Detecting Post-Exploitation Activity: Response Playbook
You've just patched two critical CVEs before attackers weaponized them. The fix landed at 03:00 UTC. By 04:15 your SIEM lights up red. Your team knows the exploit chain already executed on three production servers. Now what? This isn't about whether you'll be breached—it's about how fast you detect and contain when prevention fails. This playbook gives you concrete commands, hashes, IoCs, and Microsoft Defender Endpoint hunting queries to hunt post-exploitation activity across hybrid environments.
Phase 1: Triage & Containment (First 60 Minutes)
Stop the bleeding before you investigate. Exploitation means someone has code execution rights right now or had them moments ago. Your first priority is preventing data exfiltration and stopping lateral movement through Active Directory.
- Immediate isolation protocol: Disconnect compromised hosts from domain controllers using
Disable-ADComputerAccount -Identity "CN=HOSTNAME,OU=Servers,DC=company,DC=local"in PowerShell. RunSet-NetFirewallProfile -Profile Domain,Public,Private -Enabled Falseon every infected machine. This blocks outbound connections within seconds without rebooting. - Credential rotation sequence: Rotate domain admin tokens via
Set-ADServiceAccount -Identity "KerberosTicketHandlingUnit$domain" -PasswordResetOnNextLogon $true. Then runGet-MpThreatIntel | Set-MpThreatIntel -UpdateAutoDownload $falseto refresh antivirus definitions after password changes. Do not skip this step—compromised credentials let attackers bypass MFA during recovery attempts. - Memory acquisition baseline: Create memory dumps before running any investigative tools that might trigger fileless malware. Use
MiniDumpWriteMemory -FileName C:\Temp\memdump.mdmp ProcessId ALLvia Sysinternals PsExec. Save these to air-gapped storage immediately. You'll need raw memory if process injection occurred.
Phase 2: Forensic Evidence Collection
Every action leaves traces. Your goal is collecting enough evidence to answer three questions later: What happened? How did they get in? Can we prove who did it legally? Start with Windows Event Logs because attackers rarely wipe everything.
Critical Event IDs to Query Immediately
| Event ID | Category | Why It Matters |
|---|---|---|
| 4688 | ProcessCreation | Shows executable paths launched with command line arguments. Look for suspicious binaries like powershell.exe, mshta.exe, or wscript.exe being spawned by user processes. |
| 4720 | CreateProcess | Captures image file path, command line, and parent process ID. Cross-reference parent PID against known malicious patterns like c:\windows\temp\*.exe. |
| 4732 | Registry | Attackers create scheduled tasks under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run or add services to startup folders. Search registry hives for recent modifications near current time. |
| 4729 | Logon | Track failed logins followed by successful logons. Brute force attacks show as multiple consecutive failures then single success. Check IP geolocation against expected locations. |
| 4663 | ObjectAccess | Documents sensitive file access. If administrator account accessed finance.xlsx at 02:17 AM, that's unusual unless payroll processing runs overnight. |
Phase 3: Lateral Movement Hunting Queries
Attacker toolkit includes privilege escalation methods beyond simple password guessing. They use pass-the-hash techniques, Kerberos preauth attacks, and undocumented API calls. Standard AD audit policies often miss these vectors until damage occurs.
PowerShell Hunting Script (Adapt for Your Environment)
# Hunt for suspicious service installations
Get-Service | Where-Object {
$_.StartType -eq 'Manual' -and
($_.DisplayName -match 'update|sync|backup') -and
$_.Status -ne 'Running'
} | Select-Object Name, DisplayName, Status | Format-Table -AutoSize
# Find accounts with RID above 500 (potential admin creation)
Get-ADUser -Filter * | Where-Object {
$_.SID -match '\(RID\)(5[0-9]{2})\('
} | Select-Object SamAccountName, ObjectClass | Out-String
# Detect potential DCSync abuse
Get-ADGroupMember -Recursive -Identity "Domain Admins" | Get-ADObject | Select-Object Name, DistinguishedName | Format-Table -AutoSize
# Check for duplicate SIDs indicating impersonation
$users = Get-ADUser -Properties ObjectClass
foreach ($user in $users) {
if ($user.ObjectClass -eq 'User' -and $user.SamAccountName -notlike '*$') {
$memberships = Get-ADPrincipalGroupMembership $user.DistinguishedName
foreach ($membership in $memberships) {
$group = Get-ADGroup $membership.Sid -ErrorAction SilentlyContinue
if ($group.GroupScope -eq 'Global') {
"ALERT: User $($user.SamAccountName) added to global group $($group.Name)"
}
}
}
}Network Telemetry Analysis
Lateral movement requires communication channels. Even if firewalls block standard ports, attackers use legitimate protocols like SMB over 445, HTTP/HTTPS for command and control, or DNS tunneling through TXT records. Capture NetFlow data from firewalls and routers for the last 72 hours. Build correlation rules matching source IP ranges to target subnets during business hours.
Phase 4: Advanced Threat Indicator Extraction
Standard signature-based detection won't catch novel exploits. You need behavioral analytics and static analysis of binary artifacts found on disk. Malware samples collected from memory dumps yield MD5/SHA hashes useful for threat intelligence feeds.
Malware Analysis Workflow
- Extract files from memory dump: Use Volatility framework
volatility -f memdump.mdmp --profile=WinXPSP3x64 strings | findstr /i "http:// https://"to extract URLs used for C&C communications. - Hash collection: Generate cryptographic fingerprints for all suspicious executables found on disk. Store alongside system state snapshots. Example:
certutil -hashfile C:\Windows\System32\cmd.exe SHA256 - YARA rule development: Write custom YARA rules based on PE header characteristics unique to known malware families. Share these rules with other SOC teams via public repositories like GitHub.
Phase 5: Mitigation Strategies Before Patching Completes
Microsoft releases security updates weekly. Full deployment takes days depending on enterprise scale. During this gap, implement compensating controls that don't require waiting for update propagation.
Defensive Control Stack
- Application Whitelisting: Deploy AppLocker policies blocking unknown executables from running outside designated directories. Enforce via Group Policy
gpedit.msc → Computer Configuration → Windows Settings → Security Settings → Application Control Policies → AppLocker. Add exceptions only for verified business applications. - Device Guard enforcement: Turn on UEFI Secure Boot mode and enforce Code Integrity Rules requiring signed drivers. Prevents bootkit installation even if physical access occurs. Configure via
bcdedit /set testsigning ontemporarily during investigation phase. - Network segmentation hardening: Isolate database servers behind dedicated VLANs with strict egress filtering rules. Block outbound traffic from application tiers except toward approved endpoints like backup storage buckets or monitoring services.
- Privilege reduction: Audit user account types monthly. Remove unnecessary local admin rights. Promote least-privilege principle throughout infrastructure hierarchy. Use
whoami /privto verify current permission level before granting elevated access.
Post-Incident Review & Continuous Improvement
Every incident teaches something valuable. Conduct structured debriefings focusing on detection lag times, containment delays, and root cause analysis. Update playbooks based on lessons learned rather than theoretical best practices alone. Share findings internally across teams responsible for different technology domains—security operations collaborates closely with network engineering during recovery efforts.
The difference between surviving an outbreak versus containing it silently comes down to preparation quality. Teams practicing tabletop exercises regularly outperform those reacting blindly when crisis hits. Invest time now building muscle memory through realistic simulation scenarios involving multiple coordinated threats targeting different layers simultaneously.
FAQ
What if I cannot isolate systems immediately due to production impact?
In high availability environments, implement temporary network filtering rules at the switch level to block suspicious traffic while maintaining uptime. Use port security features on enterprise switches to shut down specific switch ports connected to infected endpoints without powering down servers completely. Document all changes for audit trails.
How can I verify if memory dump collection worked correctly?
Check file size—memory dumps should approximately match total RAM installed on the system. For example, a 16GB machine should yield roughly 16GB dump file. Verify integrity by comparing hash values before and after transfer to storage. Use checksum tools like FCIV to generate SHA256 hashes for validation.
Which Microsoft Defender ATP queries should I prioritize for zero-day hunting?
Focus on process tree anomalies, unusual parent-child relationships, and credential access attempts. Start with queries filtering for process injection techniques, lateral movement via WMI or SMB, and registry persistence mechanisms. Adjust time windows based on estimated breach timeline from initial alert.
Should I pay ransom if data gets encrypted during incident response?
Law enforcement and cybersecurity experts universally advise against paying ransom. Payment encourages criminal activity and does not guarantee data recovery. Focus instead on restoring from clean backups and improving detection capabilities to prevent future incidents. Many organizations successfully recover without payment through proper incident response procedures.
How long should I retain forensic evidence for legal proceedings?
Retain raw evidence including memory dumps, disk images, and network captures for minimum 90 days or according to your organization's legal hold policy. Some regulated industries require longer retention periods. Consult legal counsel for jurisdiction-specific requirements regarding electronic evidence preservation.
