Loading the run…

Corporate assumed breach

PT-1842 · Internal assumed breach · Corporate · started Nov 2, 2026, 9:10 AM CST from VY-WIN-0142 finance jump.

What the run did

Complete

100% · production-safe mode

Nov 2, 2026, 9:10 AM CSTRunner checked in from the finance jump host. Destructive modules are off.
Nov 2, 2026, 9:14 AM CSTOutlook offline store on the jump host still holds a reused password for a.chen.
Nov 2, 2026, 9:21 AM CSTProcess memory on ERP-SQL-01 contains the NTLM secret for svc-backup.
Nov 2, 2026, 9:28 AM CSTsvc-backup replicated the directory and can list the payroll share. No Sentinel alert in 15 minutes.

Open path

A reused mailbox password reached a SQL sysadmin, which exposed svc-backup, which replicated the directory.

Open path

svc-backup is also on the payroll share. Retiring the account closes this path with the directory path.

Loading the run…