Live Operations

Active incidents · sorted by severity and SLA clock
Active (12)
Resolved (2)
0 Critical
2 High
1 Medium
0 Unclaimed
0 SLA breached
CLIENT AllAcme
CRITICALAcmeINC-ACME-0015just now
Shadow copies deleted on finance server — vssadmin delete shadows /all
UnclaimedON TRACK
HIGHAcmeINC-ACME-00042h ago
Mimikatz LSASS credential dump — sekurlsa::logonpasswords
▶ InvestigatingD. ReyesON TRACK
HIGHAcmeINC-ACME-00065h ago
K8s API server access from compromised pod — privilege escalation to cluster-admin
● ClaimedA. HorvatON TRACK
MEDIUMAcmeINC-ACME-00111d ago
Impossible travel — console sign-ins from two countries within 40 minutes
● ClaimedJ. ParkON TRACK
LOWAcmeINC-ACME-00144d ago
Outdated TLS 1.0 negotiation detected on fleet management API
● ClaimedD. ReyesON TRACK
CRITICALAcmeINC-ACME-0015

Shadow copies deleted on finance server — vssadmin delete shadows /all

Host
acme-fin-srv-02
Account
svc_backup
Technique
T1490 Inhibit recovery
Detected
Thu 14:12 UTC
What we already know about this host
Known-goodThe backup agent runs vssadmin here on Tuesdays at 02:00. This is Thursday afternoon, from a shell.
Change logMoved to the new finance VLAN on 3 Sep. No change to backup policy was recorded.
Asset noteTier-1 server. Holds month-end close data for the finance team.
Outside every known pattern for this host. Treat as hostile.
MKClaimed by M. Kovač
14:12Alert raised by detection rule DLX-WIN-0417
14:13Claimed by M. Kovač
14:14acme-fin-srv-02 isolated from the network
acme-fin-srv-02 isolated. Business traffic to backup vault preserved.

Threat Hunting

Hypothesis-driven · full event stream
Hunt hypothesis
What are you looking for and why?
SimpleAdvanced
Event type
PROCESS_EXEC
Time range
Last 24 hours
Hostname (optional)
acme-*
Field filter (optional)
field
value
Configure a hunt on the left and run it.
Searching 7 days of process events across Acme…
3 matches on 2 hostsOne matches a known-good pattern. One is new.
Time (UTC)HostCommandParentContext
Thu 14:11:52acme-fin-srv-02vssadmin delete shadows /all /quietcmd.exeINC-ACME-0015
Thu 13:58:07acme-hr-ws-17vssadmin delete shadows /all /quietrundll32.exeNew host
Tue 02:00:03acme-fin-srv-02vssadmin create shadow /for=C:backupagent.exeKnown-good
Hunt saved to the Acme knowledge graph
acme-hr-ws-17 added to INC-ACME-0015 and isolated.
 
DARKLYNX LABS
Monitored is a commodity.
Known is the product.
DARKLYNX LABS