Investigations
SOC
What Expel opened for AMHS, how each type was stopped or only seen, and the incidents AMHS is running from that queue.
Opened and resolved
Bucketed so a handful of investigations still reads as a trend.
- Opened
- Resolved
Type and protection
One stack per type. False positives are left out.
- Blocked
- Detected
- Manual
Average resolution, ranked
Slowest type first, among investigations resolved in this window. Target is 8 hours.
- 1. Ransomware16.0h
2 closed · 8.0h over target
- 2. Insider activity15.5h
2 closed · 7.5h over target
- 3. Data exfiltration13.8h
2 closed · 5.8h over target
- 4. Business email7.8h
2 closed · 15m under target
- 5. Command and control7.3h
2 closed · 45m under target
- 6. Phishing5.0h
2 closed · 3.0h under target
- 7. Malware2.8h
2 closed · 5.2h under target
- 8. Suspicious login1.7h
2 closed · 6.3h under target
Encryption stopped on an East Campus revenue workstation
A macro on AMHS-WS-1844 tried to encrypt local files. SentinelOne killed the process and isolated the host. Shared drives do not show encryption.
- Id
- EXP-4418
- Assignee
- M. Alvarez
- Opened
- 17 Oct 04:08 UTC
- Resolution
- Still open
- Assets
- AMHS-WS-1844
Techniques
- T1486 Data encrypted for impact
- T1204.002 Malicious file
- T1059.001 PowerShell
Signals
- S1-91820 · Payload killed and the host isolated
Investigation queue
Open items stay listed even if they started before this window. Charts above do not do that.
| Id | Title | Type | Severity | Status | Protection | Opened | Resolution |
|---|---|---|---|---|---|---|---|
| Credential harvest sent to the shared clinical mailbox | Phishing | critical | Open | Detected | 17 Oct 16:08 | Open | |
| Workstation beaconed to a newly registered host | Command and control | medium | Investigating | Blocked | 17 Oct 13:08 | Open | |
| Vendor asked accounts payable to change bank details | Business email | high | Investigating | Detected | 17 Oct 11:08 | Open | |
| Loader quarantined after a macro on a clinic PC | Malware | medium | Contained | Blocked | 17 Oct 07:08 | Open | |
| Encryption stopped on an East Campus revenue workstation | Ransomware | critical | Contained | Blocked | 17 Oct 04:08 | Open | |
| Research file server sent an unusual volume of DNS | Data exfiltration | high | Open | Detected | 16 Oct 20:08 | Open | |
| Push marked as fraud during an overnight sign-in | Suspicious login | high | Resolved | Blocked | 16 Oct 16:08 | 2.0h | |
| Payroll lure with a weaponized attachment | Phishing | high | Resolved | Blocked | 15 Oct 20:08 | 4.5h | |
| Security newsletter quarantined | Phishing | low | False positive | Blocked | 15 Oct 15:08 | 48m | |
| Obfuscated loader killed before a second stage | Malware | high | Resolved | Blocked | 15 Oct 00:08 | 3.2h | |
| HTTPS beacon blocked at the resolver | Command and control | medium | Resolved | Blocked | 14 Oct 14:08 | 6.5h | |
| Contained encryption attempt on a finance PC | Ransomware | high | Resolved | Blocked | 13 Oct 22:08 | 18.0h | |
| Benefits export uploaded to personal cloud storage | Data exfiltration | medium | Resolved | Manual | 12 Oct 22:08 | 15.5h | |
| Gift-card request impersonating an executive | Business email | medium | Resolved | Detected | 12 Oct 02:08 | 9.0h | |
| After-hours copy from a finance share | Insider activity | medium | Resolved | Manual | 11 Oct 16:08 | 21.0h | |
| Password spray against a service account | Suspicious login | low | Resolved | Blocked | 11 Oct 06:08 | 1.4h | |
| Signature-request link removed from inboxes | Phishing | medium | Resolved | Detected | 10 Oct 20:08 | 5.5h | |
| Adware installer quarantined on a lobby kiosk | Malware | low | Resolved | Blocked | 9 Oct 14:08 | 2.4h | |
| Rare destination on a lab workstation | Command and control | low | Resolved | Detected | 8 Oct 18:08 | 8.0h | |
| Shadow-copy tamper blocked, no encryption | Ransomware | medium | Resolved | Blocked | 7 Oct 02:08 | 14.0h | |
| Personal webmail used for a small export | Data exfiltration | low | Resolved | Detected | 5 Oct 10:08 | 12.0h | |
| USB copy by a departing contractor | Insider activity | low | Resolved | Manual | 1 Oct 06:08 | 10.0h | |
| Freemail invoice never reached accounts payable | Business email | low | Resolved | Blocked | 27 Sep 22:08 | 6.5h |
Incidents
Declared by AMHS from an Expel investigation. Not every investigation becomes one.
| Id | Title | Severity | Status | Owner | Investigation | Opened |
|---|---|---|---|---|---|---|
| INC-1092 | Vendor payment-detail change held No payment file was edited. Vendor callback is outstanding. | high | Declared | Andre Silva | EXP-4414 | 17 Oct 12:08 |
| INC-1094 | Contained ransomware on an East Campus workstation One workstation isolated. No shared-drive encryption observed. | critical | Contained | Lina Bennett | EXP-4418 | 17 Oct 05:08 |
| INC-1090 | Research server DNS anomaly File server still online. Destination was not blocked. | high | Declared | Ruth Adeyemi | EXP-4411 | 16 Oct 22:08 |
| INC-1077 | Payroll lure removed before open No mailbox compromise. Payroll distribution list searched. | medium | Closed | Andre Silva | EXP-4390 | 15 Oct 21:08 |
| INC-1086 | Finance PC encryption attempt recovered Host rebuilt. Local credentials rotated. No data loss confirmed. | high | Recovered | Lina Bennett | EXP-4370 | 13 Oct 23:08 |
| INC-1081 | After-hours finance share copy Contractor access removed. Copied set inventoried with Finance. | medium | Closed | Hannah Cho | EXP-4355 | 11 Oct 18:08 |
| INC-1064 | Small export via personal webmail Export was not sensitive. User coached. No control change yet. | low | Closed | Chris Palumbo | EXP-4302 | 5 Oct 12:08 |