Detecting Long Dwell Intrusions Inside Financial Networks

By Joseph Caruso, Founder, CEO and CTO, Global Digital Forensics

The Danger of the Patient Adversary Living Off the Land

The most destructive financial breaches and corporate extortion events are rarely smash and grab attacks. Skilled adversaries routinely spend weeks or months quietly observing an environment after gaining initial access. Instead of dropping noisy malware that triggers standard antivirus alerts, they live off the land using legitimate system administration tools like PowerShell, Windows Management Instrumentation, remote desktop protocols and authorized cloud sync utilities. They study executive calendars, read controller email threads to learn when a major acquisition wire or vendor payment is scheduled, and strike at the exact moment key personnel are traveling or unavailable.

Proactive Compromise Assessments and Deep Artifact Hunting

When internal security teams notice subtle anomalies, such as an unexplained administrative login after hours, a brief spike in outbound cloud traffic or a customer reporting a suspicious invoice, waiting for a commercial antivirus alert can be fatal. Global Digital Forensics performs deep technical compromise assessments and forensic telemetry analysis in support of corporate IT security leaders, internal audit and legal counsel. Our examiners hunt across endpoint event logs, registry persistence keys, scheduled tasks, Active Directory Kerberos ticket anomalies and cloud unified audit trails to uncover and evict stealthy intruders before they can execute their payload.

Dwell Time Is a Retention Problem Before It Is a Detection Problem

Hunting for a patient adversary starts with an honest inventory of what the environment still remembers. Windows security event logs roll over on size, so a busy domain controller may hold only days of logon events unless they are forwarded. Entra sign in logs expire within weeks under many licenses, as Microsoft's data retention page documents, and the Microsoft 365 unified audit log defaults to 180 days under standard licensing according to the audit retention documentation. Firewall and VPN logs are often kept shortest of all. If the intrusion began before these windows, the first weeks of the attacker's presence survive only in artifacts the operating system keeps for its own purposes.

Those artifacts are where a compromise assessment does its real work. Prefetch files, the Amcache and the ShimCache record that a program ran on a host long after the event log that would have shown who ran it has rolled over. The master file table and the USN change journal show files created and renamed. PowerShell operational logs and script block logging capture the commands an attacker typed if logging was enabled, and their absence is itself a finding. Scheduled tasks, services, WMI event subscriptions and run keys show persistence. What this layer establishes is that a tool existed and executed on a particular host at a particular time. The report keeps the activity the record shows separate from questions of intent and operator identity, so counsel argues from exactly what the record carries.

Cloud tenants add their own layer. Mailbox rules created by the intruder persist until someone removes them, OAuth application grants persist across password changes, and the audit entries for both are among the records that survive longest when audit retention has been extended. For an intrusion aimed at a payment, the executive and controller mailboxes are where the attacker spent the most time, and the mailbox audit records of items read and searched are what show how the attacker learned the payment schedule. Our Microsoft 365 forensics practice and business email compromise analysis team handle that layer alongside the endpoint work, because the two records corroborate each other and a timeline built from one alone is easy to attack.

Running a Compromise Assessment Without Alerting the Intruder

The engagement begins with scoping under the direction of counsel where notification or litigation may follow, so the findings are prepared with that use in mind. Scoping identifies crown jewel systems, the identity platform, the payment workflow and the telemetry already available, and it sets a rule that nothing is changed on production systems until the extent of the intrusion is understood. Acquisition then collects endpoint triage data, memory from key hosts, domain controller logs, cloud audit exports and network flow records in a way that looks like routine administration, because an attacker who sees a response forming will either accelerate the theft or wipe the tracks. Our incident response retainer clients have this acquisition path agreed in advance so no one is negotiating access at two in the morning.

Analysis is hypothesis driven. We start from the anomaly that prompted the call, an after hours administrative login or a customer's report of a strange invoice, and work outward to the accounts, hosts and sessions connected to it, then test each lead against the artifacts described above. Kerberos ticket anomalies, service account logons from workstations, new OAuth consents and mailbox rules hidden on executive accounts are the usual threads. The output of this phase is a scoped list of compromised identities and hosts with the first and last evidence of attacker activity on each, which is what the eviction plan and the notification analysis both depend on. Our network forensics practice supports this with flow and packet analysis where the environment captured it.

Eviction and validation come last and run together. Credentials are rotated, tokens revoked, persistence removed and controls tightened in a single coordinated window rather than piecemeal, because a partial eviction tells the intruder exactly what was found and what was missed. Validation monitors for a return and confirms that the indicators are gone from every host on the list. The report documents each phase so the board, the insurer and any regulator can see what was known, when it was known, and what was done about it, which is the record that decides whether the response is judged reasonable.

Standards and Statutes Behind the Incident Record

NIST Special Publication 800-61 Revision 3, published as Incident Response Recommendations and Considerations for Cybersecurity Risk Management, frames incident response as part of a continuous risk management cycle organized around the Cybersecurity Framework functions rather than a standalone procedure that begins when an alarm sounds. For a long dwell intrusion that framing matters, because the governance and identification work done before the incident, such as asset inventories, log retention decisions and defined roles, determines whether the response phase has anything to work with. The companion forensic guide, SP 800-86, describes the collection, examination, analysis and reporting sequence our examiners follow so the technical work can be explained and repeated by someone else.

Where the intrusion leads to a referral or a civil action, the federal computer fraud statute at 18 U.S.C. 1030 reaches whoever "intentionally accesses a computer without authorization or exceeds authorized access," and the artifacts above are the evidence of access, the systems reached and the period involved. Counsel decides whether and when law enforcement is contacted and what is disclosed to whom, including the insurer and any regulator with jurisdiction over the institution. Our role is to make sure the record supports whatever position counsel takes and to say clearly where it does not, because a report that overreaches is worth less than one that stops at the evidence.

The Mistakes That Hand the Intruder Another Month

Rebooting or reimaging a suspect host is the most common error, and it destroys memory resident tools and volatile network state that may be the only evidence of how the attacker moved. A mass password reset ordered before scoping is complete alerts the intruder and often misses the service accounts and OAuth tokens that actually sustain the access. Discussing the response in the same email system the attacker is reading hands over the response plan. Trusting a clean antivirus scan as proof of a clean network ignores that living off the land leaves nothing for signatures to match. Each of these feels like decisive action and each extends the dwell time.

Avoiding them requires only a short written rule that nothing is changed, rebooted or announced until an examiner has scoped the intrusion, plus an out of band channel for the response team. Preserving memory and triage data from suspect hosts takes less time than a reimage. The ransomware and data breach analysis page describes what the first hours look like when a hidden intruder is confirmed, and our guide to preserving evidence during incident response gives the security team the collection order to follow before we arrive. Our hotline at (800) 868-8189 answers 24/7 for exactly this situation.

Verify That Your Network Is Free of Hidden Persistence

If you suspect unauthorized dwell activity inside your environment, call Global Digital Forensics 24/7 at (800) 868-8189 for an immediate technical assessment. Our ransomware and data breach analysis page explains what the first hours look like when a hidden intruder is confirmed.

Long Dwell Indicators and the Artifact That Shows Each

The guide treats dwell time as a retention problem before it is a detection problem, with the first weeks surviving only in artifacts the operating system keeps for itself. This table pairs the indicator of a patient intrusion with the artifact that records it and what that artifact can establish, so a security lead can hunt where the record still remembers. Read it as the threads a compromise assessment pulls. An execution artifact shows a tool ran on a host at a time, not the intent or the identity of the operator.

The internal corporate fraud case study shows how missing logs from recently changed systems limited the historical record, the retention problem this guide treats as the first obstacle to hunting a patient intruder.

How to Begin and What Happens on the First Call

Have the anomaly that prompted the call with its timestamp and source, a list of the systems that handle payments and the identities that can approve them, the licensing tier of your identity platform and cloud tenant, and the names of anyone who has already touched the suspect hosts. The examiner will ask what has been rebooted, reset or announced since the anomaly, whether logs are forwarded anywhere outside the platform, whether counsel and the insurer are aware and whether an out of band channel exists for the response team. You receive a written scope, a timing estimate for acquisition and analysis and a proposal. The initial consultation is free. Call (800) 868-8189 at any hour.

Technical References and Further Reading

Related GDF pages for this work: cyber security solutions and penetration testing plans.

The original article pointed readers to The New York Times reported. Those references are kept for the record.

Authorities cited in this guide: NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management. Frames incident response within the Cybersecurity Framework 2.0 functions, final publication from NIST CSRC. NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response. Describes the collection, examination, analysis and reporting phases of forensic work, final publication from NIST CSRC. Microsoft Entra data retention for reports and logs. States sign in and audit log retention by license tier, Microsoft Learn as read in October 2026. 18 U.S.C. 1030, Fraud and related activity in connection with computers. Federal statute reaching unauthorized access to computers, Cornell LII text of the United States Code.