Incident Response Timeline
Ransomware Attack & Containment Detection to Escalation: 1 Minute
Explore a real-world attack on a customer in the utilities industry. The threat actor leveraged a malicious encoded PowerShell Script (Base64) and within a minute of detection, the Â鶹¹û¶³ Labs team triggered an investigation.
We¡¯ll show you, step by step, how Â鶹¹û¶³ helped this customer both stop this attack as well as develop a roadmap for preventing future ones.
When minutes matter, turn to industry-leading security operations to detect, investigate and escalate incidents before they impact your business.
Industry Average
Average number of days to detect and remediate a ransomware attack
With Â鶹¹û¶³
Actual time from detection to remediation in this real-world Â鶹¹û¶³ ransomware response
View Timeline Navigation
Wednesday, 4 May, 2022 |5:53 PM
Detection: Â鶹¹û¶³ Agent
5:53 pm
5:54 pm
1 Minute Since Attack
Wednesday, 4 May, 2022 | 5:54 pm
Investigation Triggered
5 Minutes Since Attack
Wednesday, 4 May, 2022 | 5:58 PM
Investigation Escalated
5:58 pm
6:01 pm
8 Minutes Since Attack
Wednesday, 4 May, 2022 | 6:01 PM
Endpoint Contained
12 Minutes Since Attack
Wednesday, 4 May, 2022 | 6:05 PM
Incident Ticketed
6:05 pm
Begin Post-Incident Zone
6:06 pm
13 Minutes Since Attack
Wednesday, 4 May, 2022 | 6:06 PM
Post-Incident Security Journey
The Concierge Security Team works with the customer to identify areas of improvement related to this high-severity incident:
Enforce stricter controls over egress traffic
Implement ability to control browser settings
Consult on implementing PowerShell policies with more restrictive permissions such as Just Enough Administration (JEA) and execution of only signed scripts
Recommend Windows 10 AppLocker for validating PowerShell scripts
Consult on technology solutions and best practices to increase likelihood of preventing an attack outright
Recommend security awareness training to highlight the danger of visiting unknown websites
Minutes Matter
Reach out to learn how Â鶹¹û¶³¡¯s industry-leading security operations workflow can detect, investigate, and escalate incidents like ransomware attacks before they impact your business operations.
