadow copies. If you see this now, the attacker has already done 5 and 4 without you noticing. And so that nothing can be restored, "the disk space is freed up again". This is usually the last step before number 2. From now on, it only takes minutes for the last two.

The time has come. From now on, disconnect everything that was in the same blast zone from the network. Make a lot of coffee, even if you don't like it. Coffee is meant literally, but a symbolic act will do. It will take a while until the company runs "smoothly" again.

On to the restore. But from when? How can you be sure the backups are clean?

So everything (yes, everything: servers, clients, handhelds, scanners, printers, ... factory reset says hello) gets rebuilt, and only files that were checked beforehand get restored.

What can I say? I would already knock on marketing's and legal's door so the CEO and the statements are prepared.

And remember the NIS2 (24h) / GDPR (72h) reporting deadlines. So you might as well file a report with one authority or the other now.

Because the world knows now, too.

To be honest, I have seen four from this list. I aged many years in the process, even though they turned out to be false positives.