A caller says the 02:00 credential-theft alert on your domain controller is red-team activity. How do you verify it?

## The situation 02:00. An endpoint detection alert on a domain controller shows a memory dump being taken of a privileged process. Automated containment has already isolated the host and two others, the on-call engineer whose server went dark is on the phone, and the external incident-response retainer is about to be dialled — a call whose clock, and whose bill, start when it connects. Then someone rings the SOC and says: it's fine, that's the red team. **Nothing changes yet.** A claim of authorisation is a technique in its own right, and it is the cheapest one available to an intruder who has just been caught. Everything below is about converting a claim into an attribution. ## Root the callback in something you trusted first - **Call back**, always, on a number recorded before the exercise — in the SOC runbook, in the escalation sheet — and never on a number the caller offers. - **Check with the client side, not only the red side.** The sponsor or trusted agent confirms an exercise is genuinely running. The operators confirm the specific activity. One of those alone is a single point of failure; an intruder who knows a test is scheduled can pose as an operator, and a persuasive caller can invent an engagement. - **Ask, do not tell.** The defender's half of the call is questions. If you read out the command line and the caller agrees with it, you have learned nothing. ## Ask for the details only the operator can hold A useful attribution is specific to the activity in front of you: which host, which minute, which process and command line, which account, which source address, and what they did immediately before and after. "We're testing this week" attributes nothing — it is true for an intruder inside the same window, too. ## What the record in front of you can and cannot settle The process-create record above carries the host, the launch time, the image and its parent, the full command line, the account context and file hashes. What it does **not** carry is any remote address: a process-create event describes something that happened on that machine, so there is nothing in it to compare with the operator ranges in the authorisation letter. To get a source you have to go to telemetry that records one — the logon that created that session (a Windows Security 4624 success carries a logon type and a source network address; type 3 is a network logon and type 10 a remote interactive one), the network connection events from the same process, or the firewall and flow records around that minute. This is the general lesson: **the field you want to verify against is often in a different data source from the field that alerted**, and knowing which source carries a remote address, a parent process or a command line is what makes a 02:00 verification possible at all. ## What stays running while you verify - **Containment stays.** Releasing a host on an unverified claim is the whole reason the claim gets made. Reversing a stand-down later is cheap; recalling a released intruder is not. - **Evidence keeps being collected.** Volatile state disappears while you are on the phone. Nothing about a pending claim justifies losing memory or a process listing you cannot get back. - **The retainer call is a judgment, not an automatism.** If verification looks minutes away, holding the call briefly is defensible; if it does not, mobilise. The cost of an unnecessary callout is money, and the cost of a delayed one is dwell time. ## Deconfliction is per-activity, not per-incident The most common mistake after a successful callback is closing the whole case. Operators account for what their log contains. If your investigation touched five hosts and they account for two, the other three are **unattributed activity** and remain a live investigation. A genuine intruder operating inside an exercise window is not a hypothetical: it is the specific scenario the whole authorisation-and-deconfliction arrangement exists to survive. ## Close it honestly When the attribution is specific and confirmed from both sides, the case closes as authorised activity — with the deconfliction call recorded in it: who called whom, on which number, at what time, which host-and-timestamp pairs were attributed and which were not. Then say the true thing about the night: the telemetry arrived, the rule fired, the analyst worked it correctly and the response landed. The exercise has produced a genuine result, and the only thing wrong with the night was that the actor was authorised. Do not let anyone respond to it by tuning the detection away — and record the real costs (isolated hosts, an engineer's shift, a near-miss retainer call) as findings about how expensive a correct response is, which is exactly the sort of thing the exercise was commissioned to reveal.