24x7 managed detection and response for a manufacturer: credential dumping on a file server caught overnight and isolated in minutes

A manufacturer of about 200 people with two plants had one IT generalist who went home at five and a console of alerts that nobody read overnight. Its cyber insurer asked who would see an intruder at 2 a.m. The client is not named on this page. This is an illustrative engagement that describes the kind of work our team does; details are composite.

We started with coverage. Endpoint detection and response went onto every workstation and server, tuned so plant systems were left undisturbed, and logs from Microsoft 365, Entra ID, firewalls and domain controllers flowed into one monitored pipeline. A team watches that pipeline 24 hours a day, 7 days a week, and investigates alerts instead of forwarding them.

Before go-live we agreed written rules with the manufacturer: which actions our analysts take at once, such as isolating a server from the network, and which wait for a phone call. A file server is the kind of system that case is made for, because it holds data that attackers want and many people depend on it.

The overnight event was a detection of credential dumping, where a process reads the memory of the Windows security subsystem to collect passwords. It is a common step before an attacker moves from one machine to the rest of a network. In this illustrative case the alert fired, an analyst confirmed it and the server was isolated within minutes. The exposed accounts were disabled and their passwords reset, and nothing was encrypted.

By the start of the day the plant manager had a morning report: the timeline, what the attacker touched, what was contained and the hardening that followed, including how the attacker got in and the detection rule we kept. Times here are illustrative. Monitoring shortens the time an intruder has; it does not promise that none gets in.