Kill Chain — Execution Agent Response

When this fires: execution_agent detected malicious process execution — LOLBin launched from Office/browser, known offensive tool (mimikatz, cobalt, meterpreter, procdump), process executing from user-writable path (Temp/AppData/Downloads), or PowerShell download cradle (EventID 4104).

Severity: CRITICAL — this finding goes directly to OPEN, bypassing the analyst queue. Telegram notification is immediate.

MITRE: T1059 (Command and Scripting Interpreter), T1204 (User Execution), T1218 (Signed Binary Proxy Execution)

---

Immediate Triage — Within 5 Minutes

1. Open the SecOps finding. Note: host, account, process name, parent process, command line, timestamp
2. Determine the detection subtype from the description:
   • offensive_tool_detected — mimikatz, cobalt, meterpreter, procdump in process or command line → immediate isolation
   • lolbin_execution — LOLBin from Office or browser parent → high confidence phishing, isolate
   • suspicious_path_execution — process from Temp/AppData/Downloads → investigate before isolating
   • powershell_download_cradle — IEX, DownloadString, or base64 in script block → investigate and likely isolate
3. Check Cortex XDR console https://ciriusgroup.xdr.us.paloaltonetworks.com → Incidents — is Cortex showing a related incident for this host?
4. If Cortex is silent while execution agent is firing: escalate concurrently using runbooks/edr-silence-escalation.md
5. Check whether this host has other kill chain findings in the same SecOps incident window

---

Containment Decision — Within 15 Minutes

Detection Type	Action
offensive_tool_detected	Isolate immediately — no investigation needed first
lolbin_execution	Isolate immediately — phishing chain is high confidence
suspicious_path_execution	Investigate process hash before isolating
powershell_download_cradle	Review script block content — isolate if payload confirmed

Isolation via Cortex XDR:

• Console → Endpoints → [host] → Actions → Isolate
• Network isolation preserves the management channel (Cortex) while blocking all other traffic

Isolation via Arctic Wolf:

• Arctic Wolf MDR has authorization to act without approval for containment
• Contact via Arctic Wolf portal or hotline — they can isolate independently

---

Investigation KQL

// All process creation and PowerShell on this host in the last 4 hours
SecurityEvent
| where TimeGenerated > ago(4h)
| where Computer has "<hostname>"
| where EventID in (4688, 4104)
| project TimeGenerated, EventID, Account, NewProcessName, ParentProcessName,
    CommandLine, ScriptBlockText, SubjectUserName
| order by TimeGenerated desc

// Did this host make outbound connections after the execution event?
CommonSecurityLog
| where TimeGenerated > ago(4h)
| where DeviceVendor == "Palo Alto Networks"
| where SourceIP == "<host_ip>"
| project TimeGenerated, DestinationIP, DestinationPort, SentBytes, ApplicationProtocol
| order by TimeGenerated desc

// Did this account attempt lateral movement after execution?
SecurityEvent
| where TimeGenerated > ago(4h)
| where EventID == 4648
| where SubjectUserName == "<account>" or TargetUserName == "<account>"
| extend SourceHost = toupper(tostring(split(Computer, ".")[0]))
| project TimeGenerated, SourceHost, TargetServerName, SubjectUserName, TargetUserName

---

Evidence Preservation

Before isolating (if time allows):

1. Export the SecOps finding
2. Screenshot the Cortex Causality View for the alert (Cortex → Alert → View in Causality)
3. Export relevant LAW query results to a file
4. Snapshot the VM disk if it is an Azure VM: az snapshot create --resource-group <rg> --name forensic-$(date +%Y%m%d) --source <disk-id>

Do not shut down the VM before capturing memory if a memory dump is needed — memory is lost on shutdown.

---

HIPAA Breach Assessment

Check whether ePHI was on the affected host:

• Is this host in Azure PROD or DDE (ePHI environments)?
• Does the host have access to psql-secops-prod or other PHI databases?
• Was the execution event by an account with ePHI data access?

If yes to any: initiate the 4-factor breach risk assessment per compliance/hipaa-breach-notification-procedure.md. Do this in parallel with containment — do not wait until the incident is resolved.

---

Escalation

• Rory — immediately via Telegram (CRITICAL finding sends automatic Telegram notification)
• Arctic Wolf — for independent containment and forensic support

---

Post-Incident Checklist

• [ ] Host isolated or confirmed clean
• [ ] Affected account credentials rotated, sessions revoked
• [ ] Initial access vector identified (phishing? RDP? VPN compromise?)
• [ ] HIPAA breach assessment completed
• [ ] Affected host reimaged or confirmed clean by Arctic Wolf before returning to service
• [ ] Lessons learned documented in SecOps incident
• [ ] Known-good rule added if this was a false positive (e.g., legitimate IT tool flagged)

---

Related Documents

• runbooks/incident-response.md — full IR plan
• runbooks/edr-silence-escalation.md — if Cortex is silent
• runbooks/kill-chain-credential-dumping-response.md — credentials likely compromised after execution
• runbooks/kill-chain-lateral-movement-response.md — execution often precedes lateral movement
• compliance/hipaa-breach-notification-procedure.md — if ePHI host involved