Incidents

Affected assets

sso-portal

Accounts affected

1

Stated confidence

94% stated

A confidence the scenario's author stated when writing it — not a measured rate. Nothing here has yet been scored against a human's later verdict; calibration arrives when outcomes exist (R96), and until then no figure is invented for it.

1. 1
   203[.]0[.]113[.]22->sso-portal:443

   412 sign-in failures from one new ASN in 6 minutes

   evidence: SEC-0001-a

   technique: T1110.004 Credential Stuffing · Credential Access

2. 2
   j.rivera

   failures → one success on the same account

   evidence: SEC-0001-b, SEC-0001-c

   technique: T1078.004 Cloud Accounts · Defense Evasion

3. 3
   sso-portal

   session issued to an unrecognised device

   evidence: SEC-0001-d

   technique: T1078 Valid Accounts · Persistence

Credential stuffing against the SSO portal succeeded on one account: 412 failures from a single new ASN, then one success.

evidence: SEC-0001-a, SEC-0001-b, SEC-0001-c

1. 01revoke_session●risk 25expects session invalidrollback: reissue_session
2. 02require_mfa_reauth●risk 10expects session re-verifiedrollback: clear_mfa_requirement

Risk shown is the action’s base score. Effective risk rises with blast radius, production environment, and low confidence — it never falls, and the dashboard never computes it here.

1. 11d agoagent:sentinelcorrelated412 failures and one success on one account within 11 minutes
2. 11d agoagent:analystdiagnosedimpossible travel rules out the travelling-user reading
3. 11d agodharmaawaiting approvalrevoke_session scores 25 → approval tier

Affected assets

fin-034, fs-04, dc-01

Accounts affected

0

Stated confidence

94% stated

A confidence the scenario's author stated when writing it — not a measured rate. Nothing here has yet been scored against a human's later verdict; calibration arrives when outcomes exist (R96), and until then no figure is invented for it.

Written as a simulation of the June 2017 NotPetya outbreak, from the published record. None of the telemetry below was observed — not on this estate and not on anyone else’s; it is what that shape of attack would look like in these records. The sources are named so the shape can be checked against them.

• NotPetya (S0368) · MITRE ATT&CK

  the technique mapping this chain follows

• Petya Ransomware (TA17-181A) · CISA

  the contemporaneous advisory: update channel, SMB spread, no recoverable key

1. 1
   fin-034

   a binary outside the vendor manifest, through the signed update channel

   evidence: SEC-0005-a, SEC-0005-b

   technique: T1195.002 Compromise Software Supply Chain · Initial Access

2. 2
   svc-deploy

   deployment credentials read out of process memory

   evidence: SEC-0005-c

   technique: T1003 OS Credential Dumping · Credential Access

3. 3
   fs-04

   written to over ADMIN$ with the stolen credentials

   evidence: SEC-0005-d

   technique: T1021.002 SMB/Windows Admin Shares · Lateral Movement

4. 4
   fs-04

   malformed SMBv1 transaction against the unpatched service

   evidence: SEC-0005-e

   technique: T1210 Exploitation of Remote Services · Lateral Movement

5. 5
   fs-04

   boot record overwritten with no copy kept, and a reboot scheduled

   evidence: SEC-0005-f, SEC-0005-g

   technique: T1561.002 Disk Structure Wipe · Impact

A destructive wiper arrived inside a trojanised vendor update, took svc-deploy's credentials out of memory, spread to fs-04 and dc-01 both with those credentials and by exploiting an unpatched SMB service, and overwrote boot records behind a ransom note that cannot be paid.

evidence: SEC-0005-a, SEC-0005-b, SEC-0005-c, SEC-0005-d, SEC-0005-e, SEC-0005-g, SEC-0005-i

1. 01isolate_host◆risk 55expects network isolated, edr reachablerollback: rejoin_network
2. 02revoke_session●risk 25expects session invalidrollback: reissue_session
3. 03block_ip◆risk 35expects traffic_from_ip deniedrollback: unblock_ip
4. 04notify_analyst●risk 0expects no state changerollback: none

Risk shown is the action’s base score. Effective risk rises with blast radius, production environment, and low confidence — it never falls, and the dashboard never computes it here.

1. 11d agoagent:sentinelcorrelatedupdate fetch, unlisted binary, credential read and admin-share writes to two hosts inside eleven minutes
2. 11d agoagent:analystdiagnosedthe ransom note is contradicted by the installation ID and by the overwritten boot record — this destroys rather than encrypts
3. 11d agodharmaescalatedisolate_host scores 67 → senior tier, and the plan touches a domain controller

Affected assets

file-share, app-07

Accounts affected

0

Stated confidence

86% stated

A confidence the scenario's author stated when writing it — not a measured rate. Nothing here has yet been scored against a human's later verdict; calibration arrives when outcomes exist (R96), and until then no figure is invented for it.

1. 1
   ws-0148->198[.]51[.]100[.]74:8443

   outbound every 60s ± 2s to a destination never seen before

   evidence: SEC-0003-a, SEC-0003-b

   technique: T1071.001 Web Protocols · Command and Control

2. 2
   ws-0148

   SMB opened to two hosts never previously contacted

   evidence: SEC-0003-c

   technique: T1021.002 SMB/Windows Admin Shares · Lateral Movement

3. 3
   app-07/schtasks

   scheduled task created on app-07 from a remote session

   evidence: SEC-0003-d

   technique: T1053.005 Scheduled Task · Persistence

ws-0148 is beaconing to a command-and-control host and has begun moving laterally: new SMB peers, then a scheduled task.

evidence: SEC-0003-a, SEC-0003-b, SEC-0003-c, SEC-0003-d

1. 01isolate_host◆risk 55expects network isolated, edr reachablerollback: rejoin_network
2. 02block_ip◆risk 35expects traffic_from_ip deniedrollback: unblock_ip

Risk shown is the action’s base score. Effective risk rises with blast radius, production environment, and low confidence — it never falls, and the dashboard never computes it here.

1. 11d agoagent:sentinelcorrelatedbeacon, new SMB peers and remote task creation on one host within 90 minutes
2. 11d agoagent:analystdiagnoseddestination absent from backup inventory — the backup reading does not hold
3. 11d agodharmaescalatedisolate_host scores 55 → senior approval