Incident Response When Hackers Try To Steal Your Spotlight

The talk follows the traces an attacker leaves after breaking into a server, using a breach at a small beauty retailer as the case study. Its appointment booking site had broken access controls: a logged-in customer could change a predictable role identifier, reach an administrator upload function, and push a shell file to the host. From there the intruder enumerated accounts and environment variables, gained remote access, and moved between machines.

The speaker argues that EDR or XDR consoles should not be the only source of truth, since an attacker with console access can stop the sensor or isolate a host. Forwarding those logs to a SIEM and adding network detection, deception, and forensic collection with Velociraptor provide alternatives. On Linux the useful artifacts include authentication files, shell history, modified hosts or name-resolution files, persistence through cron jobs or services, and oddly named services such as a fake updater. Network clues included bursts of failed logins from many countries and an outbound transfer to a domain the attacker already controlled. An exposed remote management interface on port 9090 was also noted.

The closing checklist covers the controls that would have stopped this chain: server-side authorization checks, restricted upload types, multi-factor authentication, outbound egress filtering, and lateral movement detection. For responders, the advice is to learn what normal activity looks like in your environment, automate log review where possible, test controls before relying on them, and layer defenses rather than trusting one product.