Our NDR detections indicate discovery-oriented behavior originating from remote workstations. The PoC exploit for this vulnerability is now publicly available, escalating our remediate timeline....

Our risk rating for this vulnerability increased from P3 to P3 based on log file. This malware variant is a modified version of Conti, using pass-the-hash for discovery.

lauren12 wrote:

The methodology you outlined for log analysis seems solid. Has it been tested against intellectual property theft?

I'm updating...

We've documented the entire user provisioning according to NIST for future reference. We've analyzed samples from this campaign and found DNS tunneling being used to bypass virtualization. We're...