Unit 1: Who attacks and how · Lesson 3 of 4 · 22 min
Mapping alerts to stages
Replay last month's intrusion from its alerts and find the moment it could have been stopped.
mission
- You are
- The analyst presenting last month's intrusion at the case review.
- Situation
- IR-2026-0921 started with a phishing email to three people and ended with a payment request to a new bank account. Every alert is in alerts.csv, oldest first.
- Goal
- Rebuild the story stage by stage and name the earliest alert that should have triggered a response.
- Hand in
- The time and text of that alert.
case file
Colonial Pipeline Legacy VPN Account
Colonial Pipeline · 2021
In May 2021 DarkSide ransomware affiliates disrupted Colonial Pipeline, which halted pipeline operations for nearly a week and paid a $4.4 million ransom. The CEO testified to the US Senate that attackers entered on or around 29 April through a legacy VPN profile that was no longer in use but still active and protected only by a password, with no multifactor authentication. The password was later found in a batch of leaked credentials, suggesting reuse, though how it was obtained was not determined.
What went wrong
A dormant but active remote access account that required only a password and was not covered by MFA or account lifecycle reviews.
What would have stopped it
- Enforce MFA on all remote access, with no legacy exceptions
- Account lifecycle management that disables unused VPN profiles and accounts
- Monitor for organizational credentials appearing in breach dumps and force resets
- Segment IT from operational technology so IT ransomware does not force OT shutdown
What defenders could have seen
- Successful VPN login on an account with no recent activity
- VPN authentication without an MFA event recorded
- Credential exposure alerts from breach monitoring services
Colonial's attackers came in through a remote access account nobody used any more. Here the way in was an email. The lesson is the same: initial access is the cheapest stage to stop, so know exactly what it looked like.
Look at the shape of the data
Check the header and a few rows before you search. You need to know which field is which.
head -4 alerts.csv time,host,user,alert,stage 2026-09-21T06:12:04Z,edge-fw,-,Port scan from 203.0.113.17,reconnaissance 2026-09-21T06:40:51Z,web01,-,Repeated login failures on /admin,reconnaissance 2026-09-21T08:03:22Z,mx1,m.bianchi,Phishing email delivered,initial-access wc -l alerts.csv 16 alerts.csv
you should see Five fields: time, host, user, alert, stage. Fifteen alerts plus a header.
Count alerts per stage
Counting is the fastest way to see where the noise was. cut picks the stage field, sort | uniq -c counts it.
tail -n +2 alerts.csv | cut -d, -f5 | sort | uniq -c | sort -rn
3 lateral-movement
3 initial-access
2 reconnaissance
2 persistence
2 exfiltration
1 impact
1 execution
1 credential-access
defender tip Big counts are not the important ones. One execution alert mattered more than three delivery alerts.
Follow one user
Most intrusions run through one account. Filter on it to see the attack from the inside.
grep m.bianchi alerts.csv | cut -d, -f1,2,4
2026-09-21T08:03:22Z,mx1,Phishing email delivered
2026-09-21T08:17:45Z,ws-0412,Office document started a script
2026-09-21T08:18:10Z,ws-0412,New scheduled task created
2026-09-21T08:31:02Z,proxy,Password entered on lookalike login page
2026-09-21T09:05:40Z,fs01,Login to fs01 from ws-0412
2026-09-21T09:06:12Z,db01,Login to db01 from fs01
2026-09-21T09:07:55Z,backup01,Login to backup01 from fs01
2026-09-21T09:40:18Z,fs01,Archive of 2.1 GB created in a temp folder
2026-09-21T09:52:30Z,edge-fw,1.9 GB upload to files.example.net
2026-09-21T10:20:00Z,mx1,Mailbox rule forwards invoices outside
you should see Fourteen minutes after the email, a document started a script on ws-0412. Then the hops to fs01, db01 and backup01.
Trace the movement
Lateral movement alerts show which machine the attacker used to reach the next one.
grep lateral alerts.csv | cut -d, -f2,4
fs01,Login to fs01 from ws-0412
db01,Login to db01 from fs01
backup01,Login to backup01 from fs01
you should see fs01 was the stepping stone to the database and the backup server.
Check how they got in
Read the initial access alerts. Then ask what the same stage would look like if the door had been a VPN account instead of an email.
grep initial-access alerts.csv | cut -d, -f1,2,4
2026-09-21T08:03:22Z,mx1,Phishing email delivered
2026-09-21T08:03:23Z,mx1,Phishing email delivered
2026-09-21T08:03:24Z,mx1,Phishing email delivered
you should see Three phishing emails, a second apart. Here the door was mail.
defender tip For a door like Colonial's, the alert to build is a VPN sign-in on an account with no activity for 90 days and no MFA event. Disabling unused remote access accounts removes the door entirely.
Filter the timeline
2026-09-21T08:03:22Z mx1 m.bianchi Phishing email delivered initial-access 2026-09-21T08:17:45Z ws-0412 m.bianchi Office document started a script execution 2026-09-21T08:18:10Z ws-0412 m.bianchi New scheduled task created persistence 2026-09-21T09:05:40Z fs01 m.bianchi Login to fs01 from ws-0412 lateral-movement 2026-09-21T09:52:30Z edge-fw m.bianchi 1.9 GB upload to files.example.net exfiltration
5 of 7 lines. grep -c would print 5.
What a defender takes away
- 1Count by stage to see the shape of an incident before reading every line.
- 2Filter by the compromised user to read the attack in order.
- 3The execution alert at 08:17 was the cheapest place to stop everything that followed.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.