TORA — Shift 8 in Review | Eyes on the Glass.AI

Operational Handoff

**Shift window:** 2026-05-11 through 2026-05-15
**Open escalations:** 15 cases pending VERA investigation
**Priority breakdown:** P1: 8 | P2: 7 | P3: 0
**Insufficient context:** 1 case pending enrichment — blocking fields: asset.criticality, asset.environment, asset.hostname, asset.owner, identity.username, identity.user_type, identity.privilege_level, identity.risk_score
**Forced escalations:** 15 — rules triggered: phishing_credentials_submitted, elevated_privilege_user, multi_asset_scope, asset_criticality_critical_or_high, production_environment, service_account_external_query
**Watch list:** Confirm containment status on srv-jump-01.corp.local immediately — two confirmed credential submissions (c.wardlaw via login-microsofft-com.net, m.reyes via payroll-update.co) both originated from this host, and no containment confirmation arrived before shift close.

Alert Queue Overview

**Alerts processed:** 25
**Dispositions:** ESCALATED: 15 | CLOSED: 6 | INSUFFICIENT_CONTEXT: 1 | UNKNOWN: 3
**Alert subtypes:** dns_malicious_lookup: 9 | phishing_email_credential_harvest: 5 | phishing_email_malicious_attachment: 5 | phishing_email_malicious_link: 2 | dns_tunneling: 3 | dns_fast_flux: 1
**Forced escalation rules fired:** phishing_credentials_submitted: 3 | elevated_privilege_user: 4 | multi_asset_scope: 8 | asset_criticality_critical_or_high: 5 | production_environment: 6 | service_account_external_query: 2
**Parse failures:** 0 — UNKNOWN verdicts (3) reflect incomplete triage output in cases TORA-20260513-0011, TORA-20260513-0012, TORA-20260513-0014; structured reasoning narratives are present but verdict fields were not finalized

What the Shift Looked Like

The shift was dominated by three concurrent phishing campaigns operating against corp.local — okta-verify.co, payroll-update.co, and login-microsofft-com.net — alongside a multi-asset DNS tunneling operation using cdn-metrics-pipe.io as its dnscat2 C2 channel. Phishing volume climbed across the week, with seven alerts on May 15 against four on May 11, and the campaigns expanded in scope and severity as the shift progressed rather than decaying. Sender domains sharepoint-files.net, workday-notifications.net, and docusign-secure.com recurred as spoofed infrastructure across multiple delivery events; MTA IPs 62.233.50.11, 194.165.16.11, and 179.43.175.10 appeared across at least two cases each, confirming multi-MTA campaign architecture. The dns_tunneling cases required substantially more behavioral reasoning than dns_malicious_lookup cases — tunneling dispositions turned on entropy profiles, subdomain length distributions, query volume, and response payload sizes rather than domain reputation alone, and the identity context (admin service accounts with MFA disabled) was a primary driver in two of the three cases. Email click and credential-harvest delivery cases diverged sharply in triage posture: a phishing_email_malicious_attachment or phishing_email_credential_harvest delivery alert with no recorded user action leaves an open exposure window that warrants escalation but allows time for gateway retraction, whereas a confirmed credentials_submitted: true event on an email click collapses that window entirely and moves the response from prevention to active account compromise.

Cases Worth Noting

TORA-20260511-0003 | phishing_email_malicious_link | ESCALATED | critical Finding: Elevated-privilege executive user c.wardlaw submitted credentials to okta-verify.co from srv-jump-01.corp.local within 21 minutes of delivery, with all email authentication controls failed and the gateway delivering despite a malicious verdict. Why it’s worth noting: This was the first confirmed credential submission on a production jump server this shift, establishing the blast-radius pattern that made every subsequent srv-jump-01 alert a P1 regardless of the individual recipient’s privilege level.

TORA-20260513-0013 | phishing_email_malicious_link | ESCALATED | critical Finding: m.reyes, an elevated-privilege user, submitted credentials to payroll-update.co from srv-jump-01.corp.local with a Safari/macOS user-agent on a Windows 10 jump server — a device mismatch that could not be resolved at triage. Why it’s worth noting: The user-agent anomaly introduced a forensic ambiguity that triage alone cannot resolve — whether the click originated from a hijacked RDP session, a connecting device, or a compromised session changes the lateral movement scope, and VERA needs to bound that before the jump server investigation proceeds.

TORA-20260515-0019 | dns_malicious_lookup | ESCALATED | high Finding: A DNS query to login-microsofft-com.net from ws-eng-087.corp.local returned NXDOMAIN and would have closed under a valid 31-day suppression rule, but shift memory confirmed the domain was active campaign infrastructure with a confirmed credential submission earlier in the shift. Why it’s worth noting: This case is the clearest example this shift of suppression eligibility being invalidated by in-shift campaign confirmation — a rule that was correctly applied on May 11 and May 12 became operationally dangerous by May 15, and the decision required explicit shift-memory reasoning rather than any field in the alert itself.

TORA-20260515-0025 | dns_malicious_lookup | INSUFFICIENT_CONTEXT | medium Finding: A NOERROR resolution of svc-relay-cdn.net — a confirmed Remcos C2 domain backed by 22/60 intel sources — could not be triaged because both asset axes and the entire identity axis were absent for host 10.10.7.55. Why it’s worth noting: This case represents a pipeline gap, not an ambiguous signal — the threat is credible and the case is one CMDB lookup away from a probable forced escalation, which means the incoming shift should treat CMDB enrichment on 10.10.7.55 as a time-sensitive action item rather than routine backfill.

Where I Got Stuck

One case landed in INSUFFICIENT_CONTEXT, blocking on eight fields: asset.criticality, asset.environment, asset.hostname, asset.owner, identity.username, identity.user_type, identity.privilege_level, and identity.risk_score. The recurring gap was a total absence of CMDB coverage for host 10.10.7.55 — no hostname, no owner, no environment classification, leaving the network axis as the only available signal. Complete enrichment on that IP would have resolved the disposition immediately, either forcing a P1 escalation on a Remcos C2 NOERROR or permitting a monitored close on a low-criticality isolated host.

Signal vs. Noise

The O365 email gateway is consistently returning a malicious verdict and then delivering anyway — across every major campaign domain this shift (okta-verify.co, payroll-update.co, login-microsofft-com.net, sharepoint-files.net), confirmed-malicious emails reached recipient inboxes without quarantine. Cases TORA-20260511-0003, TORA-20260513-0011, TORA-20260513-0012, TORA-20260513-0013, TORA-20260514-0016, TORA-20260514-0017, TORA-20260515-0024 all record gateway_verdict: malicious paired with gateway_action: delivered. The gateway’s verdict engine should be audited immediately for policy exceptions, SPF-pass bypass conditions, or misconfigured action rules — correct detection with no enforcement is producing zero protective value and is a systemic amplifier for every phishing campaign currently active against corp.local.

For NOVA

**Alert subtype distribution:** dns_malicious_lookup: 9 | phishing_email_credential_harvest: 5 | phishing_email_malicious_attachment: 5 | phishing_email_malicious_link: 2 | dns_tunneling: 3 | dns_fast_flux: 1
**INSUFFICIENT_CONTEXT field frequency:** asset.criticality: 1 | asset.environment: 1 | asset.hostname: 1 | asset.owner: 1 | identity.username: 1 | identity.user_type: 1 | identity.privilege_level: 1 | identity.risk_score: 1
**Confidence distribution:** high: 12 | medium: 5 | low: 2 | unknown (UNKNOWN verdict): 3 | insufficient (INSUFFICIENT_CONTEXT): 1 | not applicable (CLOSED): 6
**Recurring domains:** login-microsofft-com.net: 7 cases | okta-verify.co: 4 cases | payroll-update.co: 4 cases | cdn-metrics-pipe.io: 3 cases | sharepoint-files.net: 3 cases | secure-docusign-verify.com: 3 cases
**Recurring assets:** srv-jump-01.corp.local: 4 cases | ws-eng-087.corp.local / 10.10.4.87: 6 cases | 10.10.1.42: 4 cases
**Open question:** The suppression rule on login-microsofft-com.net was correctly applied in early-shift CLOSED cases and then correctly overridden in late-shift escalations based on in-shift campaign confirmation — what is the cross-shift policy for suppression invalidation when a domain transitions from dormant to active campaign infrastructure between shifts?

For ARIA

**Escalations pending:** 15 cases
**Urgency breakdown:** immediate: 8 | within_shift: 5 | next_available: 2
**Immediate actions required:**
  - revoke_session: c.wardlaw — srv-jump-01.corp.local (TORA-20260511-0003, TORA-20260514-0018; confirmed credentials submitted to okta-verify.co and login-microsofft-com.net)
  - reset_credentials: c.wardlaw — Okta/SSO account (AiTM proxy compromise cannot be ruled out; MFA tokens may have been captured)
  - revoke_session: m.reyes — srv-jump-01.corp.local (TORA-20260513-0013; confirmed credentials submitted to payroll-update.co)
  - reset_credentials: m.reyes — Okta/SSO account
  - isolate_host: srv-jump-01.corp.local — two confirmed credential submissions, jump server lateral movement risk (TORA-20260511-0003, TORA-20260513-0013, TORA-20260514-0018)
  - isolate_host: ws-exec-005.corp.local — active dnscat2 tunneling to cdn-metrics-pipe.io, crown_jewel_adjacent, prior escalation unresolved (TORA-20260511-0004)
  - isolate_host: ws-fin-015.corp.local — active dnscat2 tunneling to cdn-metrics-pipe.io, admin service account svc-sysadmin, no MFA (TORA-20260513-0014)
  - isolate_host: ws-hr-099.corp.local — active DNS tunneling to infra-sync-probe.net, admin service account svc-backup, no MFA, 382 queries NOERROR (TORA-20260515-0020)
  - isolate_host: srv-ad-01.corp.local — Cobalt Strike fast-flux C2 beacon pattern, critical production AD server, crown_jewel_adjacent (TORA-20260515-0023)
  - disable_account: svc-backup — admin service account, no MFA, active tunneling exfiltration (TORA-20260515-0020)
  - disable_account: svc-sysadmin — admin service account, no MFA, active dnscat2 tunnel (TORA-20260513-0014)
  - reset_credentials: contractor_1 — phishing delivery with MFA disabled, no credential submission confirmed but exposure window open (TORA-20260513-0011, TORA-20260515-0024)
  - block_ioc: 194.165.16.11 — recurrent phishing MTA across TORA-20260513-0012, TORA-20260514-0017
  - block_ioc: 62.233.50.11 — recurrent phishing MTA across TORA-20260511-0002, TORA-20260512-0008, TORA-20260512-0010
  - block_ioc: 179.43.175.10 — phishing MTA, TORA-20260514-0016
  - block_ioc: 185.220.101.47 — phishing MTA, TORA-20260515-0024
**Credential exposure:** c.wardlaw (elevated, executive — confirmed submission to okta-verify.co and login-microsofft-com.net) | m.reyes (elevated, engineering — confirmed submission to payroll-update.co) | contractor_1 (standard — MFA disabled, page loaded on login-microsofft-com.net, credentials_submitted unconfirmed)
**Attacker IPs to block:** 194.165.16.11 | 62.233.50.11 | 179.43.175.10 | 185.220.101.47 | 91.92.251.103

TORA — Tier 1 Triage and Orchestration Response Agent Eyes on the Glass | eyesontheglass.ai Shift 8 | Shift ID: SHIFT-20260516-025826 | Output schema: tora_output_schema_v1.2.0