Large-Scale Compromise Detection Playbook
Introduction: The Need for Effective Large-Scale Compromise Detection Capabilities
In today’s interconnected digital landscape, organisations face an increasing risk of large-scale cyber compromises, ranging from nation-state attacks and ransomware campaigns to supply chain breaches and widespread credential theft. Threat actors employ advanced techniques such as coordinated lateral movement, fileless malware, and privilege escalation to infiltrate and persist within enterprise environments undetected. Given the complexity and scale of modern IT ecosystems—including cloud, hybrid, and on-premises infrastructures—detecting such compromises requires a proactive and multilayered approach.
Effective detection capabilities and processes for large-scale compromises are essential to identifying, analysing, and mitigating security threats before they result in catastrophic data breaches or operational disruptions. A comprehensive detection strategy must incorporate real-time network monitoring, behavioural analytics, anomaly detection, threat intelligence integration, and automation-driven response mechanisms. Security Information and Event Management (SIEM), Extended Detection and Response (XDR), and threat-hunting frameworks play a crucial role in correlating signals across endpoints, networks, and identities to uncover signs of compromise at scale.
To minimise dwell time and reduce the impact of widespread attacks, organisations must implement continuous monitoring, forensic analysis, and adaptive detection methodologies. By leveraging machine learning, automation, and human-driven threat-hunting, security teams can enhance their ability to detect and respond to large-scale compromises effectively, strengthening their overall cyber resilience in an evolving threat landscape.
Table of Contents
Initial Detection and Scoping
Identify Compromised Hosts
Detect Unusual Authentication Activity
Advanced Network Traffic Analysis
Threat Persistence Mechanisms
Registry Key Persistence
Scheduled Task Creation
Startup Folder Monitoring
Privilege Escalation Indicators
Detect Abnormal Process Behavior
Credential Dumping Activities
Privilege Escalation via Exploits
Lateral Movement
Remote Desktop Protocol (RDP) Activity
Lateral Movement via SMB Shares
SSH Lateral Movement
Data Exfiltration Detection
Monitor Large Data Transfers
Anomalous Cloud Storage Access
DNS Tunneling Detection
Incident Response and Containment
Isolate Compromised Systems
Identify Indicators of Compromise (IoCs)
Timeline Reconstruction
Conclusion
This playbook provides KQL queries and techniques to detect and analyse large-scale compromises across uan organisation. Each section includes multiple query options with detailed descriptions and expected outcomes.
1. Initial Detection and Scoping
Query Option 1: Identify Compromised Hosts
Description: Detects hosts with repeated failed login attempts, indicative of brute force attacks. Results include device names, accounts, and source IPs.
Query Option 2: Detect Unusual Authentication Activity
Description: Flags accounts with high numbers of successful logons from external IPs, which may indicate credential compromise. Results display accounts and associated IPs.
Query Option 3: Advanced Network Traffic Analysis
Description: Identifies devices sending large amounts of data to public IPs, potentially indicative of exfiltration. Results show devices, IPs, and data volumes.
2. Threat Persistence Mechanisms
Query Option 1: Registry Key Persistence
Description: Detects modifications to registry keys often used for persistence. Results include key paths and modified values.
Query Option 2: Scheduled Task Creation
Description: Identifies commands used to create scheduled tasks. Results include devices and associated accounts.
Query Option 3: Startup Folder Monitoring
Description: Flags executables added to startup folders. Results include file paths and timestamps.
3. Privilege Escalation Indicators
Query Option 1: Detect Abnormal Process Behavior
Description: Searches for commands used to enumerate accounts and privileges. Results include command lines and initiating accounts.
Query Option 2: Credential Dumping Activities
Description: Detects attempts to dump credentials from LSASS. Results show processes and associated devices.
Query Option 3: Privilege Escalation via Exploits
Description: Flags potential exploitation activities. Results display timestamps, commands, and associated accounts.
4. Lateral Movement
Query Option 1: Remote Desktop Protocol (RDP) Activity
Description: Tracks RDP connections within the environment. Results include devices and remote IPs.
Query Option 2: Lateral Movement via SMB Shares
Description: Identifies executable files accessed on SMB shares. Results display file paths and timestamps.
Query Option 3: SSH Lateral Movement
Description: Flags SSH-based lateral movement. Results include accounts and associated devices.
5. Data Exfiltration Detection
Query Option 1: Monitor Large Data Transfers
Description: Detects significant data transfers. Results include source devices and data volumes.
Query Option 2: Anomalous Cloud Storage Access
Description: Tracks large data uploads to cloud storage services. Results display domain names and data volumes.
Query Option 3: DNS Tunneling Detection
Description: Detects DNS tunneling based on query patterns. Results include domain names and query counts.
6. Incident Response and Containment
Query Option 1: Isolate Compromised Systems
Description: Identifies devices communicating with known malicious IPs. Results assist in system isolation efforts.
Query Option 2: Identify Indicators of Compromise (IoCs)
Description: Correlates IoCs (hashes) with process and file events. Results display impacted devices and files.
Query Option 3: Timeline Reconstruction
Description: Creates a timeline of activities during the incident. Results provide a comprehensive incident overview.
7. Conclusion
The playbook offers a good approach to detecting and analysing compromises in an environment. However, its usefulness depends on the environment and tools at your disposal. For an environment where KQL is an option, the queries may require some adaptation to specific data sources and infrastructure setup.
Last updated