Incident Response: Investigate a Simulated APT Attack

// LIST MITRE ATT&CK TECHNIQUES across all alerts (last 7 days)
// Purpose: Identify which adversary techniques are most active in your environment
//   and validate that alerts map to specific ATT&CK techniques.
//
// How it works:
//   1. Filters AlertInfo to only alerts that have ATT&CK technique tags
//   2. Parses the AttackTechniques JSON array into individual rows (mv-expand)
//   3. Counts alerts per technique and shows associated alert titles
//
// Output columns:
//   Technique  – ATT&CK technique ID (e.g., T1566.001, T1059.001)
//   AlertCount – how many alerts mapped to this technique
//   Titles     – list of alert names for context
// A multi-technique incident spanning Initial Access through Exfiltration
// signals a coordinated APT attack rather than commodity malware.
AlertInfo
| where Timestamp > ago(7d)
| where AttackTechniques != ""
| extend Techniques = parse_json(AttackTechniques)
| mv-expand Technique = Techniques
| summarize AlertCount = count(), Titles = make_set(Title) by tostring(Technique)
| sort by AlertCount desc

// CONSOLIDATED ALERT VIEW for the target incident
// Purpose: Get all alerts correlated to an incident in one table,
//   including the evidence entities attached to each alert.
//
// How it works:
//   Inner join of AlertInfo + AlertEvidence on AlertId links each alert
//   to its evidence (devices, users, files, IPs, URLs involved).
//   Title filter narrows to alerts related to the attack phases.
//
// Output columns:
//   Title             – alert name describing the detection
//   Category          – MITRE tactic (InitialAccess, Execution, LateralMovement, etc.)
//   EntityType        – type of evidence (Device, User, File, IP, URL)
//   RemediationStatus – whether automated remediation has addressed this alert
//   DetectionSource   – which Defender product generated the alert
// Sort by Timestamp ascending to see the attack progression chronologically.
AlertInfo
| where Timestamp > ago(7d)
| join kind=inner (
    AlertEvidence
    | where Timestamp > ago(7d)
  ) on AlertId
| where Title has_any ("phishing", "credential", "lateral", "exfiltration", "suspicious")
| project Timestamp, AlertId, Title, Severity, Category,
          EntityType, RemediationStatus, DetectionSource
| sort by Timestamp asc

// ============================================================
// CROSS-WORKLOAD INVESTIGATION TIMELINE
// Purpose: Build a unified chronological view of ALL activity for the
//   compromised user across Email, Endpoint, Identity, and Cloud Apps.
//   This is the most important query during incident investigation.
//
// How it works:
//   - union combines 4 sub-queries (one per Defender product)
//   - Each sub-query targets the same user and 48h investigation window
//   - Workload column identifies the source product
//   - Action column provides a human-readable event summary
//   - Results sorted chronologically to reveal the attack narrative
//
// Reading the output:
//   MDO row first → phishing email was the entry point
//   MDE rows after → process execution on the endpoint (payload)
//   MDI rows → credential usage on other devices (lateral movement)
//   MDA rows → cloud app access (data exfiltration)
// ============================================================
let targetUser = "j.smith@globex.com";
let investigationWindow = ago(48h);
// Email events: phishing delivery and any other mail to/from target
EmailEvents
| where Timestamp > investigationWindow
| where RecipientEmailAddress =~ targetUser
| project Timestamp, Workload = "MDO", Action = strcat("Email: ", Subject),
          Detail = SenderFromAddress, Entity = RecipientEmailAddress
| union (
  // Endpoint process events: commands executed on devices by target user
  DeviceProcessEvents
  | where Timestamp > investigationWindow
  | where AccountUpn =~ targetUser
  | project Timestamp, Workload = "MDE", Action = strcat("Process: ", FileName),
            Detail = ProcessCommandLine, Entity = DeviceName
)
| union (
  // Identity logon events: authentication attempts by target user
  // DeviceName = source device, DestinationDeviceName = target device
  IdentityLogonEvents
  | where Timestamp > investigationWindow
  | where AccountUpn =~ targetUser
  | project Timestamp, Workload = "MDI", Action = strcat("Logon: ", LogonType),
            Detail = strcat(DeviceName, " → ", DestinationDeviceName), Entity = AccountUpn
)
| union (
  // Cloud app activity: SaaS application usage (file access, uploads, sharing)
  CloudAppEvents
  | where Timestamp > investigationWindow
  | where AccountId =~ targetUser
  | project Timestamp, Workload = "MDA", Action = strcat("CloudApp: ", ActionType),
            Detail = Application, Entity = AccountId
)
| sort by Timestamp asc

// HUNT FOR ADDITIONAL PHISHING TARGETS from the same sender domain
// Purpose: Determine if the phishing campaign targeted other users beyond
//   the known victim. Other recipients may have also opened the email.
// Replace "vendor-invoices.cc" with the actual malicious sender domain.
// Output: Each row = an email from the phishing domain
//   DeliveryAction = "Delivered" means the email reached the inbox
//   DeliveryAction = "Blocked" means filtering caught it
// If additional users received delivered emails, check their identity
// and endpoint telemetry for post-compromise activity.
EmailEvents
| where Timestamp > ago(7d)
| where SenderFromDomain =~ "vendor-invoices.cc"
    or SenderMailFromDomain =~ "vendor-invoices.cc"
| project Timestamp, SenderFromAddress, RecipientEmailAddress,
          Subject, DeliveryAction, DeliveryLocation,
          ThreatTypes, DetectionMethods
| sort by Timestamp asc

// CORRELATE EMAIL ATTACHMENTS with endpoint file creation
// Purpose: Determine if the malicious attachment was saved/opened on any endpoint.
// How it works:
//   1. Gets all attachments from the phishing sender domain
//   2. Left outer joins with DeviceFileEvents on SHA256 hash
//   3. If a match exists, the file was written to disk on that device
//
// Output columns:
//   SHA256        – file hash (search in VirusTotal for malware classification)
//   DeviceName    – if populated, the file was opened/saved on this endpoint
//   FolderPath    – where the file was saved (Downloads, Temp = user opened it)
// A NULL DeviceName means the attachment was in the email but not opened.
EmailAttachmentInfo
| where Timestamp > ago(7d)
| where SenderFromDomain =~ "vendor-invoices.cc"
| project Timestamp, SenderFromAddress, RecipientEmailAddress,
          FileName, FileType, SHA256,
          ThreatTypes, DetectionMethods
| join kind=leftouter (
    DeviceFileEvents
    | where Timestamp > ago(7d)
    | where ActionType == "FileCreated"
    | project SHA256, DeviceName, FolderPath, FileName
  ) on SHA256

// TRACE THE MACRO ATTACK CHAIN: Word → cmd → PowerShell → payload
// MITRE ATT&CK: T1204.002 (User Execution: Malicious File)
//               T1059.001 (PowerShell) + T1059.003 (Windows Command Shell)
// Purpose: Reconstruct the exact process execution chain on the compromised
//   endpoint after the user opened the malicious Word document.
//
// Detection logic:
//   1. WINWORD.EXE as InitiatingProcessFileName = macro launched a process
//   2. cmd.exe as InitiatingProcessFileName = command shell launched by macro
//   3. FileName matches interpreters or LOLBins = payload execution
//
// The process chain reveals the attack vector:
//   WINWORD.EXE → cmd.exe → powershell.exe -enc [base64] = classic macro attack
//   WINWORD.EXE → mshta.exe = HTML Application payload
//   WINWORD.EXE → certutil.exe -urlcache = file download via LOLBin
DeviceProcessEvents
| where Timestamp > ago(48h)
| where DeviceName =~ "WS-FINANCE-01"
| where InitiatingProcessFileName =~ "WINWORD.EXE"
    or InitiatingProcessFileName =~ "cmd.exe"
    or FileName in~ ("powershell.exe", "pwsh.exe", "certutil.exe", "schtasks.exe", "mshta.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          AccountName, SHA256
| sort by Timestamp asc

// DETECT MALICIOUS SCHEDULED TASK PERSISTENCE
// MITRE ATT&CK: T1053.005 (Scheduled Task/Job: Scheduled Task)
// Purpose: Attackers create scheduled tasks to survive reboots and maintain
//   persistent access. Common disguise names mimic Windows Update or browser updates.
//
// How it works:
//   Filters DeviceEvents for ScheduledTaskCreated action type on the target device.
//   Parses AdditionalFields JSON to extract TaskName and TaskContent (the command).
//   Filters for suspicious task names that impersonate legitimate Windows services.
//
// Suspicious task names to look for:
//   "WindowsUpdateCheck" / "SystemHealthMonitor" / "ChromeUpdate" = common attacker names
//   Real Windows tasks have specific naming patterns (e.g., "\Microsoft\Windows\...")
// Check TaskContent for the actual command – PowerShell or executable paths confirm malice.
DeviceEvents
| where Timestamp > ago(48h)
| where DeviceName =~ "WS-FINANCE-01"
| where ActionType == "ScheduledTaskCreated"
| project Timestamp, DeviceName, ActionType,
          AdditionalFields = parse_json(AdditionalFields)
| extend TaskName = tostring(AdditionalFields.TaskName),
         TaskContent = tostring(AdditionalFields.TaskContent)
| where TaskName has_any ("WindowsUpdateCheck", "SystemHealthMonitor", "ChromeUpdate")

// DETECT MALWARE FILE DROPS from the attack process chain
// MITRE ATT&CK: T1105 (Ingress Tool Transfer)
// Purpose: Find files written to disk by the malicious processes
//   (PowerShell, cmd, certutil) that form the attack chain.
//
// Detection logic:
//   ActionType in (FileCreated, FileModified) – new or changed files
//   InitiatingProcessFileName – only files created by suspicious processes
//
// Key output columns:
//   SHA256     – file hash for VirusTotal/TI lookup and IoC blocking
//   FileSize   – very small files may be scripts; large files may be tools
//   FolderPath – files in Temp, ProgramData, or AppData\Local are suspicious;
//               files in System32 or Program Files indicate deeper compromise
// Use the SHA256 values to create block indicators in Settings → Indicators.
DeviceFileEvents
| where Timestamp > ago(48h)
| where DeviceName =~ "WS-FINANCE-01"
| where ActionType in ("FileCreated", "FileModified")
| where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "certutil.exe")
| project Timestamp, DeviceName, ActionType, FileName, FolderPath,
          SHA256, FileSize, InitiatingProcessFileName,
          InitiatingProcessCommandLine
| sort by Timestamp asc

// DETECT LSASS MEMORY ACCESS – Credential Dumping Indicator
// MITRE ATT&CK: T1003.001 (OS Credential Dumping: LSASS Memory)
// Why: LSASS (Local Security Authority Subsystem Service) stores hashed
//   credentials in memory. Tools like Mimikatz, procdump, or direct API
//   calls access LSASS to extract NTLM hashes and Kerberos tickets.
//
// Detection logic:
//   Finds processes that access or reference lsass.exe.
//   Excludes legitimate system processes that normally interact with LSASS:
//     svchost.exe, csrss.exe, wininit.exe = Windows core processes
//     MsMpEng.exe = Defender Antivirus engine
//
// Key output:
//   InitiatingProcessFileName – WHAT accessed LSASS (if not in exclusion list,
//     it’s suspicious). Common malicious: rundll32.exe, unknown.exe, procdump.exe
//   InitiatingProcessParentFileName – what launched the accessing process
// CRITICAL: If LSASS access is confirmed, ALL credentials on that device
//   are potentially compromised (all logged-in users, service accounts, etc.)
DeviceProcessEvents
| where Timestamp > ago(48h)
| where FileName =~ "lsass.exe" or ProcessCommandLine has "lsass"
| where InitiatingProcessFileName !in~ ("svchost.exe", "csrss.exe", "wininit.exe", "MsMpEng.exe")
| project Timestamp, DeviceName, AccountName,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessParentFileName
| sort by Timestamp asc

// DETECT PASS-THE-HASH / PASS-THE-TICKET via anomalous logons
// MITRE ATT&CK: T1550.002 (Pass the Hash) / T1550.003 (Pass the Ticket)
// Purpose: After credential theft, trace how stolen credentials were used.
//   Look for logons to devices the user doesn’t normally access, unusual
//   protocols, and logon types indicating remote access.
//
// Key columns to examine:
//   LogonType:
//     Interactive       = direct console logon (normal for user’s own device)
//     RemoteInteractive = RDP session (suspicious if to a server)
//     Network           = SMB/NTLM authentication (PtH lateral movement)
//   DestinationDeviceName – where the credentials were used
//   Protocol – "NTLM" with Network logon to multiple devices = PtH
//   FailureReason – empty for success; populated for failures (brute force)
IdentityLogonEvents
| where Timestamp > ago(48h)
| where AccountUpn =~ "j.smith@globex.com"
| where LogonType in ("Interactive", "RemoteInteractive", "Network")
| project Timestamp, AccountUpn, DeviceName,
          DestinationDeviceName, LogonType,
          Application, Protocol, FailureReason
| sort by Timestamp asc

// DETECT KERBEROS TICKET ANOMALIES – Overpass-the-Hash / Golden Ticket
// MITRE ATT&CK: T1558 (Steal or Forge Kerberos Tickets)
// Purpose: After stealing NTLM hashes, attackers may forge Kerberos tickets
//   to access any resource without knowing the password.
//
// IdentityQueryEvents captures AD queries including Kerberos ticket requests.
// Suspicious patterns:
//   - Kerberos TGT requests from unusual devices
//   - LDAP queries for sensitive groups (Domain Admins, Enterprise Admins)
//   - Abnormal QueryTarget values (targeting service accounts or DCs)
//
// Golden Ticket indicator: if QueryType shows Kerberos activity from a
//   device where the user never normally authenticates, this may indicate
//   a forged ticket being used.
IdentityQueryEvents
| where Timestamp > ago(48h)
| where ActionType has_any ("Kerberos", "LDAP")
| where AccountUpn =~ "j.smith@globex.com"
| project Timestamp, AccountUpn, ActionType,
          DeviceName, DestinationDeviceName,
          QueryType, QueryTarget
| sort by Timestamp asc

// DETECT LATERAL MOVEMENT via remote logons from compromised account
// MITRE ATT&CK: T1021.002 (Remote Services: SMB/Windows Admin Shares)
// Purpose: After credential theft, attackers use stolen credentials to
//   authenticate to other machines. This query finds logons from the
//   compromised user to devices OTHER than their primary workstation.
//
// Key filter: DestinationDeviceName !~ "WS-FINANCE-01" excludes the
//   user’s own device to focus on lateral movement to NEW devices.
// LogonType explanation:
//   RemoteInteractive = RDP session to the target (interactive control)
//   Network = SMB/NTLM authentication (file share access, PsExec, WMI)
// Each row = the compromised account accessed a different device.
// Multiple devices in a short time = active lateral movement campaign.
IdentityLogonEvents
| where Timestamp > ago(48h)
| where AccountUpn =~ "j.smith@globex.com"
| where LogonType in ("RemoteInteractive", "Network")
| where DestinationDeviceName !~ "WS-FINANCE-01" // Exclude the source device
| project Timestamp, AccountUpn, DeviceName,
          DestinationDeviceName, LogonType,
          Protocol, IPAddress
| sort by Timestamp asc

// DETECT REMOTE PROCESS EXECUTION on secondary target machines
// MITRE ATT&CK: T1047 (WMI) / T1569.002 (Service Execution) / T1021.006 (WinRM)
// Purpose: After lateral movement, attackers execute commands on target devices.
//   This query detects when remote execution frameworks spawn suspicious processes
//   on the domain controller (DC01) and file server (FS02).
//
// InitiatingProcessFileName values that indicate remote execution:
//   wmiprvse.exe    = WMI remote execution
//   wsmprovhost.exe = WinRM / PowerShell Remoting
//   PSEXESVC.exe    = PsExec service (created on target machine)
//   services.exe    = new service installation (SCM-based execution)
//
// Exclusion: svchost.exe and taskhostw.exe are normal child processes of
//   services.exe and shouldn’t trigger alerts.
// Output: FileName + ProcessCommandLine = what the attacker actually ran.
DeviceProcessEvents
| where Timestamp > ago(48h)
| where DeviceName in~ ("DC01", "FS02")
| where InitiatingProcessFileName in~ ("wmiprvse.exe", "wsmprovhost.exe", "PSEXESVC.exe", "services.exe")
| where FileName !in~ ("svchost.exe", "taskhostw.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, AccountName, AccountDomain
| sort by Timestamp asc

// DETECT DATA EXFILTRATION via Cloud App Abuse
// MITRE ATT&CK: T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage)
// Purpose: Detect when the compromised account performs bulk file operations
//   (mass downloads, external sharing, uploads to third-party storage).
//
// ActionTypes indicating exfiltration:
//   FileUploaded              – files uploaded to cloud storage (OneDrive, Box, etc.)
//   FileDownloaded            – mass downloads from SharePoint/OneDrive
//   FileSyncDownloadedFull    – full sync download (entire library)
//   SharingSet                – files shared externally (to outside recipients)
//   AddedToGroup              – added to group with access to sensitive data
//
// Threshold: EventCount > 20 per hour flags anomalous volume.
//   Normal daily operation for one user is typically < 10 file operations/hour.
//   Values > 50 strongly suggest automated/scripted data collection.
// UniqueFiles shows how many distinct files were accessed – high values = bulk exfil.
CloudAppEvents
| where Timestamp > ago(48h)
| where AccountId =~ "j.smith@globex.com"
| where ActionType in ("FileUploaded", "FileDownloaded", "FileSyncDownloadedFull",
                         "SharingSet", "AddedToGroup")
| summarize EventCount = count(),
            UniqueFiles = dcount(ObjectName),
            Apps = make_set(Application)
    by AccountId, ActionType, bin(Timestamp, 1h)
| where EventCount > 20 // Threshold for anomalous volume
| sort by Timestamp asc

// DETECT LARGE OUTBOUND DATA TRANSFERS from compromised devices
// MITRE ATT&CK: T1041 (Exfiltration Over C2 Channel) / T1048 (Exfiltration Over Alternative Protocol)
// Purpose: Detect when compromised endpoints send unusually large amounts
//   of data to public IP addresses, indicating data exfiltration.
//
// How it works:
//   1. Filters to successful outbound connections from compromised devices
//   2. RemoteIPType == "Public" excludes internal traffic (only internet-facing)
//   3. Aggregates TotalBytesSent per destination per hour
//   4. Threshold: > 50 MB (50,000,000 bytes) in a single hour is anomalous
//
// Output columns:
//   TotalBytesSent     – volume of data sent (high values = exfiltration)
//   RemoteIP/RemoteUrl – where data was sent (check threat intel / VirusTotal)
//   ConnectionCount    – many connections = beaconing or chunked transfer
//   UniqueDestinations – data sent to many IPs = distributed exfil or scanning
// Cross-reference RemoteIP with your threat intelligence feeds.
DeviceNetworkEvents
| where Timestamp > ago(48h)
| where DeviceName in~ ("WS-FINANCE-01", "FS02")
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| summarize TotalBytesSent = sum(SentBytes),
            ConnectionCount = count(),
            UniqueDestinations = dcount(RemoteIP)
    by DeviceName, RemoteIP, RemoteUrl, bin(Timestamp, 1h)
| where TotalBytesSent > 50000000 // >50 MB threshold
| sort by TotalBytesSent desc

# CONTAINMENT: Disable compromised user accounts in Microsoft Entra ID
# Scope: User.ReadWrite.All – required to modify user account properties
# Purpose: Immediately prevent the attacker from using stolen credentials
#   to access ANY Microsoft 365 or Azure resource.
# Impact: The user will be unable to log in until the account is re-enabled.
#   All active sessions continue until tokens expire or are revoked (next step).
# Expected output: "Disabled account: j.smith@globex.com" for each user
Connect-MgGraph -Scopes "User.ReadWrite.All"

$compromisedUsers = @(
    "j.smith@globex.com"
    # Add additional compromised accounts as identified
)

foreach ($user in $compromisedUsers) {
    Update-MgUser -UserId $user -AccountEnabled:$false
    Write-Host "Disabled account: $user" -ForegroundColor Yellow
}

# CONTAINMENT: Revoke all refresh tokens and active sessions
# Purpose: Even after disabling the account, existing access tokens
#   remain valid until they expire (typically 1 hour for access tokens).
#   Revoke-MgUserSignInSession forces immediate invalidation of ALL
#   refresh tokens, requiring re-authentication on every session.
# This ensures the attacker cannot use any previously issued tokens.
# Expected output: "Revoked sessions for: j.smith@globex.com"
#   followed by account status verification showing Enabled=False
foreach ($user in $compromisedUsers) {
    Revoke-MgUserSignInSession -UserId $user
    Write-Host "Revoked sessions for: $user" -ForegroundColor Yellow
}

# Verify account status – confirm all accounts show Enabled=False
foreach ($user in $compromisedUsers) {
    $userObj = Get-MgUser -UserId $user -Property AccountEnabled, DisplayName
    Write-Host "$($userObj.DisplayName): Enabled=$($userObj.AccountEnabled)"
}

# ERADICATION: Live Response commands – run on the isolated device
# Purpose: Remove all persistence mechanisms and malware artifacts identified
#   during investigation. Live Response connects to the isolated device via
#   the Defender for Endpoint cloud channel (works even when device is isolated).
#
# Step 1: Remove the malicious scheduled task used for persistence
# The "remediate" command removes the task and logs the action
remediate scheduledtask "WindowsUpdateCheck"

# Step 2: Verify the task was removed by listing all scheduled tasks
scheduledtasks

# Step 3: Remove the dropped malware files
# Remediate moves files to quarantine rather than permanently deleting,
# preserving them as evidence for post-incident forensic analysis
remediate file "C:\ProgramData\Microsoft\WindowsUpdateCheck.exe"
remediate file "C:\Users\j.smith\AppData\Local\Temp\payload.ps1"

# Step 4: Verify file removal – should return "file not found"
dir "C:\ProgramData\Microsoft\WindowsUpdateCheck.exe"
dir "C:\Users\j.smith\AppData\Local\Temp\payload.ps1"

# ERADICATION: Reset passwords for all compromised accounts
# Scope: User.ReadWrite.All – required to reset passwords
# Purpose: Replace stolen credentials with new, strong passwords.
#   ForceChangePasswordNextSignIn ensures the user sets their own
#   permanent password at next login.
#
# Security: The temporary password is generated using cryptographically
#   random characters (letters, numbers, special chars, 24 chars long).
# IMPORTANT: Communicate the temporary password via a secure
#   out-of-band channel (phone call, in-person). NEVER send via email
#   (the attacker may still have access to the mailbox).
#
# Also lists authentication methods to help plan MFA re-registration.
# If the attacker registered their own MFA method, you must remove it
# before re-enabling the account.
Connect-MgGraph -Scopes "User.ReadWrite.All"

$compromisedUsers = @("j.smith@globex.com")

foreach ($user in $compromisedUsers) {
    # Generate a strong temporary password
    $tempPassword = -join ((65..90) + (97..122) + (48..57) + (33..38) |
        Get-Random -Count 24 | ForEach-Object { [char]$_ })

    $passwordProfile = @{
        Password                      = $tempPassword
        ForceChangePasswordNextSignIn = $true
    }

    Update-MgUser -UserId $user -PasswordProfile $passwordProfile
    Write-Host "Password reset for: $user (temp password generated)" -ForegroundColor Green

    # Force MFA re-registration
    # Remove existing MFA methods so the user must re-register
    $authMethods = Get-MgUserAuthenticationMethod -UserId $user
    Write-Host "  Authentication methods count: $($authMethods.Count)"
}

# ERADICATION: Reset KRBTGT password (run on domain controller)
# MITRE ATT&CK: T1558.001 (Golden Ticket defense)
# Purpose: The KRBTGT account is used to encrypt all Kerberos tickets in AD.
#   If the attacker stole the KRBTGT hash, they can forge Golden Tickets
#   granting unrestricted access to any resource in the domain.
#
# CRITICAL: Reset KRBTGT TWICE with a 10+ hour gap between resets.
#   - First reset: invalidates tickets issued with the current hash
#   - Wait 10+ hours: allows maximum ticket lifetime (10h default) to expire
#   - Second reset: invalidates tickets forged with the first new hash
# Without the second reset, attackers who captured the new hash during
# the first reset window can still forge valid tickets.
#
# WARNING: Monitor domain authentication closely after reset.
#   Some services using cached Kerberos tickets may experience brief disruptions.
# First reset:
Set-ADAccountPassword -Identity krbtgt -Reset `
    -NewPassword (ConvertTo-SecureString -AsPlainText (
        -join ((65..90) + (97..122) + (48..57) | Get-Random -Count 32 |
        ForEach-Object { [char]$_ })
    ) -Force)
Write-Host "KRBTGT password reset #1 complete. Wait 10+ hours before second reset." -ForegroundColor Yellow

# After 10+ hours, run the second reset to fully invalidate old tickets

# RECOVERY: Re-enable user accounts after credential reset is confirmed
# Purpose: Once new passwords are set and MFA re-registration is required,
#   re-enable the accounts so users can log in with fresh credentials.
# Expected output: "Re-enabled account: j.smith@globex.com"
#
# IMPORTANT: Communicate the temporary password via a SECURE out-of-band channel:
#   - Phone call (verify user identity first)
#   - In-person delivery
#   - Encrypted messaging app
#   NEVER send credentials via email – the attacker may still have
#   inbox access via forwarding rules or OAuth app consents.
foreach ($user in $compromisedUsers) {
    Update-MgUser -UserId $user -AccountEnabled:$true
    Write-Host "Re-enabled account: $user" -ForegroundColor Green
}

# Communicate temporary password to user via secure out-of-band channel
# (phone call, in-person, encrypted message. NEVER via email)

// POST-ERADICATION VERIFICATION: Monitor for persistence re-creation
// Purpose: After removing all malware and persistence mechanisms, run this
//   query to verify nothing reappears. Schedule this as a daily check for
//   24-48 hours after eradication is complete.
//
// What to watch for:
//   ScheduledTaskCreated  – new scheduled tasks (attacker's persistence returning)
//   ScheduledTaskUpdated  – modification of existing tasks (hiding in legitimate tasks)
//   RegistryValueSet      – autorun registry keys (Run, RunOnce, Services)
//   ServiceInstalled      – new Windows services (common persistence method)
//
// The Detail column extracts the specific artifact name from AdditionalFields JSON.
// If ANY results appear after eradication, the threat was NOT fully removed –
//   re-investigate immediately and look for secondary backdoors.
// Empty results = successful eradication confirmed.
DeviceEvents
| where Timestamp > ago(24h)
| where DeviceName =~ "WS-FINANCE-01"
| where ActionType in ("ScheduledTaskCreated", "ScheduledTaskUpdated",
                         "RegistryValueSet", "ServiceInstalled")
| project Timestamp, DeviceName, ActionType,
          AdditionalFields = parse_json(AdditionalFields)
| extend Detail = case(
    ActionType == "ScheduledTaskCreated", tostring(AdditionalFields.TaskName),
    ActionType == "RegistryValueSet", tostring(AdditionalFields.RegistryValueName),
    ActionType == "ServiceInstalled", tostring(AdditionalFields.ServiceName),
    "N/A"
  )

// Comprehensive MITRE ATT&CK mapping for the incident
AlertInfo
| where Timestamp > ago(7d)
| where AttackTechniques != ""
| extend Techniques = parse_json(AttackTechniques)
| mv-expand Technique = Techniques
| extend TechniqueStr = tostring(Technique)
| summarize
    AlertCount = count(),
    AlertTitles = make_set(Title),
    Severities = make_set(Severity),
    DetectionSources = make_set(DetectionSource),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
  by TechniqueStr
| sort by FirstSeen asc

// Custom detection: Office app spawning PowerShell with download cradle
DeviceProcessEvents
| where Timestamp > ago(1h)
| where InitiatingProcessFileName in~ ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe",
                        "cscript.exe", "mshta.exe")
| where ProcessCommandLine has_any (
    "DownloadString", "DownloadFile", "Invoke-WebRequest",
    "IEX", "Invoke-Expression", "Net.WebClient",
    "-EncodedCommand", "-enc ", "FromBase64String",
    "Start-BitsTransfer", "certutil"
  )
| project Timestamp, DeviceName, AccountName, FileName,
          ProcessCommandLine, InitiatingProcessFileName,
          InitiatingProcessCommandLine, SHA256
// Entity mapping for custom detection rule:
// DeviceName → Device, AccountName → User, SHA256 → File