Detailed record & replication

Actions1. Query EDR endpoint sensor for full process creation chain from parent web application process (include command-line arguments, timestamps, and parent-child relationships). 2. Check service-control / Windows service-state log for any recent state changes to the EDR agent service (e.g., stopped or disabled). 3. Cross-reference netmon data with EDR alert time window for outbound connections from workstation-01 — focus on unusual protocols, high volume, or unknown destinations. 4. Isolate workstation-01 from network at perimeter level to prevent potential exfiltration or C2 communication.

Actions1. Query SIEM for all alerts generated by EDR agent on workstation-01 in the 5-minute window preceding the service-stop event (to detect if prior alerts were suppressed or missed). 2. Perform a forensic memory dump of the web application process and its parent chain using local tools (if available) to analyze potential code injection artifacts, focusing on anomalous sections of memory with executable permissions. 3. Check identity/auth logs for svc-backup account activity during the same time window — specifically look for logon events or service impersonation attempts that may indicate credential misuse. 4. Re-enable EDR agent service via local administrative access to test its integrity and confirm whether it can re-establish telemetry; monitor for immediate self-repair behavior or continued disruption.

Actions1. Query EDR endpoint sensor for all process creation events on workstation-01 from the time of the initial exploit alert through the service-stop event, focusing specifically on processes with executable memory regions or anomalous command-line arguments (e.g., PowerShell, wmic, regsvr32). 2. Cross-reference netmon outbound HTTPS transfer data (O4) with process creation events to identify which process initiated the connection — use timestamps and destination IP for correlation. 3. Check service-control log for any other recent state changes to critical security services beyond EDR (e.g., Windows Defender, firewall service). 4. Initiate a full disk forensic image of workstation-01 using local tools to preserve evidence for post-mortem analysis, especially targeting the web application binary and its working directory.

Actions1. Query EDR endpoint sensor for all process creation events on workstation-01 between the initial exploit alert and service-stop event that involve processes with executable memory regions or anomalous command-line arguments (e.g., PowerShell, wmic, regsvr32), focusing specifically on those created after the EDR agent was re-enabled. 2. Correlate netmon outbound HTTPS transfer data (O4) with process creation events from step 1 to identify the initiating process and confirm whether it matches known exfiltration patterns or C2 beaconing behavior. 3. Check identity/auth logs for svc-backup account activity post-re-enablement of EDR agent — specifically look for additional logon attempts, service impersonations, or scheduled task executions that may indicate persistence or ongoing lateral movement. 4. Initiate a full disk forensic image of workstation-01 using local tools to preserve evidence, with priority on the web application binary, its working directory, and any recently modified registry keys related to startup or service configuration.

Actions1. Query SIEM for all alerts related to 'svc-backup' account activity on workstation-01 from the time of initial exploit alert through present, including logon events, service impersonations, scheduled task creations, and any associated process execution metadata. 2. Initiate a memory dump of the web application process and its parent chain using local forensic tools, focusing specifically on executable regions with anomalous code patterns matching known shellcode or injection artifacts; prioritize analysis for signs of indirect injection (e.g., DLL sideloading, process hollowing). 3. Check service-control log for any recent state changes to Windows Defender Service or Firewall Service — confirm they remain active and unmodified post-attack. 4. Block outbound HTTPS traffic from workstation-01 at the perimeter firewall using destination IP of the unfamiliar host (O4) as a permanent deny rule, regardless of process attribution; prevent future exfiltration attempts.

ActionsIsolate workstation-01 from the network; query SIEM for prior EDR alerts on this host; initiate investigation into service-control log to confirm EDR service status (bb:invEdr); validate that dfExploit is live and enriched via EDR telemetry

Actionsquery netmon for outbound HTTPS traffic from workstation-01; initiate investigation into identity/auth logs for service account svc-backup; validate dfExfil face health (trigger + enrichment) using available telemetry

Actionsinitiate investigation into identity/auth logs for service account svc-backup to confirm credential usage post-step 3; query netmon for volume and pattern of outbound HTTPS traffic from workstation-01 to assess exfiltration scale; isolate the host further by disabling the service account svc-backup (if permitted); validate dfEncrypt face health via available telemetry

Actionsquery SIEM for any pre-kill alerts related to mass file modification or bulk encryption activity on workstation-01; initiate host-level forensic acquisition of the EDR service binary and associated driver files from disk (if permitted); validate whether the outbound HTTPS flow observed in netmon exhibits patterns consistent with data exfiltration (e.g., large, periodic, non-standard payloads) using available metadata

Actionsquery SIEM for any alerts related to process-memory access or LSASS reads on workstation-01 prior to step 3; initiate forensic analysis of the EDR service binary and driver files from disk using third-party tooling (if permitted) to detect signs of BYOVD exploitation; validate whether the outbound HTTPS flow in netmon exhibits anomalous timing patterns consistent with exfiltration (e.g., periodic bursts, off-peak activity); confirm that no new process creation or file modification events have occurred on workstation-01 since step 3 via host-level audit logs

Actions1. Query EDR console for full process lineage of the suspicious service spawned from services.exe; 2. Check SIEM for recent event 4624 (successful logon) entries on DC01 with non-interactive or remote session flags, especially from unknown source IPs; 3. Inspect AD/DS access audit logs (event 4662) for any access to domain root or replication-related objects by the service account associated with the suspicious process; 4. Review EDR tamper log on DC01 for signs of agent compromise or recent changes to LSASS protection policies; 5. Initiate network egress monitor scan for outbound connections from DC01 matching known C2 patterns or anomalous protocols.

Actions1. Query EDR console for full registry access telemetry from DC01 during the impaired window to detect any modification of LSASS protection policies or creation of persistence mechanisms; 2. Cross-reference SIEM event 4662 (AD/DS access) with recent service install events (7045) to identify if the malicious service account attempted replication-related operations beyond initial discovery; 3. Inspect EDR process lineage for any child processes spawned by the suspicious service that may indicate credential dumping or lateral movement tools; 4. Initiate forced krbtgt password rotation across all domain controllers as a defensive measure due to confirmed LSASS access and compromised agent integrity; 5. Escalate to IR team with request for full forensic imaging of DC01 and initiate domain-wide audit of service account permissions and replication trust relationships.

Actions1. Query EDR console for full file-access telemetry from DC01 during the impaired window to detect any access or exfiltration of NTDS.dit or other domain database files; 2. Cross-reference SIEM event 4662 (AD/DS access) with recent service account permissions and replication trust relationships identified in IR escalation to determine if any unauthorized accounts had DCSync rights; 3. Initiate domain-wide audit of all service accounts with 'Replication Synchronization' or 'Replicating Directory Changes' privileges, focusing on those not tied to known DCs; 4. Review EDR process lineage for any outbound file transfer attempts from DC01 (e.g., via SMB, HTTP) matching NTDS.dit or LSA secrets dump artifacts; 5. Confirm completion status of krbtgt rotation and validate that all domain controllers have synchronized the new key across the forest.

Actions1. Query EDR console for full process lineage of mimikatz.exe and wmiexec.py to trace their execution context, parent processes, and any subsequent lateral movement attempts; 2. Cross-reference SIEM event 4662 (AD/DS access) with the identified non-DC service account (svc-replica-01) to determine if it was used in a DCSync-style request or replication-based data extraction; 3. Inspect EDR registry access telemetry for any modification of LSASS protection policies, such as disabling Protected Process Light (PPL), during the impaired window; 4. Initiate domain-wide audit of all accounts with 'Replicating Directory Changes' rights to confirm no other unauthorized accounts exist beyond svc-replica-01; 5. Confirm that all domain controllers have synchronized the new krbtgt key and validate that no DC is still using the old key via Kerberos ticket-granting behavior analysis.

Actions1. Initiate immediate revocation of replication rights for service account svc-replica-01; 2. Disable the svc-replica-01 account across all domain systems; 3. Trigger a full domain-wide audit of all accounts with 'Replicating Directory Changes' and 'Replication Synchronization' privileges using native AD tools to confirm no other unauthorized accounts exist; 4. Confirm that all DCs have purged any cached tickets issued under the old krbtgt key via Kerberos ticket-granting behavior analysis; 5. Escalate to the ontology/modeling team with a request for formal coverage gap assessment on DCSync-style attacks and replication-based credential harvesting, including telemetry requirements for future detection.

ActionsQuery EDR console on DC01 for process lineage of the service spawned from services.exe; check registry access telemetry for remote-registry operations; inspect Windows Security log (event 4624) for the originating network logon associated with the session; verify EDR controlStatus and whether degradesTelemetry is true

ActionsInitiate out-of-band investigation via service-control log to confirm EDR agent status; isolate DC01 from network; escalate to IR team with full telemetry package including EDR lineage, registry access logs, and event 4624 details; request immediate krbtgt rotation due to potential credential compromise

ActionsQuery service-control log for EDR agent status confirmation; initiate forced krbtgt rotation via domain admin account; isolate DC01 from network (already done); escalate to ontology/modeling team with full telemetry package including EDR lineage, registry access logs, 4624 and 7045 events, and DCSync-related 4662 directory-service-access audit records; request immediate review of AD/DS auditing configuration for replication control-access-right coverage

ActionsQuery service-control log for EDR agent status confirmation; initiate forced krbtgt rotation via domain admin account; escalate to ontology/modeling team with full telemetry package including DCSync-related 4662 directory-service-access audit records and remote-registry access logs; request immediate review of AD/DS auditing configuration for replication control-access-right coverage

ActionsQuery service-control log for EDR agent status confirmation; initiate forced krbtgt rotation via domain admin account; escalate to ontology/modeling team with full telemetry package including DCSync-related 4662 directory-service-access audit records and remote-registry access logs; request immediate review of AD/DS auditing configuration for replication control-access-right coverage

Actions1. Query DC Security logs for all 4769 events related to account 'j.rivera' within the last 5 minutes; filter by encryption type 0x17 (RC4) and SPN values.
2. Cross-reference with EDR on SQLPROD-01 for any outbound network connections or process creation (e.g., mimikatz, kerberoast tools) initiated by 'j.rivera' during the same timeframe.
3. Check member-server logon events (4624) for 'j.rivera' to confirm session activity on domain-joined systems, especially SQLPROD-01 or other high-value servers.
4. Isolate SQLPROD-01 from network via firewall policy temporarily pending further analysis.
5. Disable account 'j.rivera' immediately via AD management tools.

Actions1. Query DC Security logs for all 4768 events (TGT requests) associated with account 'j.rivera' in the last 5 minutes to detect pre-authentication activity or potential AS-REP roast attempts; filter by encryption type and client IP. 2. Review EDR telemetry on SQLPROD-01 for any process creation involving credential dumping tools (e.g., mimikatz, sekurlsa::logonpasswords) or network exfiltration patterns post-logon event 'svc-mssql'. 3. Check SIEM correlation rule logs to confirm whether the RC4 TGS alert was triggered by a single source IP or multiple IPs — assess for potential lateral movement or tool distribution. 4. Query member-server logon events (4624) across all domain-joined systems for any additional sessions initiated by 'j.rivera' beyond SQLPROD-01, especially on high-value targets like DCs, file servers, or backup hosts. 5. Initiate a forensic artifact collection from SQLPROD-01 via EDR (memory dump, process list, network connections) to preserve evidence of potential post-compromise activity.

Actions1. Query DC Security logs for all 4768 events (TGT requests) associated with the account 'svc-mssql' in the last 5 minutes to detect any pre-authentication activity or potential AS-REP roast attempts; filter by encryption type and client IP. 2. Review EDR telemetry on FILESRV-02 for any process creation, logon events (4624), or network connections initiated by 'svc-mssql' during the same timeframe as the suspicious session — particularly focusing on credential dumping tools or lateral movement patterns. 3. Cross-reference SIEM correlation rule logs to determine if the RC4 TGS alert was triggered from a single source IP or multiple IPs; assess for evidence of tool distribution across systems. 4. Query member-server logon events (4624) across all domain-joined systems for additional sessions by 'svc-mssql' beyond SQLPROD-01 and FILESRV-02, especially on high-value targets such as Domain Controllers or backup servers. 5. Isolate FILESRV-02 from the network via firewall policy pending further analysis.

Actions1. Query DC Security logs for all 4768 events associated with account 'svc-mssql' in the last 5 minutes, focusing on encryption type (0x17 RC4) and client IP to detect any pre-authentication attempts or AS-REP roast activity indicative of credential harvesting. 2. Review EDR telemetry on FILESRV-02 for process creation, logon events (4624), and network connections initiated by 'svc-mssql' during the suspicious session window — specifically hunting for credential dumping tools, lateral movement techniques, or outbound C2 traffic. 3. Cross-reference SIEM correlation rule logs to confirm whether any new RC4 TGS requests have been generated from additional source IPs beyond j.rivera; assess for evidence of tool propagation across systems. 4. Query member-server logon events (4624) across all domain-joined systems for any further sessions by 'svc-mssql' — particularly on high-value targets such as Domain Controllers, backup servers, or file shares with sensitive data. 5. Initiate forensic artifact collection from FILESRV-02 via EDR (memory dump, process list, network connections) to preserve evidence of potential post-compromise activity and confirm the extent of attacker presence.

Actions1. Query DC Security logs for all 4768 events associated with account 'svc-mssql' in the last 5 minutes, focusing on encryption type (0x17 RC4) and client IP to detect any pre-authentication attempts or AS-REP roast activity — despite prior absence, confirm no new anomalies. 2. Review EDR telemetry on FILESRV-02 for process creation involving data exfiltration tools (e.g., PowerShell scripts, SQL dump utilities), network connections to external IPs, and file access patterns consistent with reconnaissance or data harvesting. 3. Cross-reference SIEM correlation rule logs to confirm whether any new RC4 TGS requests have been generated from additional source IPs beyond j.rivera — assess for evidence of tool propagation across systems. 4. Query member-server logon events (4624) across all domain-joined systems for any further sessions by 'svc-mssql' on high-value targets such as Domain Controllers, backup servers, or sensitive file shares — particularly focusing on non-standard timing or source IPs. 5. Initiate full forensic artifact collection from FILESRV-02 via EDR (memory dump, process list, network connections) to preserve evidence of attacker persistence and confirm scope of data exfiltration.

ActionsQuery DC Security logs for 4769 events from j.rivera within the last 15 minutes; isolate SQLPROD-01 via EDR; reset the password of the service account associated with the most frequently requested SPN (based on 4769 volume); verify AD-SIEM control status and check for any recent impairment alerts.

ActionsQuery DC Security logs for 4769 events from j.rivera with enc-type=0x18 (AES) in the last 15 minutes to detect low-and-slow or AES-only Kerberoast variants; initiate a correlation rule tuning request to deploy dfKerbVolume (sourcedFrom AD-SIEM, reading obsSpnHarvest) as a new detect-face with L4 robustness ceiling; verify SQL-EDR control status and assess whether any enrichment dependencies are missing that could degrade dfSqlLogon; disable j.rivera account pending further investigation.

ActionsQuery DC Security logs for 4769 events from j.rivera with enc-type=0x12 (AES) over the last 3 hours to detect low-and-slow Kerberoast patterns; initiate a formal request to deploy dfKerbVolume as a new correlation rule in AD-SIEM, citing MC policy admission rank 4 and need for L4 robustness via obsSpnHarvest; verify that no other accounts are exhibiting similar SPN harvesting behavior using the same volume/diversity threshold (10+ distinct SPNs in 5 minutes); disable the SQL service account 'svc-mssql' on SQLPROD-01 to prevent lateral movement via valid credential logon, pending further analysis.

ActionsQuery DC Security logs for 4769 events from j.rivera with enc-type=0x12 (AES) over the last 3 hours to confirm persistence of low-and-slow Kerberoast patterns; verify that no other accounts are exhibiting SPN harvesting behavior using a volume/diversity threshold of 10+ distinct SPNs in 5 minutes; initiate an emergency override request to deploy dfKerbVolume as a new correlation rule in AD-SIEM, citing MC policy admission rank 4 and the critical need for L4 robustness via obsSpnHarvest; assess whether disabling svc-mssql on SQLPROD-01 has triggered any service disruption or dependency chain failure; re-evaluate the status of dfSqlLogon under current conditions to determine if its degradation-by-legitimacy is now more apparent due to account disablement.

ActionsQuery DC Security logs for 4769 events from j.rivera with enc-type=0x12 (AES) over the last 3 hours to confirm persistence of low-and-slow Kerberoast patterns; verify that no other accounts are exhibiting SPN harvesting behavior using a volume/diversity threshold of 10+ distinct SPNs in 5 minutes; assess whether disabling svc-mssql on SQLPROD-01 has triggered any service disruption or dependency chain failure; re-evaluate the status of dfSqlLogon under current conditions to determine if its degradation-by-legitimacy is now more apparent due to account disablement.

Actions1. Query Azure AD sign-in logs for the user who granted consent, filtering for recent sign-ins from their device (IP and client app) to confirm session legitimacy.
2. Check Unified audit log for any other OAuth-related events involving 'MeetingNotes Sync' or similar apps within the last 7 days.
3. Inspect Microsoft Graph activity logs for mailbox access attempts by the user or service principal associated with 'MeetingNotes Sync'.
4. Query EDR and network egress monitor on the user’s device (identified in sign-in log) for suspicious outbound connections, especially to domains linked to Nimbus Data Solutions or known third-party OAuth providers.
5. Temporarily disable the app registration 'MeetingNotes Sync' in Azure AD to prevent further token issuance.

Actions1. Query Azure AD sign-in logs for additional non-interactive sign-ins using the same client ID ('MeetingNotes Sync') from foreign IPs, focusing on timing relative to the initial consent event and checking for patterns in frequency or geographic spread. 2. Cross-reference the app's client ID against known malicious indicators (e.g., IoCs from threat intelligence feeds) via external lookup tools (simulated). 3. Inspect conditional access policies to confirm whether any policy enforces MFA for non-interactive sign-ins, especially those involving apps with Mail.ReadWrite or offline_access scopes — if not, flag this as a configuration gap. 4. Query the EDR and network egress monitor on the user’s device (from Turn 1) for additional outbound connections to domains associated with Nimbus Data Solutions or third-party OAuth providers beyond those already observed. 5. Revoke all active refresh tokens issued to the 'MeetingNotes Sync' app registration via Azure AD, preventing further token reuse even if previously issued.

Actions1. Query Azure AD sign-in logs for all non-interactive sign-ins using the 'MeetingNotes Sync' client ID within the last 24 hours, focusing on geographic distribution, timing patterns, and correlation with CASB alert timestamps. 2. Cross-reference the app's publisher domain ('Nimbus Data Solutions') and associated OAuth scopes against Microsoft Defender for Cloud Apps’ threat intelligence feed to confirm if this combination is flagged as high-risk or part of a known campaign. 3. Inspect Unified audit log for any additional delegated permission grants, admin consent events, or app registration changes involving 'MeetingNotes Sync' or similar apps with Mail.ReadWrite + offline_access scopes since the initial consent event. 4. Query Microsoft Graph activity logs for all mailbox access attempts (e.g., MailItemsAccessed) attributed to the service principal associated with 'MeetingNotes Sync', filtering by volume, folder scope, and user targets — especially those outside normal business hours or involving high-value mailboxes. 5. Immediately disable the app registration 'MeetingNotes Sync' in Azure AD to prevent any further token issuance or access attempts.

Actions1. Query Unified audit log for all 'MailItemsAccessed' events attributed to the 'MeetingNotes Sync' client ID over the last 48 hours, with focus on user mailbox targets, folder types accessed, and time-of-day patterns; 2. Cross-reference the app's publisher domain ('Nimbus Data Solutions') and associated OAuth scopes against internal threat intelligence repositories (if available) for prior incidents or known abuse patterns within the organization’s ecosystem; 3. Review all conditional access policies governing non-interactive sign-ins involving apps with Mail.ReadWrite or offline_access scopes, identifying any exceptions that allow bypass of MFA or device compliance checks; 4. Initiate a targeted forensic query on Microsoft Graph activity logs to identify whether any other service principals or app registrations have been granted similar high-privilege mailbox scopes in the past 90 days — especially those from unknown publishers; 5. Escalate to the ontology/modeling team with a request for formal representation of this maneuver as a 'consent-based OAuth data exfiltration' pattern, including trigger conditions (new app + sensitive scope + non-interactive access + foreign IP) and detection logic gaps.

Actions1. Query Unified audit log for all 'MailItemsAccessed' events attributed to the 'MeetingNotes Sync' client ID over the last 48 hours, with focus on user mailbox targets, folder types accessed, and time-of-day patterns; 2. Cross-reference the app's publisher domain ('Nimbus Data Solutions') and associated OAuth scopes against internal threat intelligence repositories for prior incidents or known abuse patterns within the organization’s ecosystem; 3. Review all conditional access policies governing non-interactive sign-ins involving apps with Mail.ReadWrite or offline_access scopes, identifying any exceptions that allow bypass of MFA or device compliance checks; 4. Initiate a targeted forensic query on Microsoft Graph activity logs to identify whether any other service principals or app registrations have been granted similar high-privilege mailbox scopes in the past 90 days — especially those from unknown publishers; 5. Escalate to the ontology/modeling team with a request for formal representation of this maneuver as a 'consent-based OAuth data exfiltration' pattern, including trigger conditions (new app + sensitive scope + non-interactive access + foreign IP) and detection logic gaps.

ActionsQuery Azure AD sign-in logs for the user's recent interactive sign-ins to identify the device/IP context of the consent event; initiate a review of the application 'MeetingNotes Sync' in the tenant via Microsoft Graph API to check its registration details and publisher verification status; flag the app as high-risk due to untrusted publisher and inclusion of offline_access scope; prepare for potential revocation of refresh tokens if further anomalous activity is detected.

ActionsQuery Unified Audit Log for additional 'Add delegated permission grant' events involving the application 'MeetingNotes Sync', specifically looking for repeated or bulk consent attempts across multiple users; initiate a Microsoft Graph API call to retrieve all existing refresh tokens associated with this app's service principal in the tenant; review CASB alerts for any anomalous data-access patterns linked to the client ID of 'MeetingNotes Sync'; escalate to the ontology/modeling team to request an emergency assessment of whether a new mc:Control instance can be authored for OAuth consent telemetry, given the high-risk nature of this event and the absence of coverage in mc-core/0.2.1.

ActionsQuery Azure AD sign-in logs for non-interactive sign-ins from the client ID of 'MeetingNotes Sync' to detect potential use of issued access tokens; initiate a Microsoft Graph API call to list all service principal instances associated with 'MeetingNotes Sync' and verify their registration status and publisher trust level; review CASB alerts for any high-volume mailbox data-access events tied to this application's client ID, particularly across multiple user accounts; escalate to the ontology/modeling team to request an emergency assessment of whether a new mc:Control instance can be authored for non-interactive token use telemetry (A2), given that real-world evidence suggests active abuse is underway and current coverage remains SILENT / no authored coverage record.

ActionsQuery Unified Audit Log for 'MailItemsAccessed' events tied to the client ID of 'MeetingNotes Sync', specifically looking for high-volume mailbox data access across multiple user accounts; initiate a Microsoft Graph API call to retrieve all existing refresh tokens associated with the service principal of 'MeetingNotes Sync'; disable the application registration 'MeetingNotes Sync' in Azure AD to immediately terminate any active consent grants and prevent further token issuance; escalate to the ontology/modeling team to request an emergency assessment of whether a new mc:Control instance can be authored for bulk mailbox collection telemetry (A3), given that real-world evidence suggests potential progression into A3 and current coverage remains SILENT / no authored coverage record.

ActionsQuery Azure AD sign-in logs for non-interactive sign-ins from the client ID of 'MeetingNotes Sync' to confirm ongoing token use; initiate a Microsoft Graph API call to retrieve all active refresh tokens associated with the service principal of 'MeetingNotes Sync'; disable all existing refresh tokens tied to this app's service principal; escalate to the ontology/modeling team for an emergency review of whether a new mc:Control instance can be authored for OAuth consent and token lifecycle telemetry, citing structural gaps in mc-core/0.2.1 (D1–D7); document that no coverage verdict can be derived due to absence of authored detect-faces, despite real-world telemetry confirming active abuse.

Actions1. Isolate workstation-01 from network via firewall rule; 2. Query EDR for full process lineage of suspicious child process (parent PID, command line, file hash); 3. Check Active Directory logs for recent service installations (Event ID 7045) on workstation-01; 4. Search SIEM for any outbound connections from workstation-01 in last 10 minutes; 5. Initiate credential rotation for all local admin accounts on workstation-01

Actions1. Query EDR for all process creation events on workstation-01 in the last 30 minutes with parent processes matching known web server binaries (e.g., IIS worker processes, Apache httpd); 2. Search SIEM for Event ID 4688 (Process Creation) entries on workstation-01 involving lsass.exe as a target process; 3. Check Active Directory logs for any recent Kerberos pre-authentication failures (Event ID 4768) or ticket-granting ticket requests (Event ID 4769) from workstation-01; 4. Initiate forensic memory dump of workstation-01 via EDR agent; 5. Deploy temporary detection rule in SIEM to flag any process spawning child processes with command-line arguments containing '-wmi' or 'powershell -enc', indicative of common lateral movement techniques

Actions1. Query EDR for all process creation events on file-server-01 and hr-workstation-02 in the last 30 minutes with parent processes matching known lateral movement patterns (e.g., wmic.exe, powershell.exe, schtasks.exe); 2. Search SIEM for Event ID 4688 entries involving lsass.exe as a target process on any host other than workstation-01; 3. Initiate forensic memory dump of file-server-01 and hr-workstation-02 via EDR agent; 4. Deploy new SIEM detection rule to flag any use of schtasks.exe with /ru or /u flags (indicative of scheduled task persistence); 5. Force credential rotation for the domain-wide svc-backup account and disable its current session tokens across all hosts

Actions1. Query EDR for all process creation events on file-server-01 and hr-workstation-02 involving schtasks.exe with /ru or /u flags in the last 30 minutes; 2. Search SIEM for Event ID 4688 entries on file-server-01 and hr-workstation-02 where the target process is lsass.exe; 3. Initiate forensic memory dump of ad1 (domain controller) via EDR agent, given its role in authentication and potential exposure to credential reuse; 4. Deploy new SIEM detection rule to flag any use of wmic.exe with /node: or \ syntax for remote execution; 5. Disable all active sessions associated with the svc-backup account on file-server-01, hr-workstation-02, and ad1

Actions1. Query EDR for all process creation events on ad1 involving schtasks.exe with /ru or /u flags in the last 30 minutes; 2. Search SIEM for Event ID 4688 entries on ad1 where the target process is lsass.exe; 3. Analyze forensic memory dump from ad1 using offline tools to detect presence of LSASS memory access artifacts, credential dumping tools (e.g., Mimikatz), or anomalous processes; 4. Deploy new SIEM detection rule to flag any use of schtasks.exe with /ru or /u flags across all hosts in the environment; 5. Initiate full domain-wide audit of scheduled tasks on all critical hosts (including ad1, file-server-01, hr-workstation-02) via PowerShell script to identify any unauthorized or suspicious task definitions

ActionsQuery EDR telemetry on workstation-01 for process-memory access attempts; initiate query of Active Directory logs for authentication events involving the shared service account (bb:acct1); isolate workstation-01 from network; verify controlStatus of edr1

ActionsQuery EDR telemetry on file-server-01 and hr-workstation-02 for mass-file-modification events; initiate query of network telemetry (SMB/WinRM) for session establishment between hosts; verify controlStatus of edr2 and edr3; force credential rotation for the shared service account (bb:acct1); deploy a new detection rule on netmonLat to monitor for multiple authenticated logons from one account across distinct hosts using redundant triggers

ActionsQuery EDR telemetry on file-server-01 and hr-workstation-02 for process-memory access attempts; initiate query of Active Directory logs for authentication events involving the shared service account (bb:acct1) post-credential rotation; verify controlStatus of netmonLat and ad1; deploy a new detection rule on edr2 and edr3 to monitor for remote-service or scheduled-task creation using redundant triggers

ActionsQuery EDR telemetry on file-server-01 and hr-workstation-02 for remote-service or scheduled-task creation events using redundant triggers; initiate query of network telemetry (SMB/WinRM) for session establishment between hosts post-credential rotation; verify controlStatus of edr2 and edr3 with respect to the new detection rule deployment; deploy a permanent, high-priority alert on netmonLat and ad1 to monitor for any future authenticated logons from the shared service account (bb:acct1), even if rotated

ActionsQuery EDR telemetry on file-server-01 and hr-workstation-02 for remote-service or scheduled-task creation events using redundant triggers; initiate query of Active Directory logs for authentication events involving the shared service account (bb:acct1) post-credential rotation; verify controlStatus of edr2 and edr3 with respect to the new detection rule deployment; deploy a permanent, high-priority alert on netmonLat and ad1 to monitor for any future authenticated logons from the shared service account (bb:acct1), even if rotated

ActionsQuery EDR for process creation events on FS-CORP01 from 22:35 to 22:45; query Active Directory logs for other recent logons by d.alvarez, especially from WKS-0442; check administrative-tool logs for any remote administration or backup jobs initiated by d.alvarez around the same time window; initiate a baseline comparison of d.alvarez’s typical login patterns (time, source IP/host, session duration) against historical behavior in SIEM

ActionsQuery EDR for WMI activity on FS-CORP01 from 22:40 to 22:50; cross-reference with Active Directory logs for any WMI session initiation events (e.g., 4698, 4673) by d.alvarez during the same window; check administrative-tool logs for any scheduled or ad-hoc backup job execution on FS-CORP01 initiated via BackupOps around 22:45–22:50; initiate a deep dive into the scope of JOB-88231 (from Turn 1) to confirm target systems, data types, and destination endpoints; validate whether d.alvarez has historical precedent for such backup job initiation during off-hours; review SIEM correlation rules for any existing detection logic on 'RDP + WMI + BackupOps' sequences in high-privilege contexts

ActionsQuery SIEM for all recent 'BackupOps' job executions initiated by domain admins during off-hours (22:00–06:00), focusing on those with cross-host scope; isolate FS-CORP01, APP-SVR02, and APP-SVR03 from the network via EDR quarantine command; disable d.alvarez's account session on all hosts using Active Directory session revocation; initiate a new SIEM correlation rule to detect 'RDP logon (4624) + WMI process creation (Sysmon 10) across multiple hosts + BackupOps job initiation' within 15 minutes, with high-privilege context as trigger; request White Cell to confirm whether the destination cloud bucket for JOB-88231 is approved in change management records

ActionsQuery SIEM for all recent 'BackupOps' job executions with destination endpoints matching the newly observed off-tenant cloud bucket (from Turn 3 reveal), focusing on those initiated by domain admins; initiate a cross-log correlation of d.alvarez's session activity across EDR, AD, and BackupOps logs to identify any additional anomalous process or file access events post-isolation; request White Cell to confirm whether the off-tenant cloud bucket is registered in the org’s approved third-party service inventory; escalate detection rule for 'RDP + WMI + BackupOps' sequence to high severity with automated containment trigger on future matches; review EDR telemetry from FS-CORP01, APP-SVR02, and APP-SVR03 for any post-incident file exfiltration indicators (e.g., large outbound transfers, unusual SMB/HTTP traffic) within the last 60 minutes

ActionsQuery SIEM for all historical 'BackupOps' job executions initiated by domain admins that targeted the same sensitive data categories (finance/legal/HR shares) as JOB-88231, regardless of destination; initiate a full forensic artifact sweep on FS-CORP01, APP-SVR02, and APP-SVR03 via EDR for any residual configuration changes or custom scripts tied to d.alvarez’s session; request White Cell to confirm whether the use of this specific cloud bucket by BackupOps has ever been approved in a formal change management process (including audit trail); escalate incident status to 'High Risk' with cross-team notification and initiate post-incident review for detection coverage gaps in administrative tooling usage patterns

ActionsQuery winlog1 for additional 4624 events involving d.alvarez within the last 30 minutes; isolate host FS-CORP01; query hostTelem1 for remote WMI process creation (Sysmon event ID 1) on FS-CORP01 initiated by d.alvarez in the same window; check bkops1 audit log for any ad hoc job creation by d.alvarez matching that timeframe; verify netmon1 egress flow records from FS-CORP01 to external destinations during this period

ActionsQuery winlog1 for additional 4624 events involving d.alvarez within the last 30 minutes from non-admin-tier hosts (specifically WKS-0442); query hostTelem1 for any remote WMI process creation (Sysmon event ID 1) on FS-CORP01 initiated by d.alvarez in the same window with command line content; check bkops1 audit log for any job creation events involving data scope changes or destination-profile modifications by d.alvarez within the last hour; initiate a cross-face correlation query across dfRdpLogon (winlog1), dfRemoteExec (hostTelem1), and dfBackupJob (bkops1) to detect co-occurrence of these signals under d.alvarez’s activity in a narrow time window

ActionsQuery winlog1 for 4624 events involving d.alvarez from WKS-0442 within the last 30 minutes to establish a pattern of atypical source-host usage; initiate a manual cross-face correlation between dfRdpLogon (winlog1), dfRemoteExec (hostTelem1), and dfBackupJob (bkops1) for co-occurrence under d.alvarez in a narrow window (22:30–22:50); check netmon1 egress records from FS-CORP01 to any destination outside the sanctioned provider’s address range during this period; disable session on FS-CORP01 via AD for d.alvarez; step-up account d.alvarez with temporary MFA requirement

ActionsQuery winlog1 for 4624 events involving d.alvarez from WKS-0442 within the last 30 minutes to confirm pattern of atypical source-host usage; initiate manual cross-face correlation across dfRdpLogon (winlog1), dfRemoteExec (hostTelem1), and dfBackupJob (bkops1) for co-occurrence under d.alvarez in a narrow window (22:30–22:50); check netmon1 egress records from FS-CORP01 to any destination outside the sanctioned provider’s address range during this period; revoke session on FS-CORP01 via AD for d.alvarez; isolate host WKS-0442 as a potential compromised endpoint

ActionsQuery winlog1 for 4624 events involving d.alvarez from WKS-0442 within the last 30 minutes to confirm persistent atypical source-host usage; initiate manual cross-face correlation across dfRdpLogon (winlog1), dfRemoteExec (hostTelem1), and dfBackupJob (bkops1) for co-occurrence under d.alvarez in a narrow window (22:30–22:50); check netmon1 egress records from FS-CORP01 to any destination outside the sanctioned provider’s address range during this period; disable and isolate host WKS-0442 as a potential compromised endpoint; step-up account d.alvarez with permanent MFA requirement and restrict its administrative privileges to only essential systems

ActionsThis turn I take the following concrete actions:

1. EDR — full process-tree query on workstation-01 for the alerting PID: pull parent (web app service) PID/image/hash, the child process's full image path, command line/arguments, code-signing status, and process-start timestamp. I want to see whether the child is a shell/interpreter (cmd.exe, powershell.exe, wscript, bash-equivalent) or a distinct dropped binary, and whether the command line contains encoded/obfuscated content (base64, -enc, certutil, IEX, etc.) — that distinguishes "interactive post-exploitation shell" from "dropper executing a payload" from a false-positive benign subprocess.

2. EDR — query for any grandchild processes, file-write events, or module/DLL loads attributed to that child PID in the same time window, to see if it already spawned further children, wrote a file to disk, or loaded anything abnormal (would indicate progression past initial execution).

3. Netmon — pull raw outbound connection metadata (destination IP/domain, port, protocol, volume, first-seen time) for workstation-01 specifically for the window bracketing the alert, even though no netmon alert fired — I want to check for a beacon/C2 callback or data transfer that simply hasn't crossed an alerting threshold yet, since absence of a fired alert isn't the same as absence of activity.

4. Service-control / Windows service-state log — check workstation-01 for (a) any EDR agent service state transitions (start/stop/pause) around the alert time, since the brief flags that an attacker with sufficient privilege can kill the agent, and this log is host-local and independent of EDR liveness; and (b) any restart/reconfiguration of the web application service itself.

5. Identity/auth logs — check logons and privilege use for the host's service accounts (the account the web app runs as, plus any other host service accounts such as svc-backup) in the same window, looking for the web-app service context being used to authenticate elsewhere or for any new/elevated logon session tied to this host.

6. Containment — isolate workstation-01 from the network via the EDR agent's network-isolation/quarantine mode now (not a shutdown), while leaving the process and host running so the above forensic queries and any live-response collection remain possible. Rationale: this is an internet-facing host, the signature is a genuine exploit-behavior detection (not a heuristic/anomaly-only score) with a lineage mismatch against a known baseline, and the tooling brief itself flags that a sufficiently privileged attacker could disable the EDR agent — so the cost of waiting outweighs the cost of a false-positive isolation (a temporary service disruption we can reverse in seconds once cleared). I do not yet disable or rotate any account and do not yet block a specific egress destination — no identity or netmon signal has named a specific account or destination to act on; doing so now would be acting ahead of evidence. I also do not kill the suspicious process — isolating at the network layer preserves it for the next round of live forensics without tipping off the actor through a process-kill (isolation is quieter and reversible).

ActionsThis turn:

1. EDR — full process detail for the PID that triggered the LSASS memory-read signature: image path/name, parent PID and full lineage back to the web application service, hash/code-signing status, command line, integrity level, and start timestamp. Priority question: is this the same child process flagged in Turn 1 (or a direct descendant of it), or a distinct/new process (e.g., a living-off-the-land binary invoked via a new logon or scheduled task)? That answer determines whether this is the same intrusion progressing or a second, separate event on the same host.

2. EDR — query for any file-write, module-load, or further process-creation events attributed to that same PID in the window immediately following the memory-read event — specifically looking for a dump-style artifact written to disk. A read-only access stays in that process's memory; a subsequent file write would mean the harvested material has been externalized to persistent storage.

3. Netmon — re-pull outbound connection metadata for workstation-01 for the window bracketing this new alert, to (a) confirm isolation is holding with zero egress and (b) check for any connection attempt (even a blocked/failed one) that straddles the moment isolation engaged.

4. Service-control / Windows service-state log — re-check specifically for an EDR-agent or web-app-service state transition in the window bracketing the LSASS-read event. This is exactly the moment a privileged attacker might try to kill the agent, and I want that ruled in or out before leaning further on continued EDR telemetry.

5. Identity/auth log — query logon sessions on workstation-01 at the time of the LSASS read: which accounts (the web-app service account, svc-backup, and any interactive session) were logged on and therefore had credential material resident in LSASS at the moment of the read.

6. Response actions taken now: (a) workstation-01 remains network-isolated, no change; (b) disable / force-expire the credentials of the web application service account immediately — it is already directly implicated in the compromised process lineage, and any secret it held must be treated as burned the instant LSASS was read, since host isolation does not stop those credentials from being replayed against other systems; (c) do not yet block a specific egress destination — netmon has not named one; (d) do not kill or terminate the LSASS-reading process — leave it live for the item 1–2 forensic pulls, consistent with isolated-but-running rather than powered off.

ActionsThis turn:

1. EDR — attempt one live query against workstation-01 (agent heartbeat / process-list request) purely as a reachability canary. I expect no response, consistent with the service-control log's STOPPED finding; if it *does* respond, that's a significant anomaly (partial agent functionality, or a spoofed/incomplete service-control entry) that would need immediate follow-up. Either way, I stop treating this channel as a reliable ongoing telemetry source after this check — I am not relying on it going forward.

2. Service-control log — pull full detail on the STOPPED transition: exact timestamp relative to (a) Turn 2's LSASS-read event and (b) the last good EDR heartbeat; the account/session context that issued the stop, if the service-control manager captured a caller identity; and the mechanism (clean service stop vs. process kill vs. service/driver deletion). Goal: establish temporal linkage to the LSASS read as cause, and confirm whether the acting principal required SYSTEM/admin-equivalent privilege — i.e., did privilege escalation occur using material harvested in Turn 2.

3. Netmon — pull *current, real-time* outbound connection metadata for workstation-01, not just the prior window. Turn 1's isolation was applied via the EDR agent's own quarantine mode; if that control is enforced by the same service that just went down, I can no longer trust EDR's self-reported "isolation remains in effect." Netmon is my only EDR-independent way to confirm zero egress is still actually true right now, not merely still true as of the last trusted reading.

4. Identity/auth logs — (a) query for any new or elevated/interactive logon session on workstation-01 in the window bracketing the EDR-stop event; (b) separately and more urgently, query whether the (already-disabled) web-app service account or svc-backup's credentials were used to authenticate anywhere else in the environment — any other host or resource — during this same window, since host-level containment does nothing to stop credential replay elsewhere, and that is now the top unresolved risk.

5. SIEM — (a) pull any EDR-forwarded telemetry from workstation-01 in the final moments before the last heartbeat, in case a tamper-relevant event (e.g., attempted protected-process access, an attempted service-stop) fired but hasn't surfaced as a ticket yet; (b) query across the rest of the environment for any other host currently showing EDR heartbeat loss or a similar service-stop pattern in the same timeframe — to determine whether this is isolated to workstation-01 or part of a broader coordinated move against multiple agents.

6. Containment (response decision) — escalate to an EDR-independent containment layer now: apply a network-infrastructure-level block on workstation-01 (perimeter firewall/switch-port block on its IP/MAC), under my "block an egress channel" authority, redundant to and independent of the EDR-based isolation from Turn 1. I am not willing to rely solely on a control enforced by the exact channel the attacker has just demonstrated the capability to kill.

7. Credential response decision — disable/force-expire svc-backup's credentials now (web-app service account was already disabled in Turn 2). svc-backup's session was confirmed resident on this host at the moment of the LSASS read; this turn's evidence (successful kill of a protected security service) is consistent with escalation via harvested material. Same asymmetry as Turn 2: a disrupted backup job is far cheaper than replayed backup-service credentials elsewhere.

8. I do not power off or forcibly reboot workstation-01 this turn — that destroys volatile forensic state for marginal benefit given the new infra-level block (action 6) is already going in independent of host state. Held in reserve for Turn 4/5 if evidence of active data destruction or confirmed lateral movement changes that calculus.

ActionsThis turn:

1. EDR — attempt a remote agent-restart/redeploy command against workstation-01 through the EDR management/policy plane (distinct from Turn 3's on-host reachability canary). Goal: determine whether the management-plane channel itself survived the agent kill and can revive the sensor or push a fresh agent, independent of the dead host-local process. If this succeeds, it's the single fastest path back to host-level visibility; if it fails, it confirms the channel is fully and durably dark, not just quiet.

2. Service-control / Windows service-state log — re-pull for the full period since the STOPPED transition, specifically filtering for ANY new service creation/install, driver load, or scheduled-task-backed service entry (not just further EDR/web-app state changes, which the White Cell already reported as nil). Persistence mechanisms built via a new service or driver would surface here even with EDR dead, since this log is host-local and EDR-liveness-independent — this is the one channel that could still catch a defense-evasion-era persistence step.

3. Identity/auth — broaden the query past the two already-flagged accounts: (a) check for any local or domain account CREATION event tied to workstation-01 or issued from a session that touched this host, since a freshly minted account is a common privilege-escalation/persistence move that wouldn't show as "authentication using svc-backup/web-app-account"; (b) check environment-wide for authentication by any OTHER account that had a session on workstation-01 in the relevant window (i.e., confirm Turn 2's identity pull — web-app account, svc-backup, no human session — was truly exhaustive, not just the two we've been tracking).

4. Netmon — pull a full retrospective window from the LSASS-read/EDR-stop event through now (not just "current instant"), specifically to close Turn 3's open question: was there any brief egress spike in the gap between the EDR agent dying and the infra-level block landing, i.e., a window where EDR-based isolation was the only control and its "active" status was unverifiable. This is an EDR-independent check on whether containment actually held gap-free or whether there's a brief exposure window already in the past that needs accounting for.

5. SIEM — broaden the environment-wide sweep beyond Turn 3's narrow "same EDR-heartbeat-loss pattern" query: pull any new alert of any severity/type, any host, in the current period, to check for a different-shaped follow-on action elsewhere (e.g., a new exploit alert, a new anomalous-lineage alert, a new credential-access alert on a different asset) that might indicate this is part of a broader campaign rather than confirming the narrow single-pattern replay again.

6. Containment/response decisions this turn: (a) no change to either containment layer — EDR-based isolation and the infra-level perimeter/switch block both remain in effect, unlifted; (b) no change to the two disabled accounts (web-app service account, svc-backup) — remain disabled; (c) do not power off or reboot the host — still preserving volatile state in case action #1 revives the agent for live-response collection; (d) formally flag, for Turn 5 disposition, that in-place remediation is not an option I'm considering — killing a protected security service requires SYSTEM/kernel-level privilege, so this host must be treated as fully compromised at the highest privilege tier, and the only acceptable terminal action is forensic image + rebuild from known-good, not attempting to "clean" it live.

ActionsTurn 5 — final turn actions:

1. SIEM — environment-wide sweep, broadened beyond "EDR heartbeat-loss pattern," for ANY alert, ticket-correlation flag, or ransom-note/mass-file-rename signature on any other host this period. Goal: confirm single-host vs. multi-host impact before disposition.

2. Netmon — pull the FULL historical connection log for workstation-01 to internal file-share/backup/domain-controller destinations, specifically for the window BEFORE Turn 1 isolation took effect (pre-containment), to assess whether SMB/share-based propagation could have reached other storage or hosts before the network was cut — the isolation/infra-block record only proves nothing spread AFTER containment, not before it.

3. Identity/auth — targeted query: did svc-backup's credentials (confirmed LSASS-resident at the Turn 2 read, disabled in Turn 3) authenticate against backup infrastructure/repositories at any point before disablement? This determines whether the backup set is trustworthy for a rebuild, or whether it must be treated as potentially compromised/encrypted/deleted too.

4. Request ticket-level detail from the help-desk/out-of-band channel that surfaced this: exact file extension and ransom-note content (for strain identification), first-user-report timestamp (to bound when encryption began relative to the Turn 3 EDR kill), and whether affected files are confined to workstation-01's local/mapped scope or reported by users on other hosts/shares.

5. Response — containment: leave EDR-isolation and the infra-level block exactly as-is; no lifting, no change. Both have held clean (zero anomalous egress) across every retrospective window checked, so the network layer is not the open question anymore.

6. Response — decisive host-state action: HIBERNATE (suspend-to-disk) workstation-01 rather than continuing to leave it running or hard-powering it off. Rationale: the two reasons I deferred any power-state change in Turns 3-4 — preserving the option that EDR might be revived, and preserving optionality for further live forensics — are both gone now (Turn 4's management-plane revival attempt already failed, and Impact-stage damage is now confirmed, not hypothetical). Hibernation halts any still-in-progress encryption immediately (stops further file damage now, not later) while preserving RAM to disk for memory forensics (potential key/process-artifact recovery), which a hard power-off would destroy and which pure "leave it running" does nothing to stop. This is the one available action that both curtails ongoing damage and preserves evidence.

7. Do not attempt in-place remediation, decryption, or file recovery on the host. Do not interact with or respond to the ransom note. Escalate for forensic disk image + memory capture, and hand disposition to full IR/forensics for strain attribution and legal/exec breach-assessment — outside IC's remaining tooling/authority for this exercise.

ActionsThis turn I task the following queries against the telemetry the brief grants (no containment yet — see below):

1. EDR — process-tree pull: Full detail on the flagged alert — web-app parent PID/image/hash, the child process's full path, command line, digital signature status, and any further descendants it spawned (children-of-children). Looking specifically for interpreter/shell indicators (cmd.exe, powershell.exe, wscript, etc.), encoded/obfuscated command-line arguments, or writes to disk (dropped webshell/payload).

2. EDR — process-memory-access query on the same process lineage: Any OpenProcess/ReadProcessMemory/handle-duplication events by the child process or its descendants against another process (LSASS in particular). This directly checks whether mCred (A2) is already in progress — its precondition (≥user integrity) would just have been supplied by this exploit if real.

3. EDR — driver-load query, same host, same time window: Any newly loaded/unsigned or known-vulnerable driver. A precursor check for mEdrKill (A3), even though its stated precondition (admin credential) hasn't been established yet as far as we know.

4. Netmon — egress query for workstation-01: Any outbound connections initiated by or shortly after the child process's spawn — destination, volume, protocol. Checks (a) whether the egress channel is reachable (mExfil precondition) and (b) whether any anomalous outbound flow is already underway.

5. Service-control log — EDR service-state check on workstation-01: Confirm the EDR service is currently running, independent of the SIEM-forwarded alert. This is a cheap, independent hedge against the structural blind spot where mEdrKill would sever dfEdrTelemetry and blind dfExploit/dfCred/dfEncrypt all at once — I want this checked every turn, not just after suspicion.

6. Identity/auth logs: Any new logon, privilege-escalation, or svc-backup account activity on workstation-01 around the alert timestamp.

7. SIEM — correlation query: Any other alerts, on any host, from the same source IP as the inbound request that triggered the web-app child spawn (checks for opportunistic scanning vs. targeted, single-host vs. multi-host activity).

No containment action this turn (no isolation, no account action, no egress block) — see response decisions below for why and for the trigger conditions that would change that immediately.

ActionsContainment (executing now, not deferred to next turn):

1. Isolate workstation-01 — network containment via the EDR agent. This is a targeted network isolation (sever the host's network reachability), explicitly *not* an EDR agent stop — the sensor keeps running/enforcing locally so dfEdrTelemetry (and everything that trigger-depends on it: dfExploit, dfCred, dfEncrypt) stays intact. This executes the trigger condition (a) I pre-committed to last turn ("process-memory query shows a read against another process's memory") — the White Cell's own inject satisfies it, so I act immediately rather than waiting for further confirmation.

2. Account containment — disable/force-logoff + begin rotation for the credential(s) exposed to this LSASS read. Pending query #3 below to confirm exact scope, I am proactively disabling/rotating the two most likely-exposed candidates visible in my telemetry: the svc-backup service account and any local administrator account with a live session on workstation-01. Rationale: the admin credential is the *shared* precondition for both mEdrKill (A3) and mExfil (A4) — invalidating it now cuts a precondition of both next-stage maneuvers regardless of which branch the adversary intends, even though this lever isn't card-prescribed (no authored respond/prevent maneuver) — it's within my IR latitude and the chokepoint logic is sound structural doctrine (C.0).

Investigative queries this turn:

3. EDR — logon-session / credential-scope enumeration on the flagged LSASS process: which account SIDs have cached credential material resident in this LSASS instance right now. This tells me exactly which accounts to prioritize for rotation beyond my precautionary pick in #2.

4. EDR — full re-pull across all categories on workstation-01, same battery as turn 1: process lineage/hash/signature for the LSASS-reading process back through the original web-app parent; any *new* child-process creation; any *additional* memory-access events against processes other than LSASS; any driver-load events. Escalating severity warrants re-running the whole battery, not just following the one face that fired.

5. Service-control log — EDR service-state check (repeated every turn, standing hedge): confirm running, independent of the SIEM alert. This is the most important query this turn — if the credential read succeeded, the adversary may now hold the precondition for mEdrKill, and a state transition here means treat as maximum severity instantly.

6. Netmon — egress re-query for workstation-01: any outbound attempt at or after the LSASS-read timestamp, including anything the isolation action itself is now blocking — establishes whether mExfil's reachable-egress precondition was ever satisfiable and whether an exfil attempt was already inflight.

7. Identity/auth logs: any logon, privilege-escalation, or service-account (svc-backup and others) activity on workstation-01 *or any other host*, from the LSASS-read timestamp forward — checks whether harvested material is already in use (postcondition realized) rather than merely read.

8. SIEM — cross-host correlation on the account names surfaced by #3/#7 — any authentication or alert activity elsewhere using those identities, checking for lateral movement beyond this host.

ActionsNo new containment beyond what's already in force — network isolation (Turn 2) and the svc-backup disable/rotation (Turn 2) both remain in effect. This turn is queries plus one follow-through check on an item left open last turn:

1. Identity/auth logs — deep dive on the failed svc-backup authentication attempt. Pull source process/PID and host-session context on workstation-01, logon type (interactive / network / service / batch / cached-offline-domain), and precise timestamp offset from the Turn-2 disable action. Goal: determine whether this attempt originated from the flagged intrusion lineage (the web-app-spawned child that later read LSASS) versus an unrelated benign source (e.g., the normal scheduled svc-backup job, already seen running in Turn 2's pull, retrying with a stale cached credential after the account state changed underneath it).

2. EDR — process-lineage/state re-pull on workstation-01, windowed on the failed-auth timestamp. Any process creation, further memory-access, or credential-store touch coincident with the attempt. This is the corroborating half of query #1 — ties (or rules out) the auth attempt to the already-flagged lineage.

3. Rotation-completion check for svc-backup. Turn 2 reveal left this "in progress, not yet confirmed complete" — task an explicit status query this turn rather than assuming it finished; if still incomplete, treat completing it as a live action item, not a settled fact.

4. Netmon — isolation-integrity + egress re-query. Confirm workstation-01's network containment is still holding (no reachable egress/ingress) and check for any outbound attempt at/after the failed-auth timestamp — since a fully isolated host still produced an evaluable identity-log entry, I want to confirm that entry didn't correspond to any attempted network call the isolation had to block.

5. SIEM — cross-host correlation, repeated. Any auth activity (successful or failed) using svc-backup or any other identity, on any other host, since the Turn-2 rotation began. Also check for any distinct alert generated by the identity system itself off this specific failed-auth event (separate from the EDR-sourced alerts seen so far).

6. Standing battery, restated: driver-load query (host, this window) and EDR service-control liveness — both already answered NULL/RUNNING by the White Cell's own Turn-3 inject, so no re-query needed this cycle, but both remain on the fixed per-turn checklist going forward regardless of what else fires.

No lifting of isolation, no further account action beyond confirming rotation completion — nothing this turn crosses any of the escalation triggers already pre-committed in Turns 1–2.

ActionsHolding current containment (isolation + svc-backup disable/rotation both remain in force — no lifting, no new lever). This turn's tasking is investigative, split between the standing per-turn battery and one newly-broadened query:

1. EDR — service-control liveness check, explicit re-task. Even though this turn's clock update states "no new service-control transition," I task the query directly rather than inferring RUNNING from the absence of a transition-mention — this is the non-negotiable hedge against mEdrKill (A3) simultaneously blinding dfExploit/dfCred/dfEncrypt, and it stays on the fixed checklist every turn regardless of what else is quiet (per B1/C.1).

2. EDR — driver-load query, workstation-01, this window. Unlike netmon/SIEM/service-control/identity, this turn's clock update did not explicitly null this one — tasking it directly. Precursor check for the BYOVD path to mEdrKill (A3's sole authored variant); still gated on an admin credential I've already invalidated, but I check the mechanism itself, not just the precondition.

3. EDR — full process-lineage/memory-access re-pull, workstation-01. Confirm no new child process off the flagged lineage, no memory-access event beyond the already-flagged LSASS read, nothing new since Turn 3's window. Standing battery completeness — I want the underlying lineage data, not just "no new EDR alert" at the summary level.

4. New this turn — EDR persistence-mechanism sweep, workstation-01. Scheduled-task creation, registry Run/RunOnce key writes, new service installation, WMI event subscription — any tied to the flagged lineage, or any at all, since Turn 1. This hasn't been explicitly asked in any prior turn's battery (which covered process/memory/driver-load, not persistence). Rationale for raising it now: four turns in, the immediate escalation-trigger checklist is flat, which makes this the right moment to broaden the aperture toward eradication-readiness — before any future de-isolation decision, I want to know whether a foothold exists that survives the account rotation and the network cut.

5. Netmon — isolation-integrity confirm. Already answered flat this cycle by the clock update (no egress, no ingress, no new destination) — logging as satisfied, no re-query needed.

6. Identity/auth — repeat/new-attempt check. Already answered NULL this cycle by the clock update (no new identity/auth event) — this resolves the standing watch-item I flagged at the end of Turn 3 (a second or repeated auth attempt would have tipped the balance toward active reuse). No re-query needed; folding the result into this turn's hypothesis below.

7. SIEM — cross-host correlation, repeated. Same ask as prior turns (any auth or alert activity elsewhere using svc-backup or any other identity) — expect NULL again given the single-host scenario, but keeping it on the checklist rather than assuming.

No containment change, no account action, no isolation lift this turn.

ActionsContainment (executing now):

1. EDR — process termination directive against the flagged lineage. Task the EDR agent to kill/suspend the web-app-spawned child process (resident since Turn 1) and any live descendant performing the encryption, and to quarantine/block its binary hash to prevent auto-respawn. This is the one lever that acts directly on mEncrypt's precondition (local process integrity) — per the cards (C.0/A5/D-2), neither the Turn-2 credential invalidation nor the network isolation ever touched this precondition, and no respond/react maneuver is authored in the library for it (D-2: "cards flag the lever, don't prescribe the action"). I'm exercising IC response latitude beyond the four explicitly itemized levers (isolate/account/egress/query) because the situation — active, observed data destruction — warrants it; this action is *not* card-scored and I'm flagging it as such rather than claiming a modeled coverage effect from it.
2. Escalate to full incident status / ransomware playbook. Engage backup-and-recovery workstream to identify a viable restore point for workstation-01, and notify stakeholders per major-incident process. This is an operational decision, not a telemetry-backed finding — I have no modeled visibility into backup/shadow-copy state (inhibit-recovery/T1490 is unmodeled per A7/D-3), so I am not assuming shadow copies are intact or deleted; I'm treating that as an open unknown requiring out-of-band verification outside this exercise's tooling.
3. Hold existing containment unchanged: network isolation (Turn 2) and svc-backup disable/rotation (Turn 2, confirmed complete Turn 3) both remain in force — no reason to lift either.

Investigative queries this turn:

4. EDR — process-detail/scope pull on the encryption alert. Confirm the encrypting process is the same lineage flagged since Turn 1/2 (not a second, unrelated actor); pull affected-file count/path pattern, encryption rate, and any ransom-note artifact, to scope blast radius on this host.
5. EDR — service-control liveness re-check (standing hedge, unchanged discipline). Explicit re-task even though the alert's own real-time delivery already implies EDR is enforcing — I want the direct RUNNING confirmation, not an inference.
6. Netmon — egress re-query at/around the encryption-alert timestamp. Checks for a last-second outbound burst (double-extortion exfil-before-encrypt pattern) coincident with encryption onset, and reconfirms isolation is still holding through this new event.
7. Identity/auth logs — re-check for any logon/privesc/service-account activity around this alert's timestamp, on workstation-01 or elsewhere.
8. SIEM — cross-host correlation, repeated. Any alert or auth activity on any other host, checking for lateral spread rather than single-host impact.
9. EDR — driver-load re-query, standing battery item, completeness check even though mEdrKill's precondition (admin credential) was invalidated in Turn 2.

ActionsThis turn I take the following concrete steps:

1. EDR console on DC01 — alert triage/process lineage: Pull the full process tree for the LSASS-access alert: identify the exact child image path, PID, command line, and file hash of the process spawned from services.exe that touched LSASS; check its digital signature status and drop location (temp/admin share vs. legitimate binary path). Also pull the EDR agent health/tamper log on DC01 to confirm the sensor itself wasn't blinded or unloaded before/after the access.

2. SIEM — correlate 4624 + 7045 into one session: Join the Domain Admin service-account 4624 (Logon Type 3) event to the 7045 service-install event on DC01 by Logon ID — confirm they're the same authenticated session, and pull the 7045 detail (service name, binary path, account context it runs as). Pull the source workstation hostname/IP from the 4624 record.

3. SIEM — DCSync exposure check: Given the domain-root SACL already covers replication control-access rights, query 4662 for that DA account's SID (and the source workstation's machine account) across a window bracketing this incident — before and after — to see whether any DS-Replication-Get-Changes / Get-Changes-All rights were exercised outside of legitimate DC-to-DC replication.

4. EDR on the source workstation: Pull whatever telemetry exists for the workstation-subnet host named in the 4624 record — prior alerts, process history, any credential-access or lateral-movement tooling indicators in the hours before the DC01 logon — to establish whether that host is the actual point of compromise (i.e., where the DA credential was first stolen).

5. Network egress monitor: Check DC01 and the source workstation for any outbound connections (especially to unfamiliar external IPs) in the incident window — looking for C2 callback or staged exfil tied to this session.

Response/containment decisions this turn:
- Disable the Domain Admin service account now (not rotate yet — preserve the credential/hash for IR analysis first if feasible, but stop it from authenticating further). This account is the common thread across the LSASS alert, the anomalous logon, and the service install.
- Network-isolate the source workstation (the likely initial foothold), not DC01 itself — isolating a live DC risks a domain-wide outage and I don't yet have evidence the DC is doing anything beyond being a credential-dumping target this session.
- Do not force krbtgt rotation or isolate DC01 yet — holding both in reserve pending what the White Cell surfaces from the queries above (specifically the 4662/DCSync check and the dropped-binary identity).
- Escalate to IR now given DA-tier credential theft on a DC; hold escalation to the ontology/modeling team pending scope confirmation.

ActionsThis turn:

1. EDR file/registry-access telemetry, DC01 — full detail on the hive reads. Pull the complete remote-registry access record: was HKLM\SYSTEM also opened for read alongside SAM and SECURITY? (SYSTEM holds the boot key needed to decrypt SAM/LSA secrets offline — its presence would confirm a classic three-hive remote dump rather than a partial/failed attempt.) Get exact byte sizes of each hive read and confirm the session/Logon ID ties to the same authenticated session as [1]-[4] from last turn.

2. SIEM — process-creation query (4688) on DC01 for the same Logon ID/session window. Look specifically for reg.exe save/reg.exe export command lines targeting sam/security/system, or equivalent API-level registry-save activity, to get the literal command and confirm tooling.

3. SIEM — Volume Shadow Copy / backup-writer event check on DC01 (event 8222 / VSS service events) in the same window. Remote SAM/SECURITY dumps against locked hives typically require a shadow copy first — presence of a VSS creation event in this window is a strong tooling fingerprint (matches the standard Impacket secretsdump.py-style flow: registry hive dump + separate DRSUAPI/DCSync attempt, both from one run).

4. SIEM — enumerate what runs on DC01 as service/gMSA accounts (from the 7045 service-install detail and any other service-context entries) whose secrets could live in LSA secrets under HKLM\SECURITY. This scopes the blast radius of what needs rotating beyond the DA account itself.

5. Re-verify containment integrity: confirm no new authentication events (4624) under the disabled DA SID and no new traffic from WKS10-2214 since isolation — quick negative check, not a new investigative thread.

Response/containment decisions this turn:
- Force krbtgt password rotation now (standard double-reset procedure, allowing AD replication to converge between resets). Justification: last turn's [4] already confirmed (not merely attempted) DS-Replication-Get-Changes-All was exercised by the DA account — that right permits replication of secret attributes including the krbtgt hash and all domain NTLM hashes. This turn's SAM/SECURITY hive read is corroborating evidence of a comprehensive, multi-technique credential-dumping operation, not an isolated LSASS incident — I'm no longer treating krbtgt exposure as hypothetical.
- Consider/schedule DSRM local-administrator password reset on DC01 (and check exposure on other DCs), since HKLM\SECURITY (LSA secrets) was read — DC-local secrets (DSRM hash, any stored service-account credentials) must now be treated as compromised, not just domain-tier ones.
- Escalate to the ontology/modeling team now. This session has now demonstrated three distinct credential-access techniques (LSASS memory read, DCSync via replication rights, remote SAM/SECURITY hive dump) executed back-to-back against a DC in one authenticated session — a technique-chain worth cataloging regardless of incident outcome.
- Do not isolate DC01. The active-access vector (DA account, WKS10-2214) is already cut off; isolating the DC now adds domain-wide authentication outage risk without undoing already-completed reads/replication. Holding this decision, but explicitly reconsidering it every turn.
- IR escalation remains open/updated with this turn's findings.

ActionsThis turn:

1. EDR — full detail on the self-protection/tamper alert, DC01. Pull the exact record: which self-protection mechanism was targeted (agent-process kill attempt, driver/minifilter unload, service-stop, config/policy tamper), the responsible process's image path, PID, parent, hash, and signature status, and the precise start/end timestamps of the UNHEALTHY/IMPAIRED window. Cross-reference that process against the unsigned binary/service already identified from the 7045 install in turn 1 — same artifact, or a different one?

2. EDR — reconcile against turn 1's health finding. Turn 1's agent-health pull reported "Healthy/Enforcing across the entire window under review, up to and including now." This turn's alert says the impaired window *overlaps the session under investigation*. I need the exact timeline: did impairment begin after turn 1's check (a new development), or does it retroactively fall inside the window turn 1 already called clean (meaning that earlier assurance is now superseded)? This determines how much of the turn 1/2 EDR-sourced telemetry (LSASS alert, registry/file-access hive-read telemetry) I can still treat as complete rather than merely "not contradicted."

3. EDR — service-state check on DC01. Is the unsigned LocalSystem-context service from the 7045 install (turn 1) still installed/running on DC01 right now? No prior action this incident has removed or stopped it — only the DA account was disabled and the workstation isolated. If that service persists, it's a credential-independent, on-host persistence mechanism that doesn't need the DA account or WKS10-2214 at all, and is the most likely source of a local self-protection tamper attempt.

4. SIEM — Windows Security log integrity check, DC01. Query for event 1102 (audit log cleared) or any Event Log/forwarding-service stop, plus any new 4624 / 4688 / 7045 / service-control events in or after the impaired window — to determine whether the actor is also targeting the SIEM's independent (non-EDR) collection path, or whether that path remains trustworthy.

5. EDR fleet scope check. Query whether this self-protection/tamper alert is unique to DC01 or also present on any other monitored host, to determine whether this is a DC01-specific event or a broader tamper pattern.

Response/containment decisions this turn:
- Isolate DC01 now — reversing the hold from turns 1–2. The prior rationale for not isolating (active vector already cut off; EDR still gave full-fidelity visibility) no longer holds: the one remaining detective control on the DC itself is now confirmed degraded/tamper-targeted, and there is an unaddressed, credential-independent persistence artifact (the LocalSystem service) whose current state is unverified. Continued live operation of DC01 under unreliable EDR is a bigger risk now than a controlled isolation.
- Keep DA account disabled and WKS10-2214 isolated (unchanged).
- Continue the krbtgt double-reset; if this is a multi-DC forest, route the second reset and replication convergence through surviving DCs and treat DC01 as untrusted (no longer a source of truth) until forensically cleared.
- Raise IR escalation severity: reclassify from "credential theft, contained" to "active/in-progress compromise with confirmed defense-evasion against the DC's own sensor; DC01 host-trust revoked pending forensic review and possible rebuild."
- Update the ontology/modeling-team escalation to add this as a distinct technique (self-protection/anti-EDR tamper) in the same session's chain — this shifts the actor-sophistication read from "automated smash-and-grab dumping tool" toward "tooling/operator with defense-evasion capability," which matters for the technique catalog independent of this incident's outcome.

ActionsTurn 4 — closing out the technical picture before final debrief-out on turn 5:

1. SIEM — broaden the 4662 DCSync query beyond the single DA SID. Pull every DS-Replication-Get-Changes / Get-Changes-All invocation domain-wide (all source accounts, not just the DA account) across a wider bracketing window than turn 1's check, to determine whether replication abuse was a one-off use of this single credential in this single session, or whether other accounts/sessions show the same pattern — this directly scopes how wide the "assume hashes exfiltrated" residual needs to be.

2. EDR — fleet-wide hash/IOC hunt using the Turn-1 dropped-binary hash. Even though that binary returned no reputation hit, its local hash is known from the 7045-linked drop. Sweep the full EDR-monitored fleet (not just DC01) for that hash or for the same drop/execution pattern (services.exe-spawned child, ADMIN$-delivered, unsigned) to test whether this actor already touched any other monitored endpoint.

3. EDR — current health re-check on DC01. Query present agent status (Healthy/Enforcing vs. still Impaired) now that DC01 is isolated, to close out the tamper-window timeline for the case record and determine whether DC01 can be trusted to self-report anything further while held in isolation.

4. SIEM/AD — confirm domain topology and, if multi-DC, pull 4662 replication-rights activity on every DC (not just DC01) in the same window, to rule in/out whether this session's replication pull touched more than one DC's SACL.

5. Procedural status pull (not new telemetry): krbtgt double-reset and DSRM-reset progress, plus the service/gMSA rotation list from turn 2, to report accurate current remediation state alongside the coverage debrief.

Response decisions this turn:
- Formally scope recovery as domain-wide, not DA-account-scoped: recommend IR open a full credential-rotation campaign (all accounts/computer objects whose secrets could ride in a DRSUAPI replication pull), pending action #1's results to size it precisely.
- DC01 stays isolated / host-trust revoked — no restoration to service this turn; forensic image-and-rebuild remains the exit path.
- WKS10-2214 stays isolated; formally hand it to IR/forensics for offline imaging as the only way left to close the initial-access blind spot (live EDR telemetry there is permanently NULL for this exercise — no new sensor allowed).
- DA account stays disabled — do not re-enable pending the rotation campaign.
- Document the two unresolved "no verdict" gaps below as accepted open risk for IR to carry forward, not something remaining SOC tooling this turn can close.

ActionsTurn 5 (final turn — closing actions only, no new investigative pulls needed; the record is complete as of Turn 4):

1. Procedural status pull for record accuracy (not new telemetry): re-confirm current completion state of (a) krbtgt second reset, (b) DSRM local-admin reset, (c) the Turn-2 service/gMSA rotation list — so the sign-off record states what is *actually done* vs. *still queued*, not intent.
2. Log the technique-by-technique coverage matrix into the case record and the ontology/modeling-team ticket — tagging each of the three secretsdump-style credential-access techniques (LSASS read, three-hive registry dump, DCSync) with a COVERED/robustness grade, and separately tagging the T1562.001 self-protection/tamper action (which is not one of the three credential-access techniques, but the defense-evasion action layered on top) as its own line item.
3. Formally hand the two zero-verdict items to IR as explicitly named, still-open workstreams (not implied resolved, not folded into "contained"): (i) initial-access/credential-theft origin on WKS10-2214, (ii) post-session lateral-spread/exfil verification beyond the DC01↔WKS10-2214 session.
4. Final containment-posture confirmation (state check, not a new query): DA account remains disabled; WKS10-2214 remains isolated; DC01 remains isolated/host-trust-revoked. No change proposed this turn.
5. Deliver the CISO's requested plain (a)/(b)/(c) statement (below) as the sign-off record for this ticket.

No further host/network containment actions are taken this turn — posture is held, not changed, pending the named IR workstreams.

ActionsInvestigative (no new sensors, using only EDR console + SIEM + netmon per brief):
1. EDR console on DC01: pull full process lineage for the alerted LSASS-access event — identify the child-of-services.exe process (image path, hash, PID/parent PID, command line), confirm the accessed target is lsass.exe, and confirm the access rights requested (e.g., PROCESS_VM_READ / OpenProcess pattern) plus the "remote session" flag detail (which logon session/session ID it's tied to).
2. SIEM query on DC01: pull the 7045 service-install event of record — service name, binary path, install timestamp, and the security context/logon ID that created it — and the 4624 type-3 logon event — account name (the Domain Admin service account), source workstation IP/hostname, auth package, logon ID. Correlate all three logon IDs (4624 → 7045 → EDR process session) to confirm one continuous authenticated chain: remote logon → service creation → service-spawned process → LSASS read.
3. EDR console on DC01: check current agent health / tamper log right now (controlStatus, last heartbeat) — independent of the alert having fired — since the actor may already hold admin-level credential (precondition for sensor-impairment) and a live alert in the past doesn't guarantee the sensor is enforcing now.
4. SIEM: pull recent logon history/baseline for the named Domain Admin service account (typical hours, typical source subnet) to size how anomalous this off-hours workstation-origin logon is, and check whether the source workstation shows any other flagged activity in reachable telemetry.
5. Network egress monitor: quick check for anomalous egress from DC01 or the source workstation around this window (netmon is peripheral to credential-access per the cards but cheap to check and relevant if this pivots toward exfil).

Response (within stated latitude):
6. Disable/suspend the named Domain Admin service account now — cuts off further lateral use immediately regardless of what the lineage pull shows; low blast-radius relative to isolating the DC.
7. Escalate to IR now (DC-tier + Domain Admin account involved) and to the ontology/modeling team, flagging that this incident's blast radius includes two card-unmodeled paths (SAM-hive dump, DCSync) that would return zero coverage verdict even if telemetry for them appears.
8. Hold on isolating DC01 and on krbtgt rotation pending the lineage/logon-ID correlation from steps 1-2 — both are available in my latitude but disproportionate before confirming the causal chain; will revisit next turn.

ActionsInvestigative (EDR console / SIEM / netmon only — no new sensors):

1. EDR console, DC01 — full detail on the self-protection/tamper event: exact mechanism (driver-based kill attempt / BYOVD-style per A4's base variant, or other), precise timestamp of the enforcing→impaired transition, and whether the agent is *still* impaired right now or has since recovered. Also pull whatever lineage detail the agent captured for the tamper attempt itself (parent process/image) before it went dark.

2. EDR console, DC01 — full detail on the SAM/SECURITY registry-hive event: source process image/hash/PID-parent, the logon session/account tied to it, exact timestamp of the remote-registry open and the ADMIN$ hive-file reads. Critically: check whether this timestamp falls *before or after* (a) last turn's DA-account-disable action and (b) the tamper/impairment transition from item 1 — this determines whether it's the same session as A1/the 7045 service, a still-live pre-disable session, or a new one.

3. SIEM — query Windows System/service-control-manager log on DC01 for the EDR's own service (start/stop/pause/uninstall events) in this window. This is the out-of-band secondary-telemetry check (the card layer's invEdr investigation, conf. 0.9) — I am deliberately not taking the EDR's own "impaired" self-report as sufficient confirmation, since dfEdrTelemetry is sourced from the very control being impaired (self-blinding, D6).

4. SIEM — query for any 4624 logons on DC01 (any account, any source) since the DA account was disabled last turn, to check whether the actor pivoted to a second foothold/credential rather than losing access.

5. SIEM — query AD/DS 4662 directory-service-access events on the domain root for the replication control-access-right GUIDs (DS-Replication-Get-Changes / -All) in this window. I know going in this sources no authored detect-face (A3/B3/D1) and will return no model-backed coverage verdict either way — this is a hand-scoped check for a plausible next step given the escalation trajectory, not something the card layer will grade.

6. Netmon — recheck egress from DC01 specifically in the hive-read window (hive-sized files were read; check whether they were also moved off-host, vs. staged locally only).

Response / containment (within latitude):

7. Isolate DC01 from the network now.

8. Force rotation of local secrets plausibly exposed by the SAM/SECURITY read: the local built-in Administrator account on DC01, and flag for rotation any service accounts whose credentials are known to live in LSA secrets in the SECURITY hive.

9. Re-escalate to IR + the ontology/modeling team with the updated picture: EDR impairment has occurred (not just hypothetical), the one authored-covered path is now blind, and a real SAM/SECURITY hive-dump is in progress with zero card-backed coverage or robustness verdict (A2, unmodeled) — flagging DCSync (A3) explicitly as the next-step risk to watch for by hand, since the model cannot alert on it even with positive telemetry.

10. Hold krbtgt rotation this turn, pending the 4662 query in item 5 — reserving the most disruptive action for confirmed replication-pull evidence rather than acting on the unmodeled path alone.

ActionsInvestigative (closing verification only — no new sensors, same EDR/SIEM/netmon access as before):

1. EDR console, DC01 — recheck agent health/tamper status right now (current controlStatus, current heartbeat), independent of the Turn-2 finding, to know whether we are closing this out with the sensor still impaired or recovered.
2. SIEM — re-run the out-of-band secondary/service-control-log check (the invEdr investigation) at present time, not just for the historical window, to get a current-moment independent read on EDR status before I brief the CISO on ongoing detect posture — I am still not trusting the EDR's own self-report per D6.
3. SIEM — query DC01's Security log (4624/7045) and the AD/DS 4662 domain-root replication-GUID events for any activity since Turn 2's isolation of DC01, to confirm containment has held (no further logons, service installs, or replication-right invocations post-isolation).

Response (within latitude, executed this turn):

4. Execute krbtgt rotation now (first of two spaced resets, standard remediation cadence) — held explicitly last turn pending the 4662 result, which came back positive (malicious replication-right invocation, non-DC source, pre-isolation) at the end of Turn 2; that evidentiary condition is now satisfied.
5. Deliver the CISO's three-part coverage debrief formally into the IR ticket (content below), plus a distinct, itemized modeling-backlog ask to the ontology/modeling team (author A2's registry-hive primitive+face, author A3's DCSync maneuver + an mc:Control sourcing 4662, populate the empty D5 prevent-locus) — separated from the live-incident escalation already logged in Turns 1–2, since this is a standing gap that will recur unchanged on the next incident, not something this incident fixes.
6. Maintain DC01 isolation; keep the disabled DA account disabled; hold the second krbtgt rotation pass for the standard propagation interval rather than firing both this turn.

ActionsTurn 1 — investigative first, minimal soft containment, no destructive action yet:

1. SIEM query — full 4769 detail for j.rivera, the 90-second window (±5 min padding): pull all 14 events with: target SPN string, target account behind each SPN, ticket encryption type per-request (confirm which 6 are 0x17/RC4 vs the other 8 — likely 0x12/AES), ticket options flags, and the client/source IP or hostname field on each event (this is the field that tells me where the requests actually originated).

2. DC query — 4768 (AS-REQ) for j.rivera spanning back further (last 60–90 min): confirm a normal initial TGT issuance preceded this (i.e., this is a Kerberoasting-style TGS burst off a valid, already-authenticated session, not a brute-forced/guessed logon) and capture the source IP recorded there.

3. Member-server 4624 query, domain-wide, for j.rivera in the hour preceding the alert: find every host where this account has an active logon session right now (interactive, network, RDP, or service-logon type) — this identifies the candidate origin host for the TGS-REQ burst.

4. EDR pull on whatever host(s) 4624 surfaces (workstation and/or SQLPROD-01 if it appears): process-creation telemetry in the alert window for PowerShell / rundll32 / anything spawning with command-line indicators of SPN enumeration or ticket-extraction tooling, plus PowerShell script-block logging if available, plus any outbound connections from that host to the DC on 88/tcp clustered in the same 90 seconds.

5. AD/directory lookup on the 14 target SPNs: identify which accounts own them — specifically flag any that are privileged (Domain Admins, service accounts with elevated rights, anything tied to SQLPROD-01) since those are the ones an attacker would prioritize cracking.

6. Baseline check: pull j.rivera's normal 4769 volume/rate over the past 30 days to see if this user/host routinely enumerates SPNs (e.g., an inventory/vuln-scan script, SQL linked-server enumeration, admin tooling) versus this being a first-time anomaly.

Containment posture this turn: no account disable/reset and no host isolation yet — I don't have the source host confirmed. The one contingent step I'm pre-authorizing: if step 3/4 identifies a single clear origin host (not a DC, not shared infra) showing tooling indicators, isolate that host via EDR immediately upon that finding rather than waiting for a full turn — that's low-collateral and reversible. Account disable is being held pending source/intent confirmation since j.rivera may be a legitimate, compromised, or false-positive (scanner/admin-script) identity and a premature disable could tip an attacker or break a business process without adding much containment value if the activity is host-driven rather than credential-driven elsewhere.

ActionsBoard is quiet, so I use the turn to close the one concrete exposure I've already confirmed, broaden the hunt past the narrow window/host-signature approach that came back null, and get an out-of-band human check — while still holding the disable/isolate trigger.

1. Credential rotation — svc-mssql (response decision, executed now): Reset the password on svc-mssql immediately, coordinating with the SQLPROD-01/app owner for the required service restart. Rationale: this is the one privileged, RC4-ticketed account among the 14 SPNs (local admin on SQLPROD-01). The TGS-REP for that ticket is already off the wire and in the requester's possession — nothing I do to the network un-issues it, and if it's crackable RC4 the only thing that neutralizes it before an offline crack completes is invalidating the credential now. Scoped, reversible, no user-facing account impact (doesn't touch j.rivera).

2. msDS-SupportedEncryptionTypes lookup on all 6 RC4-ticketed accounts (incl. svc-mssql): query-only, no config change. Determines whether RC4 came back because those accounts are *configured* to allow RC4 (benign/expected KDC behavior given what the account supports) versus something requester-side forcing the weaker type. This directly refines the downgrade hypothesis from Turn 1 without touching any rule or Kerberos config.

3. Domain-wide 4769 sweep, all accounts, same window forward to now: looking for (a) any other account requesting the same 14 SPNs or the svc-mssql SPN specifically — tells me if this is routine/shared admin tooling vs. isolated to j.rivera; (b) any other account anywhere in the domain showing a similar burst signature (>5 distinct SPNs in a short window) — tells me if this is a single-host event or a broader pattern I haven't scoped yet.

4. SQLPROD-01 EDR — proactive credential-use check (not just the alert window): pull the last 24h of logon/auth events for svc-mssql on SQLPROD-01 specifically, looking for anomalous source, time-of-day, or session type. This checks whether the RC4 ticket has *already* been cracked and reused, which would change this from "suspected" to "confirmed compromise" instantly.

5. Broadened EDR hunt on WKS-JRIVERA07 (last ~2 hours, not just the 90-second window): process tree, module loads, LSASS access attempts, scheduled-task/autorun creation, and any .NET assembly-load activity consistent with in-memory ticket-request tooling (e.g., reflectively-loaded Rubeus-class techniques) that wouldn't necessarily spawn a flagged process or log script-block content. Turn-1's EDR pull was scoped to the exact 90s window and command-line/script-content signatures only — I want to know if that scope, not an absence of activity, is why it came back null.

6. Out-of-band human check: contact j.rivera directly (phone/in-person, not email) to ask whether they or any authorized script/tool they run performed bulk SPN/service-ticket requests in the last hour, and to confirm they were physically at their workstation during the burst (the 4624 was Type-2/interactive, i.e., console logon, not RDP — so this is either the user themselves, or something running under their already-unlocked session, not a remote pass-the-hash into that host).

Holding: No disable of j.rivera, no isolation of WKS-JRIVERA07 this turn — still first-time-anomaly-with-no-corroborating-host-evidence, and premature action here doesn't add containment value the credential rotation doesn't already provide for the actual high-value asset. Contingent trigger for this turn's queries: if #3 shows the pattern replicated elsewhere, or #4 shows any anomalous svc-mssql logon, isolate WKS-JRIVERA07 (or the new host) and disable the implicated account immediately rather than waiting for Turn 3.

ActionsBoard is quiet on new telemetry, but Turn 2 left one critical finding unresolved in time/space — the anomalous svc-mssql Type-3 logon. That's where this turn's investigation goes, and I'm no longer holding containment pending host-level corroboration that clearly isn't coming.

Investigative:
1. Pull the full record of the anomalous svc-mssql 4624 Type-3 logon (the one surfaced in Turn 2's 24h pull): exact timestamp, source IP/hostname, session duration/still-active flag. Correlate that timestamp against (a) the original 90-second TGS-REQ burst and (b) the password-rotation completion time — I need to know whether this access fell in the crack-and-use window between burst and rotation (expected/consistent), predates the burst entirely (unrelated, re-open the question of what it is), or postdates rotation completion (meaning the new credential is already compromised too — far more urgent).
2. Resolve that source IP/hostname against asset inventory. If it's a monitored host, pull EDR (process creation, network connections, module/DLL loads) for ±30 min around the anomalous logon. If unmanaged/external, pull DC/firewall/VPN logs for that IP for any other auth activity in the same window.
3. SQLPROD-01 EDR — session-activity review, not just the logon event: file/share access, query activity if logged, account/scheduled-task creation, or outbound connections during that specific svc-mssql session. Turn 2 confirmed the logon; it did not confirm what happened during it.
4. Domain-wide sweep for that same source IP/hostname against any other account's 4624/4768 in the past 48h — determine whether this is a single-use foothold tied only to svc-mssql or a broader pivot point already used elsewhere.
5. Confirm zero svc-mssql activity from that anomalous source since rotation completed — verify the rotation actually cut access rather than merely invalidating one ticket while the underlying foothold persists.

Response decisions (executed this turn, not queries):
- Isolate WKS-JRIVERA07 via EDR network containment now, and force-terminate j.rivera's active session on it. I was withholding this pending host-level corroboration; that corroboration will not arrive — Turn 2 already established EDR has no visibility into this technique on that host. Turn 2's downstream finding (confirmed unauthorized svc-mssql access originating from a ticket this session generated) is itself sufficient trigger; waiting on proof that structurally can't appear no longer serves containment.
- Reset j.rivera's password and require re-authentication (not a full account disable) — treats the session/identity as potentially compromised without foreclosing the legitimate-user explanation, which the Turn-2 out-of-band check could neither confirm nor rule out.
- Tune the existing SIEM correlation rule (within granted latitude — tuning, not new analytics) to add a secondary condition: flag first-seen source/logon-topology for privileged or high-value service accounts. This directly closes the gap Turn 2 exposed — the anomalous svc-mssql logon generated zero alert under current "valid creds = expected" logic and only surfaced via a manual historical pull.
- Holding on any wider domain-wide lockdown — Turn 2's clean domain sweep still shows no lateral spread beyond the two implicated hosts/accounts; escalating further without evidence from actions 1-4 isn't warranted yet.

ActionsBoard is quiet, but Turn 3's reveal left one unresolved, concrete exposure — the svc-mssql Type-3 session on SQLPROD-01 was still logged in with no 4634 logoff recorded as of that query, meaning the credential rotation blocked *future* authentications but did not close the session that predates it. That's this turn's priority, plus a persistence/blast-radius hunt on SQLPROD-01 that hasn't been done yet.

Response actions (executed now):
1. Force-terminate the still-open svc-mssql session on SQLPROD-01 via EDR/host action (kill the logon session directly — do not rely on the already-completed password rotation to have done this, since it doesn't). This is the one confirmed-live exposure still outstanding.
2. Escalate j.rivera from password-reset to full account disable, pending forensic clearance of WKS-JRIVERA07. Rationale: forced reauth already blocks reuse of the old credential, but the account-vs-host attribution question (legitimate user, compromised user, or fileless in-session tooling) was never resolved and structurally may never be resolvable given EDR's blind spot on this technique — with the turn cap one away, I'm closing residual ambiguity on a reversible, low-collateral control rather than leaving it open.
3. Hold WKS-JRIVERA07 in isolation — no reintegration until the persistence hunt below is clean.

Investigative (this turn):
4. SQLPROD-01 EDR — persistence hunt, full dwell window (original burst time → now): local Administrators group membership changes, new local account creation, scheduled-task creation/modification, new/modified services, registry Run/RunOnce keys, WMI event-subscription creation. Turn 3 only checked "file/share access, query activity, account/scheduled-task creation" as of the query instant against the open session — this is a broader, dedicated persistence-artifact sweep, not a repeat.
5. SQLPROD-01 EDR — LSASS access / credential-access telemetry on SQLPROD-01 itself, same window. Not yet queried: svc-mssql's local-admin rights on this box mean that if the session was used maliciously, it's the natural place to harvest further local or cached-domain credentials and expand blast radius beyond svc-mssql.
6. SQLPROD-01 EDR — outbound/egress connections *from* SQLPROD-01, full dwell window. Turn 3 only checked inbound (WKS-JRIVERA07 → SQLPROD-01); egress from the high-value asset itself for C2/exfil/further lateral movement has not been checked.
7. Confirm WKS-JRIVERA07 containment is holding: EDR check for any network-egress attempts or process activity since isolation was applied — verify the control is actually effective, not just issued.
8. Domain-wide 4624/4768 sweep, past 48h, specifically cross-referencing any new local account or service-principal touching SQLPROD-01 (ties to #4) — confirm no second foothold was staged there.

ActionsTurn 5 (final) actions:

1. Answer the SOC lead debrief directly (this turn's primary deliverable — analytical, not a query):

(a) Behavior named by observable effect: a single account/session requesting service tickets for many distinct service principals within a very short window (burst TGS-REQ volume anomaly) — bulk service-ticket harvesting positioned for offline password-cracking — followed hours later by an authentication reusing one harvested ticket's target credential from a topology never seen before for that account. Grade: the deployed rule is NOT evasion-robust in general. It is a burst/threshold heuristic (many distinct SPNs in a short window) that reliably catches noisy, default-tool enumeration (grab-every-SPN behavior) but is trivially evaded by pacing requests below the volume/time threshold, or by targeting only one or two already-known high-value SPNs instead of enumerating broadly. It is also the *sole* detection layer for this entire attack class in this environment (established across turns 1-4: EDR has zero visibility into either the ticket-request step or the credential-reuse step) — so a miss here is a total miss, not a miss-with-backup. Verdict: LOW robustness against a patient/targeted adversary, moderate-at-best against the noisy/default-tool profile that this specific incident happened to be.

(b) AES-instead-of-RC4 hypothetical: best available inference (hedged — the rule's literal logic was never shown to us, only its behavior) is that the correlation trigger keys on request-volume/burst anomaly with RC4-fraction as an enriching attribute, not a hard gate — so an identical 14-SPN/90-second burst using AES throughout would likely still have tripped the same volume-based alert. But two caveats: this is inferred, not confirmed; and even if the initial burst is still caught, AES256 is materially more expensive to crack offline than RC4-HMAC, so the specific follow-on chain (crack completing and credential reused within ~6 hours, before rotation) is less likely to succeed on the same timeline against a non-trivial password — though not impossible. Critically, the credential-reuse step (novel-topology 4624 for a privileged service account) had zero detection regardless of encryption type — that gap is about logon-topology novelty, not ticket crypto, so this hypothetical doesn't change it.

(c) Where the offline crack appears in telemetry: nowhere. None of DC/SIEM (4768/4769), EDR (workstation or SQLPROD-01), or 4624 logs can record an offline cracking computation — it's off-network compute against a ticket already fully issued and in the requester's possession. Turns 1, 2, and 4's repeated EDR nulls (narrow window, then widened to 2 hours with technique-broadened coverage) confirm this host's endpoint telemetry has no visibility into in-session ticket-handling either. That absence is structural, not a fixable detection gap — you cannot instrument an air-gapped computation. Implication: detection must bracket the invisible middle step — catch ticket-issuance anomaly on one side (partially covered today, burst-pattern-dependent) and catch credential-reuse-with-novel-topology on the other (currently NOT covered by any rule; this incident's reuse was found only because it was manually pulled, three separate times across turns 2-4). The highest-value fix is standing up that missing second layer.

2. Directory query (read-only, in-latitude): domain-wide scan for other privileged/local-admin-holding service accounts still permitting RC4 via msDS-SupportedEncryptionTypes — determine whether svc-mssql's exposure was a one-off or part of a broader hygiene gap.

3. Final containment-state re-verification (query, not new action): re-confirm directly rather than take on the tick alone — WKS-JRIVERA07 still isolated, j.rivera disable flag still set, svc-mssql new credential exclusively in use with zero old-credential attempts, zero new 4769/4624/EDR alerts since last check.

4. No new isolations, disables, or resets this turn. All confirmed exposure has already been actioned (credential rotation, forced session-kill, account disable, host isolation); domain-wide sweeps have been clean for three consecutive turns (2, 3, 4) with no lateral spread.

5. Response decisions — logged as mandatory post-incident items, not executed live (outside the "query/isolate/disable-reset/tune-existing-rules" latitude, consistent with Turn 3's rejection of new-analytic deployment): (i) enforce AES-only on the six RC4-permitting accounts, prioritizing any others sharing svc-mssql's local-admin profile; (ii) build the missing second-layer detection rule — first-seen-source/topology-novelty alerting on privileged service-account 4624 logons; (iii) require full disk+memory forensic imaging of WKS-JRIVERA07 before reintegration, given EDR's demonstrated blind spot on this technique class for that host; (iv) implement session/token revocation as part of credential-rotation procedure — this incident showed rotation and session-kill are distinct controls that must both fire.

ActionsTurn 1 — investigative queries first, one no-regret containment step, no isolation yet:

1. DC Security log pull (4769), full detail, last 24h for j.rivera: list every SPN requested, enc-type per request (0x17/RC4 vs 0x12/AES vs 0x11), ticket options, and the source-IP/workstation field on each event — not just the SIEM's 14-in-90s summary. I need the complete SPN list and the enc-type split (only 6 of 14 were flagged RC4 — what were the other 8?).
2. 4624 logon-event pull for j.rivera in the window preceding and during the burst: logon type, source host/IP, to establish the originating workstation.
3. Cross-reference the 14 targeted SPNs against the service-account directory — specifically check whether SQLPROD-01's SQL service account is among them (this is the link to the crown-jewel host).
4. EDR pull on whatever host step 2 identifies (process creation, command-line, network-to-DC) for the burst window, looking for Kerberoasting tool artifacts (Rubeus/PowerView/GetUserSPNs/mimikatz) or preceding LDAP/SPN enumeration.
5. Account-attribute check on j.rivera: human vs. service account, privilege/group membership, recent changes, and whether any other alert correlates to this account or a source host in the same window.

Containment decision taken now: force a password reset / session invalidation on j.rivera — a low-cost, no-regret step given the burst is a textbook harvest pattern, cutting off further ticket requests under the current session. Not a full account disable yet, and not isolating SQLPROD-01 — no telemetry yet ties this to that host and disabling/isolating on an unconfirmed source is disproportionate. Once step 3 returns the SPN list, I will flag (for next turn) proactive credential rotation of any targeted service accounts, especially SQLPROD-01's, as that's the actual invariant fix, not action on the requester's account.

ActionsT2 — quiet consoles do not end the investigation; I do NOT stand down. Concrete actions:

1. Raw DC Security log pull, 4769, ALL accounts, ALL enc-types, window = T1-burst-start through now (bypassing the correlation-rule filter entirely): the SIEM being quiet only tells me dfKerbRc4 hasn't fired again — it says nothing about an AES-only continuation (varAesRoast), which produces no obsRc4EncType and is invisible to the one deployed face. I want to manually eyeball raw ticket-request volume/diversity per principal (the obsSpnHarvest signal) since no rule is deployed to do this for me. This is a one-time investigative query, not a new standing analytic, so it stays inside response latitude ("query any modeled log source") without crossing into "deploy new analytics mid-incident."

2. Verify containment held: 4769/4624 pull for j.rivera specifically since the password reset. Confirm zero TGS-REQs and no new logon under a re-established session — i.e., confirm the session invalidation actually stuck rather than assuming it from silence.

3. Manual AS-REP spot-check (flagged last turn, executing now): DC Security log 4768 pull for any accounts with pre-auth disabled, same overall window. mAsRepRoast has zero deployed analytic (A2/C2, notCovered/SILENT) — the only way to check this sibling technique is a manual look, not an alert.

4. Account-attribute/privilege check on the other 13 targeted SPNs' service accounts (only svc-mssql was checked for elevated rights last turn) — looking for any other targeted account that, like svc-mssql, holds admin rights on a high-value host.

5. SQLPROD-01 EDR + 4624 pull filtered to the svc-mssql account specifically, since the burst, as a low-confidence enrichment check only — explicitly not trusted as clearing anything (see hypothesis).

6. Containment/response decision taken now: rotate the svc-mssql service-account credential. Using response latitude's "disable/reset accounts." Flagging for coordination with SQL/infra on dependent-service restart, but proceeding — this is the one action that fixes the actual exposure regardless of what detection does or doesn't show later.

Not doing this turn: no isolation of SQLPROD-01, no further action against j.rivera beyond the standing reset (no new evidence to escalate), no deployment of a volume-based Kerberoast rule (dfKerbVolume) — that would be a new analytic, which response latitude excludes mid-incident; it goes on the post-incident change-control list instead of being claimed as done now.

ActionsTurn 3 — quiet consoles + confirmed AD replication do not close this incident. The one loose thread from last turn — the atypical svc-mssql logon to SQLPROD-01 — was only partially investigated (bare logon event, no source identity, no session detail), and that's this turn's priority:

1. Resolve full identity of the atypical svc-mssql Type-3 logon source: pull the exact source hostname/IP/asset-record from that SQLPROD-01 4624 event, and cross-reference against (a) j.rivera's registered workstation IP from Turn 1 Action 2, and (b) the known asset/workstation inventory — managed corporate endpoint, unmanaged/unknown device, or external address? This is the highest-value open unknown: same-host would tie reuse directly to the original requester's box; a different/unknown host would mean the harvested material is already circulating beyond the original point of compromise.

2. Full SQLPROD-01 EDR session reconstruction around that specific logon: process-creation tree, child processes, command-lines, file reads/writes, and all network connections (internal and outbound) for the session's duration — not just the bare logon event returned last turn. Looking for LSASS/credential-dumping access, persistence artifacts, data staging, or outbound connections indicating this was more than a benign admin task.

3. 4769/4624 pull with SQLPROD-01 as source since that logon — did the session spawn any further ticket requests or logons to other hosts? Treats SQLPROD-01 as a potential pivot point, not only a destination.

4. Domain-wide 4625 (failed logon) pull for svc-mssql since the rotation replicated — checking whether anything is now attempting (and failing) to reuse the old, invalidated secret. A hit would be independent confirmation the material was actually harvested/used, plus a second source-IP data point.

5. If step 1 resolves a previously-untriaged host: run the same baseline triage on it that was run on j.rivera's workstation in Turn 1 (EDR process/command-line pull, 4624 history) — treat it as a newly identified endpoint of interest, not benign-by-association with a "legitimate" account.

Containment decision this turn: network-isolate SQLPROD-01 (contain egress/lateral pathways, host stays live for forensics — not a power-off). Turn 1 withheld isolation because "no telemetry yet ties this to that host"; that condition no longer holds — Turn 2 surfaced an atypical, admin-capable logon by the exact account whose ticket material was harvested in the confirmed burst, on the exact crown-jewel host. That's direct telemetry now tying the incident to SQLPROD-01, and isolation is within response latitude. No-regret framing: production access restores quickly once steps 1-4 clear the session; leaving a possibly-already-used admin-capable session's pathways open on the crown jewel while attribution is unresolved is the disproportionate risk. Coordinate scope (segmentation over full shutdown) with SQL/infra, same as the pending service-restart coordination from the rotation.

No change to j.rivera (reset holding, no new evidence beyond the original burst). No new analytic deployed (outside response latitude mid-incident) — flagging for post-incident change control only: (a) deploy dfKerbVolume / a 4768 AS-REP analytic to close C1's invariant rung and C2's silent gap; (b) a compensating rule for D5's blind spot — alert on high-privilege service accounts (starting with svc-mssql) logging on interactively/Type-3 from outside a small allowlisted baseline host set, since "valid credential + legitimate account" is exactly what makes dfSqlLogon degraded.

ActionsTurn 4 — two full passes of console quiet (T3→T4) plus "no activity since Turn 3 pulls" narrow what's left open, but the one loose thread from Turn 3 (the unmanaged device that logged on as svc-mssql) is still unresolved, not cleared. Concrete actions:

1. Domain-wide 4624 pull filtered on source network address 10.61.204.19 (NOT filtered by account), full window from before the T1 burst through now: Turn 3 resolved *what* logged into SQLPROD-01 from this address under svc-mssql; it never checked whether this same address touched *any other host* in the domain, under any credential, before or after that session. This is the natural next step off an identity resolution, not a repeat of Turn 3.
2. Domain-wide 4625 (failed-logon) pull, same source address 10.61.204.19, same window: mirrors the logic of Turn 3's svc-mssql-secret-reuse check — did this device attempt and fail anywhere else, which would be independent corroboration this is an active foothold rather than a one-off.
3. Session-state check on SQLPROD-01: is the specific svc-mssql interactive logon session (the one that spawned cmd.exe in Turn 3's reconstruction) still open, or has it already terminated? Network isolation cuts egress/lateral pathways going forward; it does not by itself guarantee an already-established interactive session token was killed. If the session is still live: terminate/log off that session now — a narrow, no-regret action distinct from the standing network isolation.
4. Re-pull SQLPROD-01 EDR (process/file/network) for the isolation window end-to-end directly from source, rather than resting on the White Cell's summary alone, to independently corroborate "no activity since Turn 3."
5. Re-verify j.rivera containment still holds (4769/4624, since last checked in Turn 2): zero new ticket requests, zero new logons, confirming no drift.

Response decisions this turn: terminate the atypical svc-mssql session on SQLPROD-01 if action 3 shows it's still open (in addition to, not instead of, the standing network isolation). No change to j.rivera disposition. No change to the 13 non-elevated SPN-targeted service accounts (Turn 2 action 4 already cleared them of elevated access — rotating them now would be unjustified operational burden, not a security response to any finding in hand). SQLPROD-01 isolation remains in effect — not lifted this turn; nothing in this turn's evidence clears the unmanaged-device thread. No new analytic deployed (still outside response latitude mid-incident; dfKerbVolume and a compensating Type-3-from-unallowlisted-host rule for svc-mssql remain queued for post-incident change control only).

ActionsTurn 5 — closing turn, no new leads to chase, so actions are final-state verification + formal incident disposition, not new investigation:

1. Closing consolidated log snapshot, domain-wide, full incident window (T1→now): one final 4769/4624/4625 pull across all accounts/hosts, timestamped as the incident-record baseline, to certify (for the written closure) that nothing changed between Turn 4's re-verification and now — not a new query technique, just the formal "as-of-close" capture.
2. Final containment-state confirmation: verify SQLPROD-01 remains network-isolated, the svc-mssql interactive session remains terminated (no new 4624/4769 against that session or account since Turn 4), and j.rivera's reset still holds. No drift.
3. Disposition decisions, logged as of close:
- SQLPROD-01: isolation remains in effect — NOT lifted. The unattributed source (10.61.204.19) was never resolved to an owner/asset; per Turn 3/4 findings it has no EDR, no CMDB record, and no further reach beyond the one session already terminated. Absence of spread is not attribution — isolation stays until forensic imaging / IR hands back a clean bill, which is outside this exercise's scope.
- j.rivera: reset stands, no further action — no new evidence since the original burst.
- svc-mssql: rotation stands (already replicated domain-wide); session already terminated. This, not any detection outcome, is what neutralizes the harvested material (D3).
- 13 non-elevated SPN-targeted accounts: no action — confirmed low-privilege, no justification to burden them operationally.
- Unattributed device 10.61.204.19: escalate as a standing IR/threat-intel/network-forensics referral (not a SOC-console item — it sits entirely outside modeled telemetry per B0/A4's structural-void framing) — asset-ownership tracing is a physical/network-layer investigation this environment's tooling cannot perform.
4. Queue for post-incident change control (explicitly NOT deployed now — outside response latitude mid-incident):
(i) dfKerbVolume sourced on obsSpnHarvest (L4) — closes the invariant rung C1 currently leaves open;
(ii) a 4768/AS-REP analytic — closes C2's SILENT gap;
(iii) a compensating rule for privileged service accounts (starting with svc-mssql) alerting on Type-3 interactive logon from outside a small allowlisted host set — compensates for D5's degraded-by-legitimacy blind spot on dfSqlLogon, since the face itself cannot be fixed by control health;
(iv) written debrief note (below) answering the SOC lead's three questions for the incident record.

No new queries beyond the closing snapshot; no new isolation/account actions beyond what's already stood up; no new analytics deployed mid-incident.