🚨 SOC Story: The Alert Nobody Wanted to Investigate

Let me tell you about the alert that changed the way I approach triage.

It was a Tuesday night shift. The queue had 47 open alerts and this one kept getting pushed to the bottom. It looked boring. Severity: Low. Rule: "Repeated failed login attempts — internal host." Same thing that fires a hundred times a week across the environment. Most of them are users who forget their passwords after a long weekend.

So it sat there. For six hours.

When I finally opened it, something felt off.

The failed logins weren’t from a user workstation. They were coming from a server in the DMZ — a web application server that had no business authenticating against internal Active Directory accounts. And the account it was hammering? A service account. Not a user. Service accounts don’t forget their passwords.

I pulled the raw logs. 847 failed attempts in 40 minutes against 12 different service accounts. Methodical. Sequential. Not random. This wasn’t a lockout. This was credential stuffing — someone had foothold on that web server and was quietly trying to move laterally into the domain.

We isolated the server within the hour. Forensics found a PHP webshell that had been sitting there for 11 days.

ELEVEN DAYS.

The initial access had flown completely under the radar. What tipped us off wasn’t a flashy alert — it was a boring, low-severity, easy-to-skip log that one tired analyst almost ignored for an entire shift.

💡 THE LESSONS I TOOK FROM THIS:

✅ Low severity ≠ low importance. Context is everything. Always ask: does this behaviour make sense for this asset?

✅ Know your environment. That alert only stood out because I knew DMZ servers shouldn’t be touching AD auth. Asset knowledge is a superpower.

✅ Service accounts behaving like users is always suspicious. They don’t fat-finger passwords.

✅ Alert fatigue is a real threat. If your queue is so full that low-severity alerts sit for 6 hours, your detection strategy needs review — not just your analysts.

✅ The attacker’s best friend is the alert nobody investigates. Don’t give them that gift.

Have you ever caught something big hiding in a boring alert? Drop your story below — I’d love to hear it.

—

@Aussie Mr Cyber

1 comment