Incident
incident:unnamed_it_company_network_attack
Later intrusion into Adam’s current or former employer’s systems in which administrative access was used to uninstall software and change privileged users’ passwords.
Later intrusion into Adam’s current or former employer’s systems in which administrative access was used to uninstall software and change privileged users’ passwords.
“he starts uninstalling software on various computers”
“he changed their passwords so they couldn’t log in anymore”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Office 365 | Explicit | 113 |
| outgoing | INVOLVES | privilege escalation | Explicit | 113 |
| outgoing | INVOLVES | credentialed remote access | Explicit | 113 |
| outgoing | INVOLVES | log and evidence evasion | Explicit | 113 |
Unnamed IT company network attack INVOLVES Office 365
The later attack against Adam’s employer involved logging into the company’s Office 365 portal and reaching its global administrator account.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He uses the domain admin credentials that he still had written down somewhere to log into this company’s Office 365 portal.”
Unnamed IT company network attack INVOLVES privilege escalation
The later attack involved moving from the Office 365 portal to the global administrator account.
Explicit Confidence 98% · Jack Rhysider EP 113 Details
“From there, he gets access to the global administrator account”
Unnamed IT company network attack INVOLVES credentialed remote access
The later attack used retained domain administrator credentials to access the employer’s network services.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He uses the domain admin credentials that he still had written down”
Unnamed IT company network attack INVOLVES log and evidence evasion
The later attack included uninstalling software and changing administrator passwords, actions that disrupted systems and limited access.
Explicit Confidence 96% · Jack Rhysider EP 113 Details
“he changed their passwords so they couldn’t log in anymore”