How a breach unfolds, and how a SOC answers it

An unpatched public application, an exposed remote-access service, or a valid credential bought from a broker accounts for the overwhelming majority of first steps. Nothing about that first moment looks like an attack in the logs: a request is served, a session is created, an account signs in. What follows it is the tell.

Because entry is quiet, defenders almost never detect it live — they reconstruct it afterwards from the first noisy step. That is why the exploit and the payload are filed as two separate findings: one answers how they got in, the other answers what they did once inside.

The practical consequence is patch and exposure hygiene carries detection weight. Every internet-facing service you cannot name is a step of the chain you will only ever see in hindsight.

A beacon calls out on a regular interval to an address the estate has never spoken to before. The regularity is the detection: human traffic is bursty and irregular, automation is not. Jitter widens the window but rarely erases the pattern.

Persistence follows immediately — a scheduled task, a service, a run key, a cron entry. It is cheap to plant and it is the single thing that makes eviction hard later: containment that removes the session but leaves the persistence returns the attacker to you within the hour.

Dwell time is decided here. Industry measurements put median dwell in the days-to-weeks range, and nearly all of that time is spent in this phase, waiting.

Discovery comes first: the directory is read for accounts, groups and service names. It is usually permitted, which is exactly why it is missed — the finding is the breadth and the timing, not the permission.

Then credentials. Kerberoasting asks for service tickets and cracks them offline; AS-REP roasting needs no credential at all when pre-authentication is disabled; credential dumping lifts material straight from memory. All three end at the same place: a valid account the estate trusts.

From there movement is legitimate authentication. No exploit, no malware — an account that is allowed to sign in, signing in somewhere it never has before. Your baseline of who normally touches what is the detection.

Collection is a share or a database read end to end. Staging packs it into one archive, usually in a temporary directory, usually out of hours. Both are loud if anyone is counting reads and watching file writes by volume.

The archive is also the cleanest evidence you will ever get of what was taken, which is why preserving it before removing it matters more than speed. Delete it and you spend the rest of the investigation estimating loss from access logs.

Attempts against backups are the pre-ransom signal. A refused deletion of recovery points is still a finding: it says encryption is next, and the window to act is minutes, not days.

A playbook splits an incident into six phases — triage, investigate, contain, eradicate, recover, review — and each phase into tasks that are either automated, analyst-led, a decision or an approval. Enrichment, scoping and evidence collection automate well. Containment and eradication carry an approval gate because they cause impact.

Coverage is the honest measure: how many steps of a known chain raise an alert at all. A playbook cannot respond to a step nothing detects, so the coverage line is published beside the playbook rather than hidden in a report.

Response is then measured on time, not effort: time to detect, time to acknowledge, time to contain, time to recover. Those four numbers, per step, are what the referee grades on the walk.