One alert can hide a second run.
The first alert covered only the first attempt. The second run got further, so we hunted across the whole device, not just the alert.
01 / Defend
Threat Detection & Response
Around-the-clock monitoring, investigation, and response to help stop threats from becoming incidents.
Defense in motion
From signal to
decisive action.
A real incident at Acme County. Follow Karhu Cyber’s managed detection and response from the email lure to the laptop’s return to service.
Real incidentAcme County
Step 1 of 7
- County government department
- Protected by Karhu Cyber managed detection and response.
Step 1 of 7 · Day before, early morning
The lure
A payment-themed email with a zipped attachment reaches a shared department mailbox. An existing forwarding rule sends it to four staff members.
Incident timeline
Select a step
Incident outcome
True positive. Contained in seconds.No data stolen. No attacker connection made. No other systems affected.
7 of 7 blocked
12 secondsFrom click to first blocked connection
7 of 7Attacker connection attempts blocked
0Credentials stolen
1 / 0Laptop affected / other systems affected
0Rebuilds needed
What this incident taught us
Partial cleanup is a lead, not an all-clear.
Automated remediation had 28 of 30 actions done at first. We checked the last two before trusting the device.
Email filtering is the first layer.
This lure got through because the email security layer had a gap. Layered defense stopped it at the endpoint.
Attack techniques (MITRE ATT&CK)
- Phishing attachment
T1566.001 - User execution
T1204.002 - Double file extension
T1036.007 - Obfuscated files
T1027 - JavaScript
T1059.007 - Scheduled task
T1053.005 - WMI
T1047 - PowerShell
T1059.001 - Compile after delivery
T1027.004 - Process hollowing
T1055.012 - Non-standard port
T1571
Real incident. Real response. Details changed to protect our client.
A watchful team. A coordinated response.
Bring your endpoint and security telemetry into an ongoing defense program. We help investigate suspicious activity, prioritize the alerts that matter, and coordinate response across your environment.
- 24/7 security monitoring and investigation
- Endpoint protection and response
- Security log visibility and detection tuning
- Escalation and response coordination