Post-Incident Activity (TryHackMe)

Link to the challenge on TryHackMe: Post-Incident Activity

Introduction

Post-Incident Activity closes out the Nexus Financial BEC investigation series, shifting from "what happened during the incident" to the work that comes after: assessing impact for disclosure and reporting purposes, and extracting lessons to harden defenses going forward. With the malicious inbox rule identified and the attacker's file access scoped, this room focuses on two remaining questions that matter for post-incident reporting — whether any personally identifiable information was exposed, and what the login geography tells us about the attacker's origin and whether the access pattern was even plausible for the legitimate user. This writeup covers the queries used to close out those questions and the lessons that came out of the investigation as a whole.

index=ir pii action=downloaded

index=ir location.countryOrRegion

Conclusion:

Post-Incident Activity is a good reminder that incident response doesn't end when the attacker is locked out — it ends when you can answer the questions that regulators, leadership, and future defenders will actually ask: was PII exposed, where did this really come from, and what do we change so it doesn't happen again. Checking for pii action=downloaded events ties directly into breach notification obligations, while the location.countryOrRegion field turns a single suspicious IP into a broader geographic story that either supports or undercuts the "insider mistake" theory. Across all three rooms in this series, the throughline has been the same: BEC investigations are won or lost in the pivots between authentication logs, mailbox activity, and file/data access — and post-incident work is where those pivots get turned into a report someone outside the SOC can actually act on.