Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Observations

What went wrong, and what to do about it

Real breaches, each put through the same four questions: one control that worked, one that did not, one number worth watching, and what should have been done instead. Every entry cites a primary source, because the point of this section is that you can take it to a meeting.

NO. 01/Federal / Government/4 September 2026

The GeoServer nobody patched, and the EDR alert nobody read

CISA Advisory AA25-266ACVE-2024-36401

Threat actors exploited an unpatched, public-facing GeoServer at a US federal civilian agency eleven days after the CVE was disclosed, then used a second unpatched instance thirteen days later. They held the network for three weeks, deploying the Stowaway proxy, China Chopper web shells and reconnaissance tooling before anyone noticed.

What worked

The EDR did its job. It detected and alerted on the Stowaway proxy tool on the first GeoServer on 15 July 2024, the same day the CVE was added to the KEV catalog. The detection engineering was not the failure here; every technical control that was deployed fired correctly.

What failed

Nobody read the alert. EDR alerts were not continuously reviewed, so a correct detection sat unactioned for seventeen days. The second GeoServer and the web server had no endpoint protection at all. When the agency finally responded, its incident response plan had no procedure for bringing in outside help, so granting the IR team SIEM access needed change control board approval while an active intrusion was in progress.

The number

17 days

between the EDR alerting on Stowaway and anyone acting on it.

What to do instead

Treat an unreviewed alert queue as an outage of the control that feeds it. An EDR nobody watches provides evidence after the fact, not defence, and it should be reported to leadership as coverage you do not have rather than coverage you bought. Separately: write the third-party access procedure before you need it, and rehearse it. Discovering mid-incident that your own change control stands between the responders and the logs is a failure of the plan, not of the responders.

Sources

Named for the doctrine distinction between a lesson observed and a lesson learned: a lesson is not learned until behaviour has changed and somebody has checked. Pretending otherwise is how the same finding turns up in three consecutive post-incident reports.