criticalEDR management console · 20 minutes

Somebody disabled the antivirus on eleven servers

The alert, as it arrived

EDR management console

[02:37:41] TAMPER PROTECTION · Severity: Critical
Real-time protection disabled on 11 endpoints in 4 minutes

  02:33:12  SRV-FILE-02    disabled via local admin
  02:33:51  SRV-FILE-03    disabled via local admin
  02:34:40  SRV-APP-11     disabled via local admin
  ...        (8 further, all servers, none workstations)

  Same window, all 11 hosts:
    Scheduled task created  \Microsoft\Windows\<random 8 char>
    Outbound 443 to a single address, not in any allowlist

Your turn

You have minutes rather than hours. Say what you do first, and what you deliberately do not do.

Write it down before you scroll. The value of this is in committing to an answer you can be wrong about, and reading the breakdown first removes it entirely.

Analyst breakdown

Pro

Unlock the expert breakdown and hunting queries with a Pro membership.

5 steps in order, each with the reasoning and a runnable query, plus the trap most responders fall into on this one and what the incident actually turns out to be. The scenario above stays free and complete: work it first, and the breakdown is worth more.

See what is included Sign in