Press CTRL+K to open search

Determine the initial point of compromise

  • Published on Aug 26, 2026
  • 1 minute(s) read
Prev Next

You can find the first foothold an attacker gained in your environment to understand the vulnerability they exploited.

  1. After gathering data related to an incident, sort the grid view by the Event Timestamp column in ascending order (oldest first).

  2. Analyze the earliest logon events. Look for the first suspicious entry, such as:

    • A successful RDP login from an unknown external IP address.

    • A series of failed logons followed by a success for the same account.

    • A logon event associated with a suspicious Path or Process, such as powershell.exe.

Related articles
  • Trace lateral movement
    Endpoint Detection and Response with Forensics (EDRF) > Detect and handle potential threats with EDRF > Configure EDRF to detect potential threats > Threat hunting with advanced detection modules > Detection using Logon Tracker
  • Trace an attacker's path
    Endpoint Detection and Response with Forensics (EDRF) > Investigate potential threats with EDRF > Analyzing forensic data > Analyze forensic data using HX modules > Investigate malicious authentication patterns with Logon Tracker
  • Identify anomalous logon behavior
    Endpoint Detection and Response with Forensics (EDRF) > Detect and handle potential threats with EDRF > Configure EDRF to detect potential threats > Threat hunting with advanced detection modules > Detection using Logon Tracker