Investigations
SOC
What Expel opened for AMHS, how each type was stopped or only seen, and the incidents AMHS is running from that queue.
Opened and resolved
Bucketed so a handful of investigations still reads as a trend.
- Opened
- Resolved
Type and protection
One stack per type. False positives are left out.
- Blocked
- Detected
- Manual
Average resolution, ranked
Slowest type first, among investigations resolved in this window. Target is 8 hours.
- 1. Ransomware16.0h
2 closed · 8.0h over target
- 2. Insider activity15.5h
2 closed · 7.5h over target
- 3. Data exfiltration13.8h
2 closed · 5.8h over target
- 4. Business email7.8h
2 closed · 15m under target
- 5. Command and control7.3h
2 closed · 45m under target
- 6. Phishing5.0h
2 closed · 3.0h under target
- 7. Malware2.8h
2 closed · 5.2h under target
- 8. Suspicious login1.7h
2 closed · 6.3h under target
Contained encryption attempt on a finance PC
The host tried to delete shadow copies and encrypt documents. SentinelOne blocked both. Rebuild and credential reset took the rest of the day, which is why this sits over the target.
- Id
- EXP-4370
- Assignee
- M. Alvarez
- Opened
- 13 Oct 22:08 UTC
- Resolution
- 18.0h
- Assets
- AMHS-WS-0448
Techniques
- T1486 Data encrypted for impact
- T1490 Inhibit system recovery
Signals
- S1-90990 · Tamper protection stopped shadow-copy deletion; encryption killed
Investigation queue
Open items stay listed even if they started before this window. Charts above do not do that.
| Id | Title | Type | Severity | Status | Protection | Opened | Resolution |
|---|---|---|---|---|---|---|---|
| Credential harvest sent to the shared clinical mailbox | Phishing | critical | Open | Detected | 17 Oct 16:08 | Open | |
| Workstation beaconed to a newly registered host | Command and control | medium | Investigating | Blocked | 17 Oct 13:08 | Open | |
| Vendor asked accounts payable to change bank details | Business email | high | Investigating | Detected | 17 Oct 11:08 | Open | |
| Loader quarantined after a macro on a clinic PC | Malware | medium | Contained | Blocked | 17 Oct 07:08 | Open | |
| Encryption stopped on an East Campus revenue workstation | Ransomware | critical | Contained | Blocked | 17 Oct 04:08 | Open | |
| Research file server sent an unusual volume of DNS | Data exfiltration | high | Open | Detected | 16 Oct 20:08 | Open | |
| Push marked as fraud during an overnight sign-in | Suspicious login | high | Resolved | Blocked | 16 Oct 16:08 | 2.0h | |
| Payroll lure with a weaponized attachment | Phishing | high | Resolved | Blocked | 15 Oct 20:08 | 4.5h | |
| Security newsletter quarantined | Phishing | low | False positive | Blocked | 15 Oct 15:08 | 48m | |
| Obfuscated loader killed before a second stage | Malware | high | Resolved | Blocked | 15 Oct 00:08 | 3.2h | |
| HTTPS beacon blocked at the resolver | Command and control | medium | Resolved | Blocked | 14 Oct 14:08 | 6.5h | |
| Contained encryption attempt on a finance PC | Ransomware | high | Resolved | Blocked | 13 Oct 22:08 | 18.0h | |
| Benefits export uploaded to personal cloud storage | Data exfiltration | medium | Resolved | Manual | 12 Oct 22:08 | 15.5h | |
| Gift-card request impersonating an executive | Business email | medium | Resolved | Detected | 12 Oct 02:08 | 9.0h | |
| After-hours copy from a finance share | Insider activity | medium | Resolved | Manual | 11 Oct 16:08 | 21.0h | |
| Password spray against a service account | Suspicious login | low | Resolved | Blocked | 11 Oct 06:08 | 1.4h | |
| Signature-request link removed from inboxes | Phishing | medium | Resolved | Detected | 10 Oct 20:08 | 5.5h | |
| Adware installer quarantined on a lobby kiosk | Malware | low | Resolved | Blocked | 9 Oct 14:08 | 2.4h | |
| Rare destination on a lab workstation | Command and control | low | Resolved | Detected | 8 Oct 18:08 | 8.0h | |
| Shadow-copy tamper blocked, no encryption | Ransomware | medium | Resolved | Blocked | 7 Oct 02:08 | 14.0h | |
| Personal webmail used for a small export | Data exfiltration | low | Resolved | Detected | 5 Oct 10:08 | 12.0h | |
| USB copy by a departing contractor | Insider activity | low | Resolved | Manual | 1 Oct 06:08 | 10.0h | |
| Freemail invoice never reached accounts payable | Business email | low | Resolved | Blocked | 27 Sep 22:08 | 6.5h |
Incidents
Declared by AMHS from an Expel investigation. Not every investigation becomes one.
| Id | Title | Severity | Status | Owner | Investigation | Opened |
|---|---|---|---|---|---|---|
| INC-1092 | Vendor payment-detail change held No payment file was edited. Vendor callback is outstanding. | high | Declared | Andre Silva | EXP-4414 | 17 Oct 12:08 |
| INC-1094 | Contained ransomware on an East Campus workstation One workstation isolated. No shared-drive encryption observed. | critical | Contained | Lina Bennett | EXP-4418 | 17 Oct 05:08 |
| INC-1090 | Research server DNS anomaly File server still online. Destination was not blocked. | high | Declared | Ruth Adeyemi | EXP-4411 | 16 Oct 22:08 |
| INC-1077 | Payroll lure removed before open No mailbox compromise. Payroll distribution list searched. | medium | Closed | Andre Silva | EXP-4390 | 15 Oct 21:08 |
| INC-1086 | Finance PC encryption attempt recovered Host rebuilt. Local credentials rotated. No data loss confirmed. | high | Recovered | Lina Bennett | EXP-4370 | 13 Oct 23:08 |
| INC-1081 | After-hours finance share copy Contractor access removed. Copied set inventoried with Finance. | medium | Closed | Hannah Cho | EXP-4355 | 11 Oct 18:08 |
| INC-1064 | Small export via personal webmail Export was not sensitive. User coached. No control change yet. | low | Closed | Chris Palumbo | EXP-4302 | 5 Oct 12:08 |