My system was breached: what to do in the first minutes of unauthorized access

Primeiros passos — o que fazer agora

1. 1

   Isolate without destroying (containment)

   Disconnect the compromised machine from the network (remove the cable, disable the interface or block it at the firewall/security group), but do NOT shut down or reboot. Isolating interrupts the intruder's access; shutting down erases memory, processes and evidence that point to the root cause.

2. 2

   Revoke all sessions and active access

   Force a global logout for all users (invalidate tokens and refresh tokens), terminate VPN, RDP, SSH and admin panel sessions. Revoke cloud access keys (AWS/GCP/Azure) and disable suspicious accounts instead of just changing the password, because changing a password does not drop an already open session.

3. 3

   Rotate secrets, keys and tokens

   Change the passwords of privileged access, generate new API keys, rotate SSH keys, application secrets, webhook tokens and database credentials. Consider compromised everything that was accessible to the breached machine, including secrets in environment variables and config files.

4. 4

   Preserve the evidence

   Before any cleanup, save copies of the logs (system, application, authentication, firewall, CloudTrail), a disk image and, if possible, a memory dump of the affected machine. Note the date, time and who detected what. This chain of custody supports the forensics and the notification to the ANPD.

5. 5

   Hunt for persistence and ghost accounts

   Look for new users (especially admin), added SSH keys, unknown scheduled tasks (cron/Task Scheduler), recently created services, webshells in web directories and altered firewall/security rules. These are the mechanisms through which the intruder returns even after you change the passwords.

6. 6

   Enable MFA and close the entry vector

   Enable multi-factor authentication on all privileged and remote access. Identify and close the entry door (exposed VPN, leaked credential, unpatched service, public admin panel) before putting systems back into production, or the breach repeats.

7. 7

   Engage Decripte's 24/7 Incident Response

   Through /contato you reach Decripte's incident response team (24x7 SOC, containment within 1 hour). We lead containment, threat hunting for lateral movement, eradication of persistence and root-cause forensics, and we guide the legal obligations toward the ANPD and the data subjects.

8. 8

   Assess the legal duty to notify

   If the incident involves personal data and may generate relevant risk or harm to data subjects, notification to the ANPD must occur within 3 business days from awareness (Resolution CD/ANPD No. 15/2024), with notice also to the affected data subjects. Record internally the time you became aware, as the deadline counts from there. If there is Pix fraud, contact the bank right away to trigger the MED.

The first 60 minutes: containment without destroying the evidence

The instinct of whoever discovers an intruder is to shut everything down. Resist it. Shutting down a compromised machine erases RAM (where the attacker's processes, keys in use and active connections live) and often triggers cleanup mechanisms. The goal of the first hour is to cut off the intruder's access while preserving what they touched. In practice this means isolating the machine from the network at the firewall or security-group level, instead of shutting it down.

In parallel, terminate what grants live access: force a global logout, invalidate tokens and refresh tokens, drop VPN, RDP and SSH sessions and disable suspicious accounts. Changing a password alone does not kill an already open session, which is why session revocation comes first. In cloud environments, revoke access keys and rotate the API credentials the compromised machine could have read.

Document each action with a timestamp. This record becomes both the basis of the forensics and the proof of diligence for the ANPD. If the operation is critical and you do not have an on-call response team, this is exactly when it makes sense to engage Decripte's 24/7 Incident Response through /contato: coordinated containment within 1 hour, without burning the evidence that will still tell you how it all started.

Hunting for persistence: why changing the password is not enough

An experienced attacker, the moment they gain access, plants ways to return. The most common ones: creating a new user (preferably with administrative privilege), adding their own public key to the authorized_keys of a legitimate account, installing a scheduled task that reopens a reverse connection, uploading a webshell to a directory served by the web application, or altering a firewall rule to open a return port. Each of these survives a password change.

Eradicating requires systematically scanning these points: enumerate privileged users and groups and compare with what should exist, audit SSH keys, list cron/systemd timers/Task Scheduler, review recently created services, comb web directories for files with suspicious modification dates and review network and email rules (automatic forwarding is a classic sign of mailbox compromise).

It is threat-hunting work, not a superficial checklist. Eradication only ends when you are confident you have removed all the return mechanisms and closed the original entry vector. Putting systems back into production before that is the mistake that turns an incident into a recurrence.

Lateral movement and root cause: from the entry point to the real reach

The question that defines the size of the incident is not where the intruder is, but how far they reached. From the first host, attackers move laterally using captured credentials, reused sessions and trust relationships between machines. Mapping that movement means correlating authentication logs, internal connections, database access and identity systems to reconstruct the timeline: when they got in, what they accessed, what they copied.

In parallel runs the root-cause forensics, which answers how the intruder got in. The typical entry doors are leaked or reused credentials, an internet-exposed service without patches, a public administrative panel, phishing that captured a session, or an API key exposed in a repository. Closing the vector is what prevents the next breach, and discovering the vector is what tells whether there was exposure of personal data and, therefore, a duty to notify.

This is the point where forensics becomes a business and legal decision. If the analysis indicates access to personal data with relevant risk to data subjects, it triggers the deadline to notify the ANPD of up to 3 business days from awareness, with notice to the affected data subjects. Decripte's team leads that investigation and translates the technical finding into a clear recommendation about what to communicate, to whom and when.

How Decripte leads eradication and threat hunting

Decripte's incident response follows the consolidated cycle of detection and analysis, containment, eradication, recovery and lessons learned. In practice, the team steps in doing coordinated containment with your team (isolation, session revocation and secret rotation), while preserving disk images and logs for the forensics. The SOC operates 24x7 and the containment commitment is up to 1 hour, because in an active breach every hour widens the attacker's reach.

The threat-hunting phase looks for what automated tools do not see: hijacked legitimate accounts, subtle persistence, outbound beacons and lateral movement. Eradication removes all the return points and closes the entry vector, and recovery only releases the systems after validating that the environment is clean. In the end, you receive the root cause, the timeline and the recommendations to close the gaps that allowed the breach.

Engagement is direct through /contato, at any hour. The sooner preserved evidence and correct containment step in, the smaller the damage and the more defensible your position before customers, partners and the regulator.

After containing: discover your exposure before the next attack

A large share of breaches starts outside your perimeter: a corporate credential leaked in a dump, an access for sale on a forum, a domain being used for phishing against your customers. You do not see this through internal logs, and it is precisely that blind spot that becomes the entry vector next time. Continuously monitoring that external surface is what turns response into prevention.

That is why Decripte offers a free Threat Management plan, the Decripte Intelligence Center (DIC), at decripte.com.br/intelligence-center. It monitors credential leaks, dark web exposure and your domain's reputation, with no credit card and requiring no technical team. After going through an incident, enabling it is the logical step to know what is already exposed and be warned before it becomes the next strange login at three in the morning.

For those who need continuous operational protection, the paid plans cover 24x7 SOC, contracted Incident Response, pentest, vulnerability management and compliance (LGPD and ISO 27001). The logic is simple: the free plan shows your exposure, incident response puts out the fire, and the continuous program prevents it from starting again.

Termos importantes

Persistence

The set of mechanisms an intruder plants to regain access even after you change passwords: new users, added SSH keys, scheduled tasks, webshells and services or firewall rules created by them.

Lateral movement

The technique by which the attacker, from the first compromised host, advances to other machines and systems using captured credentials and internal trust relationships, widening the reach of the incident.

Webshell

A malicious script placed in a directory served by the web application that lets the intruder execute commands on the server remotely through the browser, acting as a discreet back door.

Secret rotation

The replacement of all credentials the intruder may have accessed: privileged passwords, API keys, SSH keys, application secrets and tokens. Everything within reach of the compromised machine must be considered leaked.

Threat hunting

The active, targeted search for signs of compromise that automated tools do not detect, such as hijacked legitimate accounts, subtle persistence and the attacker's hidden communication channels.

MED (Special Return Mechanism)

A Pix feature that allows the bank to block and return funds in cases of fraud or operational failure. It has a short trigger window, which is why contact with the bank must be immediate after detecting the fraudulent transaction.

Perguntas frequentes