All tabletop exercises
DevSecOps / supply chain·Starter·Technical audience
A developer's laptop runs an infostealer and their sessions are replayed
The prompt — read this to the room
Your EDR raises a medium-severity alert on a senior developer's laptop: an unsigned executable launched from the downloads folder, then deleted itself. The developer says they installed a "free licence key generator" for a design tool on Saturday. It is now Monday. Since Saturday, their code-hosting session, their cloud console session and their password manager browser extension have all been used from an IP address in another country, with no multi-factor prompts, because the attacker replayed session cookies. The developer has admin rights on 60 repositories. Where do you start?
Total duration
1 h 15 min
People to involve
5
Best fit
Saas
Who to involve
Most important first.
- Incident response lead
- SOC analyst
- IT operations
- Developer / DevOps
- Cloud engineer
What it tests
- Invalidate stolen sessions everywhere, not only reset the password.
- Scope what was accessed with each stolen session across code, cloud and vaults.
- Handle the device and the developer fairly, without delaying containment.
- Identify controls for session theft: device-bound sessions, admin separation and software installs.
Outline of activities
- 1The alert: from medium severity to a real incident
- 2Kill the sessions: every service, every token
- 3Scope: code, cloud and password vault activity since Saturday
- 4The laptop and the person
- 5Controls against session replay
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…