NexLINKEDIN ARCHIVE / Security
Detecting what happens after initial access
Earlier this month, as part of Cybersecurity Awareness Month, I wrote about how attackers are exploiting legitimate identities, authenticated sessions, and trusted IT processes to gain access to organizations.
By Phil Kinsley
Adapted and republished on Nexlinks. The publication date is the original article date; the text is preserved as historical author commentary.
Date derived from the original LinkedIn post identifier, shown in America/New_York time; the export supplied only a relative age.
Historical author commentary. Statements and links reflect the original period; this import is not a new factual verification of every historical claim.
Earlier this month, as part of Cybersecurity Awareness Month, I wrote about how attackers are exploiting legitimate identities, authenticated sessions, and trusted IT processes to gain access to organizations.
But gaining access is only part of the story. How quickly would your organization recognize what happens next?
Consider an attacker installing a legitimate remote management tool, creating mailbox rules to conceal suspicious communications, or using a stolen session token to access Microsoft 365 without another MFA challenge.
The challenge is that these activities don’t necessarily look malicious when viewed individually. It’s often the context surrounding them that reveals what’s actually happening.
An unusual sign-in, a new mailbox rule, or an unexpected remote session might each generate separate signals across identity, email, and endpoint security systems. Investigated in isolation, they might not warrant much attention, but when correlated, they can reveal an attacker operating within the environment.
Many organizations have already invested heavily in Microsoft Defender, Entra, Sentinel, and other security technologies. The capabilities are often there, but that doesn’t automatically mean the right signals are being collected, correlated, investigated, and acted upon.
And even when suspicious activity is detected, there’s still the question of who’s available to investigate and respond, particularly outside normal business hours.
We also focus on continuously improving detections, configurations, and security controls based on what we’re observing, rather than simply closing alerts and moving on to the next one.
As Cybersecurity Awareness Month continues, I’d encourage organizations to look beyond how they’re preventing attacks and evaluate how effectively they can recognize and respond when prevention doesn’t work.
After all, detecting suspicious activity is only part of the equation. What ultimately counts is whether someone can recognize the threat, understand what’s happening, and take action before it becomes a more significant incident.
Original publication
Original LinkedIn post ↗Original writing supplied by the author. Feed cards, repeated article announcements, and provider promotion have been removed. Consult current primary documentation before acting on historical technical guidance.