⌘K
Dashboard
Incidents3
Threat Queue8
Investigations
Threats
Vulnerabilities
Assets
Endpoints
Network Monitoring
Firewall Rules
Log Analysis
Analyst Notes
Remediation & Orders
Messages
Reports
Analysts
Access Control
Settings
Login
Register
Forgot Password
Reset Password
2 Step Verification
Lock Screen
404 Error
500 Error
Lateral Movement Review
OpenINV-1001 · Opened 10 Jul 2026
Critical Priority
Subnet 10.20.0.0/16
24
Evidence Items09
IOCs03
Days Open02
Linked IncidentsInvestigation Timeline
6 StepsCase Opened
Alert triaged from SIEM correlation rule "SMB pivot".
10 Jul 2026, 08:12Scope Assessment
Identified 4 affected hosts across the finance VLAN.
10 Jul 2026, 09:40Log Collection
Pulled EDR and firewall logs for the last 72 hours.
10 Jul 2026, 11:05Malicious Tooling Found
Detected PsExec and Mimikatz artifacts on WKS-2043.
11 Jul 2026, 14:22Containment Applied
Isolated affected endpoints and rotated credentials.
12 Jul 2026, 10:15Analysis In Progress
Building root-cause timeline for final report.
12 Jul 2026, 16:48Evidence
Add| Artifact | Type | Source Host | Collected | Status |
|---|---|---|---|---|
mimikatz.exe |
Binary | WKS-2043 | 11 Jul 2026 | Malicious |
security.evtx |
Event Log | DC-01 | 10 Jul 2026 | Reviewing |
pcap-072026.pcap |
Network Capture | FW-EDGE-02 | 10 Jul 2026 | Analyzed |
memory.dmp |
Memory Image | WKS-2043 | 11 Jul 2026 | Queued |
Case Details
- Case IDINV-1001
- PriorityCritical
- StatusOpen
- CategoryLateral Movement
- Opened10 Jul 2026
- Linked IncidentsINC-2043, INC-2044
Collaborators
5
+1
Esther Schmidt, Valerie Padgett, Michael Smith and 2 others are assigned to this case.