Walkthrough
Nothing in this attack was malware.
Every step used a binary that ships with the operating system, run by an account that was allowed to run it. That is why it produced forty-seven alerts and no incident. Here is the same campaign read correctly.
The campaign
Five stages, eleven days, no exploit.
This is the shape of a living-off-the-land intrusion. Select any stage to see what the adversary did and why nothing paged anyone.
Your stack
Forty-seven alerts. Four tools. Not one of them wrong.
Each tool saw its own slice and judged it correctly in isolation. No individual verdict here is a mistake. The campaign is the thing none of them were positioned to see, because none of them can see across the others.
- edr14Low
Endpoint detection
Built-in tools, expected parent processes. Scored and shelved.
- idp6Informational
Identity provider
Successful sign-ins by valid accounts. Nothing to raise.
- firewall25Allowed
Firewall
Internal SSH and outbound 443, both permitted by policy.
- siem2Medium
SIEM correlation
Auto-closed inside the hour. The vulnerability scanner produces the same shape weekly.
What Nodal produced
One Ticket, with the path already drawn.
The same events, linked by the behaviour that connects them rather than by the tool that reported them. An analyst opens one thing, and the reconstruction is already done.
10.0.4.17
Workstation · SYSTEM
rundll32 → powershell
10.0.4.62
Internal peer · root
ssh -N -L 0.0.0.0:9443
10.0.9.8
Subnet bridge · unmanaged
no endpoint agent possible
198.51.100.74
External host
C2 · tcp/8443
Investigation verdict
Built-in Windows and Linux tools relay 10.0.4.17 → 10.0.4.62 → 10.0.9.8 out to an external host on tcp/8443. No malware anywhere in the path, and the hop carrying the volume runs no agent.
The response
Cut the channel, protect valid activity.
Conventional containment takes the device off the network, which stops the attack and the work at the same time. Disruption is narrower than that: the command-and-control path is severed at the edge while every internal system stays online, and the action is time-bound and reversible.
The console
Now open it yourself.
This is the Nodal Ghost admin UI, running against the campaign above. Let it walk you through, or take over and click anywhere.
See it live
Bring your own questions.
Thirty minutes with a Nodal engineer, against a real campaign rather than a scripted one. Ask it to do the thing you think it cannot.