Malware: Trojan Dropper Masquerading as PDF Utility

Defender quarantined dropper signed with revoked cert before execution. No C2 observed.

• 30/72 VT engines (strong malicious consensus)
• RED ROOT LTD cert (known malicious signer)
• Estate-wide hash hunt: single endpoint

Phishing: LOTS Platform Abuse with KYC Lure

Threat actor abused legitimate SaaS doc platform to target two named employees.

• Legitimate sender domain (LOTS pattern)
• Per-recipient tracking tokens embedded
• RF Score 15 on attacker infrastructure

OAuth Consent: Persistent Mailbox Access Granted

User granted Mail.Read + Offline_access to third-party AI app. MFA-bypassing refresh token created.

• Offline_access = MFA-bypassing refresh token
• Consent IP confirmed as Microsoft OAuth infra
• Tenant-wide consent audit triggered

Ransomware Precursor Detection: Pre-Encryption Kill Chain

Identifying the 4-phase pre-encryption operational pattern: discovery, credential harvesting, staging, and inhibit recovery.

Identity Analytical Pivots: Session & Token Integrity

Beyond simple MFA verification. Auditing Token Theft (AitM) and Session Authority through orthogonal telemetry pivots.

Sentinel Workspace Hygiene & Ingestion Cost Governance

Auditing table-level ingestion volumes, identifying verbose data sources, and implementing transformation-based cost controls.