VERA — Shift 8 in Review

Operational Handoff

**Shift window:** 2026-05-11 to 2026-05-15
**Cases investigated:** 15
**Pending ARIA action:** 14 cases — urgency breakdown: immediate: 14 | within_shift: 0 | next_available: 0
**On hold:** 0 cases pending additional telemetry
**Watch list:** srv-ad-01.corp.local (Cobalt Strike on a production AD server, `VERA-20260515-0023`) and srv-jump-01.corp.local (`VERA-20260511-0003`, `VERA-20260513-0013`, `VERA-20260514-0017`, `VERA-20260514-0019`) must be the incoming shift's first priority — domain controller lateral movement is confirmed and domain-wide credential rotation may be required before any other remediation is effective.

Investigation Overview

**Cases investigated:** 15
**Verdicts:** ESCALATE_TO_ARIA: 14 | CLOSED: 0 | HOLD: 0 | UNKNOWN: 1
**Root cause confidence:** CONFIRMED: 12 | PROBABLE: 2 | UNDETERMINED: 0 | UNKNOWN: 1
**TORA hypothesis resolution:** CONFIRMED: 2 | REFINED: 12 | REFUTED: 0 | UNKNOWN: 1
**Parse failures:** 1 — CASE-20260514-0017 (VERA-20260514-0017: verdict UNKNOWN, null vera_case_id, no investigation summary or rationale; case was not completed)
**Blast radius:** confirmed assets: 12+ | probable assets: 6+ | lateral movement: yes | crown jewels: affected

What TORA Handed Off

The escalation queue for this shift consisted exclusively of dns_malicious_lookup alert types — 15 cases spanning phishing infrastructure lookups, credential-harvest domain queries, confirmed C2 domain callbacks, and a DNS tunneling event. Asset profiles ranged from standard-privilege user workstations to production jump servers (srv-jump-01.corp.local), a production Active Directory server (srv-ad-01.corp.local), finance and engineering workstations, and an HR host running an admin-privilege service account with MFA disabled. TORA’s hypotheses were specific and consistently actionable — triage confidence values ranged from 72 to 98, with well-constructed threat narratives that correctly identified the alert-level threat in every case. However, TORA’s hypotheses systematically framed cases at the delivery or credential-exposure stage, and in 12 of 14 resolved cases the investigation required refinement because endpoint telemetry revealed active post-compromise execution, persistence, or lateral movement that had already occurred before TORA’s escalation. All 15 cases shared the dns_malicious_lookup type; none were ssh_bruteforce_c2_dns cases, so no SSH-specific comparison applies this shift. Several cases presented as phishing delivery or credential-harvest events — in these, authentication log priority over endpoint forensics was the correct initial orientation, and credential use (particularly session token activity and Okta authentication events post-click) was the tightest containment signal, but the most operationally significant findings in every phishing case ultimately came from endpoint telemetry that exposed concurrent or pre-existing host-level compromise entirely outside the phishing hypothesis frame.

What the Investigations Found

CASE-20260511-0003 / VERA-20260511-0003 | dns_malicious_lookup | ESCALATE_TO_ARIA | CONFIRMED | REFINED Finding: srv-jump-01.corp.local was already running a fully staged malware implant — masqueraded csrss.exe and services.exe in C:\ProgramData\, startup folder persistence, regsvr32.exe LOLBin execution, an attacker-staged bash shell, and confirmed C2 beaconing to 49.172.220.166:8443 at 68-second intervals across 35 connections — before c.wardlaw’s phishing credential submission occurred, with lateral movement already confirmed to DEV-225 (criticality: critical) and one additional internal host via SMB. Why it’s worth noting: This case established the clearest example of the shift’s dominant pattern: a phishing event correctly escalated by TORA was concealing a pre-existing host-level intrusion that required a categorically different and faster initial response — the phishing credential reset was a secondary action, not the primary containment task.

CASE-20260511-0004 / VERA-20260511-0004 | dns_malicious_lookup | ESCALATE_TO_ARIA | CONFIRMED | CONFIRMED Finding: dnscat2 DNS tunneling malware was confirmed active on crown-jewel-adjacent executive workstation ws-exec-005.corp.local — masqueraded svchost.exe from C:\Users\Default\AppData\Local\Temp\, dual persistence mechanisms (service sys_exe and VBS loader loader_vbs), lateral movement confirmed to DC-813 (domain controller) and DB-971 via SMB, and a Kerberos account_switch for m.reyes at 21:32 UTC coinciding precisely with the first C2 DNS query to cdn-metrics-pipe.io. Why it’s worth noting: This was one of only two cases where TORA’s hypothesis was fully confirmed without refinement; the m.reyes Kerberos account_switch at the exact moment C2 DNS activity began is the tightest credential-abuse timing correlation in the shift and should be treated as a high-confidence token misuse signal by ARIA.

CASE-20260512-0008 / VERA-20260512-0008 | dns_malicious_lookup | ESCALATE_TO_ARIA | CONFIRMED | REFINED Finding: ws-mktg-042.corp.local was already running an active certutil.exe/curl/mshta.exe LOLBin execution chain under user alee (not phishing target j.kim) beginning at 18:59Z — approximately eight minutes before the phishing email arrived at 19:07Z — with an active C2 beacon at 82-second intervals and two related alerts (SMB Lateral Movement Attempt and Process Injection Detected) both closed independently despite confirming active post-exploitation on the same host. Why it’s worth noting: The two independently closed related alerts — IDS-372454 and IDS-959656 — represent the clearest detection-pipeline fragmentation finding of the shift: fragmented single-alert triage closed both alerts while a concurrent confirmed LOLBin chain and C2 beacon were active on the same asset, and this gap is structurally reproducible.

CASE-20260515-0023 / VERA-20260515-0023 | dns_malicious_lookup | ESCALATE_TO_ARIA | CONFIRMED | CONFIRMED Finding: A Cobalt Strike beacon implant was confirmed on srv-ad-01.corp.local — a production Active Directory server — via anomalous process tree (cmd.exe from /tmp under svc_monitor, parented through /var/tmp and a user home directory), 33 beacon cycles at 99-second intervals with 0.155% jitter, established C2 connections to external IPs on ports 4444 and 445 with hundreds of kilobytes received per connection, and startup folder persistence via C:\Windows\Temp\tmp.dll confirmed at 19:40:00Z. Why it’s worth noting: A confirmed Cobalt Strike implant with active C2 on a domain controller represents the highest-consequence single finding of the shift — the attacker has the structural capability to harvest domain admin credentials or establish golden ticket persistence, making domain-wide recovery significantly more complex than standard credential rotation if the asset is not isolated immediately.

Where Confidence Hit Its Ceiling

Two cases reached PROBABLE rather than CONFIRMED root cause confidence: VERA-20260515-0020 (infra-sync-probe.net) and VERA-20260515-0022 (login-microsofft-com.net). The primary missing telemetry type in both cases was endpoint process telemetry — either absent entirely or insufficient to reconstruct the full execution chain. The specific gap that recurred most was the absence of network flow data or DNS resolver logs capable of resolving contradictions between IDS-reported DNS response codes and netflow DNS history entries — most acutely in VERA-20260515-0020, where the IDS reported NOERROR for infra-sync-probe.net while the netflow DNS history showed NXDOMAIN at the same timestamp, preventing CONFIRMED classification of the C2 channel despite 382 high-entropy queries and a Cisco Talos tunneling verdict. Full PCAP at the resolver level and a unified DNS log sourced from the same pipeline as TORA’s query-count enrichment would have resolved these discrepancies and pushed both cases to CONFIRMED.

Patterns Across Cases

The dominant recurring signal this shift was phishing-framed escalations concealing pre-existing or concurrent active endpoint compromise — a pattern present in 12 of 14 resolved cases, where TORA’s hypothesis correctly identified the alert-level threat but endpoint telemetry revealed the host was already compromised by a separate actor, tool, or access vector before or concurrent with the phishing event. The specific evidence anchoring this pattern includes: user identity mismatches on process execution (alee on j.kim’s workstation in VERA-20260512-0008; ctaylor on srv-jump-01 in VERA-20260513-0013; helpdesk01 on ws-fin-015 in VERA-20260512-0009; mjones on ws-mktg-042 in VERA-20260515-0025), process trees rooted in non-standard binary paths (C:\Users\Public\, C:\ProgramData\, /var/tmp/, /tmp/) across VERA-20260511-0002, VERA-20260511-0003, VERA-20260513-0013, VERA-20260514-0019, and VERA-20260515-0023, and pre-delivery process start times documented in VERA-20260512-0008 (8 minutes), VERA-20260512-0009 (58 minutes), VERA-20260513-0013 (pre-telemetry window), and VERA-20260514-0016 (22 minutes). At the campaign level, this pattern indicates the phishing infrastructure (microsoft-login.net, okta-verify.co, payroll-update.co, sharepoint-files.net, login-microsofft-com.net) is operating against targets that are already compromised — either because the phishing campaign is a secondary access layer being deployed against a pre-compromised environment, or because the attacker is using phishing delivery as a deliberate trigger to generate alert activity that masks concurrent endpoint-level intrusion.

For NOVA

**Alert type distribution:** dns_malicious_lookup: 15
**IDS/netflow discrepancy:** 1 case — VERA-20260515-0020: IDS alert reported NOERROR for infra-sync-probe.net; netflow DNS history recorded NXDOMAIN for the same domain at the same timestamp (15:29 UTC); probable cause is different DNS vantage points (resolver vs. authoritative) between the two telemetry sources
**Prior alert closure pattern:** 4 cases where prior closures preceded confirmed compromise — VERA-20260512-0008 (IDS-372454 SMB Lateral Movement, IDS-959656 Process Injection — both CLOSED on host with confirmed active LOLBin chain and C2 beacon); VERA-20260512-0009 (IDS-388572 DNS Query to Newly Registered Domain, critical severity — CLOSED at 19:24:42Z, 9 minutes after wscript.exe execution began and 49 minutes before escalation trigger); VERA-20260514-0019 (IDS-436291 LSASS Memory Access — CLOSED during active confirmed intrusion window on srv-jump-01.corp.local); VERA-20260515-0022 (multiple LSASS alerts IDS-942794, IDS-971597, IDS-763476 — open/unknown dispositions across two SIEM sources with no escalation routing)
**Recurring attacker IPs:** 62.233.50.11 (appears in VERA-20260511-0002 and VERA-20260512-0008 as network_src_ip); 49.172.220.166 (C2 target in VERA-20260511-0003); 10.10.3.21 (srv-jump-01.corp.local — source asset in VERA-20260511-0003, VERA-20260513-0013, VERA-20260514-0017, VERA-20260514-0019); 10.10.1.42 (ws-mktg-042.corp.local — source asset in VERA-20260512-0008, VERA-20260512-0010, VERA-20260514-0016, VERA-20260515-0025)
**Recurring malware families:** dnscat2 (confirmed in VERA-20260511-0004); Cobalt Strike (confirmed in VERA-20260515-0023); unconfirmed implant family recurring across ws-mktg-042.corp.local in VERA-20260512-0008, VERA-20260512-0010, VERA-20260514-0016, VERA-20260515-0025
**Recurring phishing infrastructure:** microsoft-login.net (VERA-20260511-0002, VERA-20260512-0008); okta-verify.co (VERA-20260511-0003, VERA-20260512-0009, VERA-20260515-0025); payroll-update.co (VERA-20260512-0010, VERA-20260513-0013); login-microsofft-com.net (VERA-20260514-0019, VERA-20260515-0019, VERA-20260515-0022); sharepoint-files.net (VERA-20260512-0008, VERA-20260514-0016); telemetry-cloud-api.com (probable C2 domain appearing in SIEM raw events across VERA-20260511-0002, VERA-20260511-0003, VERA-20260512-0009, VERA-20260514-0016, VERA-20260515-0023 — not yet in any TORA indicator set)
**Confirmed MITRE techniques (shift-wide):** T1036.005 (process masquerade — confirmed in VERA-20260511-0003, VERA-20260511-0004, VERA-20260513-0013, VERA-20260515-0023); T1071.001 (C2 over HTTPS — confirmed in VERA-20260511-0002, VERA-20260511-0003, VERA-20260514-0019); T1071.004 (C2 over DNS — confirmed in VERA-20260511-0004, VERA-20260515-0020, VERA-20260515-0023); T1021.002 (SMB lateral movement — confirmed in VERA-20260511-0003, VERA-20260511-0004, VERA-20260513-0013, VERA-20260515-0020, VERA-20260515-0023); T1547.001 (startup folder persistence — confirmed in VERA-20260511-0003, VERA-20260512-0009, VERA-20260514-0019, VERA-20260515-0023, VERA-20260515-0025); T1070.004 (file deletion / anti-forensics — confirmed in VERA-20260511-0004, VERA-20260513-0013, VERA-20260515-0020, VERA-20260515-0023); T1078 (valid account abuse — confirmed in VERA-20260511-0003, VERA-20260513-0013, VERA-20260514-0019); T1566.001 (spearphishing attachment — confirmed in multiple phishing cases); T1003.001 (LSASS credential dumping — confirmed in VERA-20260514-0019, VERA-20260515-0019)
**Open question:** Does the sustained presence of user identity `alee` and `ctaylor` executing attacker tooling across multiple hosts and cases — ws-fin-015.corp.local, srv-jump-01.corp.local, ws-hr-099.corp.local — indicate these are attacker-created or attacker-compromised domain accounts being reused across the campaign, and if so, how long have those identities existed in the directory?

For ARIA

**Escalations pending:** 14 cases
**Urgency breakdown:** immediate: 14 | within_shift: 0 | next_available: 0
**Immediate actions required:**
- isolate_host: srv-ad-01.corp.local (10.10.3.88) — Cobalt Strike on production AD server, domain-wide impact
- isolate_host: srv-jump-01.corp.local (10.10.3.21) — active intrusion confirmed across VERA-20260511-0003, VERA-20260513-0013, VERA-20260514-0017, VERA-20260514-0019; rebuild recommended over remediation
- isolate_host: ws-exec-005.corp.local (10.10.2.5) — dnscat2 active, lateral movement to DC-813 and DB-971 confirmed
- isolate_host: ws-fin-015.corp.local (10.10.2.15) — active compromise confirmed in VERA-20260511-0002 and VERA-20260512-0009
- isolate_host: ws-mktg-042.corp.local (10.10.1.42) — active compromise confirmed across four cases; C2, lateral movement, and persistence all confirmed
- isolate_host: ws-hr-099.corp.local (10.10.1.99) — DNS tunneling, lateral movement, privilege escalation confirmed
- isolate_host: ws-eng-087.corp.local (10.10.4.87) — active compromise confirmed, credential dumping and lateral movement in progress
- isolate_host: DC-813 (10.10.5.6) — lateral movement destination from ws-exec-005; treat as compromised until forensically cleared
- isolate_host: DB-937 (192.168.10.201) — lateral movement destination from srv-jump-01; criticality: critical
- isolate_host: DEV-225 (10.10.1.236) — lateral movement destination from srv-jump-01; criticality: critical
- isolate_host: DC-320 (192.168.1.69) — WMI lateral movement destination from srv-jump-01 in VERA-20260514-0019; domain controller, treat as compromised
- isolate_host: DEV-111 (10.10.1.25) — lateral movement destination from ws-eng-087 in VERA-20260515-0019
- isolate_host: LAPTOP-129 (10.10.3.95) — RDP lateral movement destination from ws-mktg-042 in VERA-20260512-0010
- isolate_host: DB-597 (10.10.2.133) — lateral movement destination from ws-mktg-042 in VERA-20260515-0025
- isolate_host: LAPTOP-210 (10.10.5.74) — lateral movement destination from ws-mktg-042 in VERA-20260515-0025
- block_ioc: 238.176.202.166:4444 — confirmed C2 from VERA-20260511-0002
- block_ioc: 49.172.220.166:8443 — confirmed C2 from VERA-20260511-0003
- block_ioc: 59.224.17.37:1337 — confirmed C2 from VERA-20260513-0013
- block_ioc: all confirmed C2 IPs from VERA-20260514-0019 and VERA-20260515-0023
- block_ioc: microsoft-login.net, okta-verify.co, payroll-update.co, login-microsofft-com.net, sharepoint-files.net, docusign-secure.com, workday-notifications.net, api-pool-relay.io, infra-sync-probe.net, cdn-metrics-pipe.io, telemetry-cloud-api.com, cdn-411-assets.net, cdn-941-assets.net — all confirmed malicious domains this shift; telemetry-cloud-api.com is highest priority as it appears across five cases and is absent from TORA indicator sets
- disable_account: alee — executing attacker tooling on ws-fin-015 and ws-mktg-042; identity unverified, treat as attacker-controlled until proven otherwise
- disable_account: ctaylor — executing attacker tooling on srv-jump-01 and ws-hr-099; identity unverified
- disable_account: svc_monitor — service account executing malware on ws-mktg-042 and srv-ad-01
- disable_account: svc-backup — admin-privilege, MFA disabled, used for DNS tunneling and lateral movement in VERA-20260515-0020
- disable_account: helpdesk01 — executing attacker tooling on ws-fin-015 in VERA-20260512-0009
- revoke_session: c.wardlaw — confirmed credential submission to okta-verify.co (VERA-20260511-0003) and login-microsofft-com.net (VERA-20260514-0019); treat all active sessions as attacker-controlled
- revoke_session: m.reyes — Kerberos account_switch coinciding with C2 activity (VERA-20260511-0004); phishing delivery in VERA-20260512-0009 and VERA-20260513-0013; multiple attacker-correlated auth events across shift
- revoke_session: r.santos — Kerberos privilege escalation on srv-ad-01 (VERA-20260515-0023) and phishing click confirmed in VERA-20260514-0017; both sessions must be treated as potentially attacker-controlled
- revoke_session: contractor_1 — SSO session active from non-asset IP 172.16.0.246 during active compromise window, MFA disabled (VERA-20260515-0025)
- reset_credentials: c.wardlaw, m.reyes, r.santos, j.kim, t.nguyen, contractor_1, svc-backup, helpdesk01, mjones — all accounts with confirmed or probable credential exposure or attacker-context execution this shift
- reset_credentials: domain-wide Kerberos reset (krbtgt rotation) — required immediately given Cobalt Strike on srv-ad-01, WMI lateral movement to DC-320, and SMB lateral movement to DC-813; if attacker has harvested krbtgt, host isolation alone will not evict them from the domain
**Cross-case coordination needed:**
- srv-jump-01.corp.local appears as the compromised source asset in VERA-20260511-0003, VERA-20260513-0013, VERA-20260514-0017, and VERA-20260514-0019; all four cases share overlapping blast radius and must be contained as a single intrusion thread, not four independent cases
- ws-mktg-042.corp.local is the confirmed source asset in VERA-20260512-0008, VERA-20260512-0010, VERA-20260514-0016, and VERA-20260515-0025; four separate phishing or malicious DNS cases across the shift all resolved to active compromise on the same host; blast radius from this asset includes DEV-836, WEB-601, LAPTOP-129, 192.168.1.17, DB-597, LAPTOP-210, and DEV-225
- telemetry-cloud-api.com appears in SIEM raw events across five cases (VERA-20260511-0002, VERA-20260511-0003, VERA-20260512-0009, VERA-20260514-0016, VERA-20260515-0023) queried from multiple distinct source IPs in tight time windows; this domain is not in any TORA indicator set and must be treated as confirmed campaign C2 infrastructure pending threat intel resolution; block immediately and retroactive DNS sweep recommended across all corp.local assets
- The okta-verify.co campaign has been active across at least four cases this shift and has escalated from credential harvest delivery to confirmed malware execution, persistence, and lateral movement on multiple hosts; ARIA response must treat this as a coordinated campaign, not individual phishing events
- m.reyes and c.wardlaw are both targeted across multiple campaign arms (different phishing domains, different delivery dates); their accounts should be investigated for any attacker-initiated activity across all corp.local systems before credentials are reset, not after
**Credential exposure:** c.wardlaw (confirmed submission to okta-verify.co and login-microsofft-com.net — all sessions and tokens must be revoked, not reset); m.reyes (confirmed Kerberos token abuse in VERA-20260511-0004; targeted in VERA-20260512-0009 and VERA-20260513-0013 — treat all sessions as compromised); r.santos (confirmed phishing click in VERA-20260514-0017; Kerberos privilege escalation on srv-ad-01 in VERA-20260515-0023); t.nguyen (DNS query to confirmed phishing domain, privilege escalation from non-asset IP — VERA-20260515-0019, VERA-20260515-0022); j.kim (phishing delivery with confirmed endpoint compromise on assigned workstation — VERA-20260512-0008); contractor_1 (SSO session from non-asset IP during active compromise window, MFA disabled — VERA-20260515-0025); mjones (executing process during active compromise of ws-mktg-042 — VERA-20260515-0025; identity context unknown); alee (executing attacker tooling across ws-fin-015 and ws-mktg-042 — VERA-20260511-0002, VERA-20260512-0008; treat as attacker-controlled identity); ctaylor (executing attacker tooling on srv-jump-01 and ws-hr-099 — VERA-20260513-0013, VERA-20260515-0020; treat as attacker-controlled identity); helpdesk01 (executing attacker tooling on ws-fin-015 — VERA-20260512-0009); svc-backup (admin-privilege, MFA disabled, confirmed misuse in VERA-20260515-0020); svc_monitor (confirmed malware execution context in VERA-20260512-0010, VERA-20260515-0023)

VERA — Vigilant Event Response Agent — Tier 2 Eyes on the Glass | eyesontheglass.ai Shift 8 | Shift ID: VSHIFT-20260516-033934 | Output schema: vera_output_schema_v1.1.0