SOC Service

1. Resource Development
   Credential obtained
   T1589.001 · Gather Victim Identity Information: Credentials

   Infostealer malware on an unmanaged personal device harvests a saved corporate password. It reaches a stealer log days later - nothing in the customer's own estate was touched, so nothing in the customer's own estate could have noticed.

   Detected · ReconX Identity
2. Credential Access
   Password tried at scale
   T1110.004 · Brute Force: Credential Stuffing

   Repeated sign-in attempts against that same account from several countries within hours. Taken alone this is the noise every tenant sees daily - which is precisely why it is filtered out of most inboxes.

   Detected · Microsoft Entra ID

3. Chain broken here

   ProDesk correlated both signals onto one identity and one ticket. A leaked password plus live attempts against that same account is no longer ambiguous: someone holds a working credential and is working through MFA. The customer was notified the same day - credential reset, active sessions revoked, MFA methods reviewed. Everything below is what the next four stages would have been.

4. Initial Access
   A sign-in finally succeeds
   T1078.004 · Valid Accounts: Cloud Accounts

   One attempt lands. From the logs it is a legitimate user signing in from an unfamiliar city - indistinguishable from travel, and no longer a failed-login alert at all.

   Never reached
5. Persistence
   Attacker enrols their own MFA
   T1556.006 · Modify Authentication Process: Multi-Factor Authentication

   A second factor the attacker controls is added to the account. Access becomes durable and self-service, and survives the password reset that would otherwise have ended it.

   Never reached
6. Defense Evasion
   Mailbox rules hide the activity
   T1564.008 · Hide Artifacts: Email Hiding Rules

   Inbox rules auto-delete or divert replies and security notifications, so the account's real owner never sees the conversations being held in their name.

   Never reached
7. Impact
   Payment redirection
   T1657 · Financial Theft

   Bank details are altered mid-thread on a real invoice conversation, and internal phishing goes out from a trusted mailbox that passes every authentication check. Discovery arrives weeks later, from a supplier asking where their money is.

   Never reached

The specific pair of signals varies; the shape does not. A look-alike domain registered days before a phishing wave. A new exposed service appearing shortly before it is exploited. A supplier's posture degrading right before an invoice-fraud attempt. Any one of them is dismissible. Two of them, on the same entity, in the same week, is a SOC ticket.