IncidentsINC-2026-0418
CRITICAL

Suspected hands-on-keyboard intrusion via finance phishing

Status · investigatingOwner · youOpened · 6/27/2026, 6:30:11 AMAlerts · 5Entities · 11
Copilot narrativeverdict: true positive · 87%

Phishing email to m.kowalski → click on invoice-portal-corp[.]co → encoded PowerShell stager → Cobalt Strike beacon to Tor exit → svc_backup lateral RDP to DC-EU-01. Strong kill-chain coherence; verdict: true positive, contain immediately.

T1566.002 · Spearphishing Link/ Initial AccessT1059.001 · PowerShell/ ExecutionT1021.001 · Remote Desktop Protocol/ Lateral MovementT1098.001 · Additional Cloud Credentials/ Persistence

OCSF timeline

normalized
5 events
  1. 05:55 AMcls 1001
    HIGHFile ModifiedFile System Activity
    Falco Falco · LIN-SSHKEY-PERSIST-01 · OCSF-ALT-48165-1001
    device.hostnamelnx-pay-03
  2. 06:12 AMcls 4001
    MEDIUMConnection EstablishedNetwork Activity
    Corelight Zeek · NET-TOR-EGRESS-01 · OCSF-ALT-48170-4001
    src_endpoint.hostnameWIN-FIN-0142
  3. 06:30 AMcls 4009
    HIGHURL ClickedEmail Activity
    Proofpoint TAP · EMAIL-LINK-CLICKED-01 · OCSF-ALT-48177-4009
    actor.user.email_addrm.kowalski@corp.iourl.hostnameinvoice-portal-corp.co
  4. 07:20 AMcls 3002
    CRITICALInteractive LogonAuthentication
    Microsoft Defender for Identity · LAT-RDP-DC-01 · OCSF-ALT-48188-3002
    actor.user.namesvc_backupsrc_endpoint.hostnameWIN-FIN-0142dst_endpoint.hostnameDC-EU-01
  5. 08:14 AMcls 1007
    CRITICALProcess LaunchedProcess Activity
    CrowdStrike Falcon · EDR-PS-ENCODED-CMD-01 · OCSF-ALT-48201-1007
    device.hostnameWIN-FIN-0142actor.user.namem.kowalskiprocess.cmd_linepowershell.exe -enc JABzAD0ATgBlAHcALQBPAGIA...process.file.hash.sha256a3f9c8e1b4d2065f9b1e0a4cd91f3e7a82b50d4e6c11f9bda2c84e5fb9f8c21e