The Challenge
A Global Administrator Account, Compromised
The organization experienced a breach of its Microsoft 365 Global Administrator account. The attacker gained access to the account and used it as part of a multi-stage attack aimed at reaching the company's entire network.
The Approach
Contain First, Then Investigate
ECS responded quickly—containing the breach and ejecting the attacker before major damage was done. From there, ECS's Incident Response Team worked to understand exactly how the attacker had gotten in and what they had touched.
The Solution
Closing Every Door the Attacker Left Open
The Incident Response Team worked tirelessly to discover half a dozen methods the attacker had planted to retain persistence in the environment, then removed all of them to prevent a relapse.
The Outcome
Damage Avoided, Insurance Claim Supported
The team's attention to detail and ability to respond quickly saved the organization hundreds of thousands of dollars in potential damages, and ensured their insurance carrier had all the detail needed to cover the incident.