Anatomy of a Cyberattack | BAE Networks + Huntress
How One Click Becomes a Security Incident
A convincing email. A familiar sign-in page. A successful login. Everything looks normal, until it isn't.
In the time it takes to open an email and sign in, an employee could unknowingly give an attacker access to the organization's environment. And, once that happens, the challenge isn't just stopping the attack. It's figuring out what happened, what the attacker accessed, and whether anything else is at risk.
So, what does a cyberattack actually look like as it unfolds?
In our Anatomy of a Cyberattack webinar, BAE Networks and Huntress walked through a fictional attack scenario to demonstrate how a routine-looking email can lead to a security incident, and how security teams connect the clues to investigate and respond.
Let's walk through the scenario:
Note: This scenario is fictional and educational, based on real-world attack patterns. The names, organization, events, and timeline are illustrative; actual incidents can unfold differently.
Step 1: One Convincing Email
Meet Bobby, an employee at a fictional company called Acme.
One morning, Bobby receives an email that appears to come from Dana Reyes in the finance department. The subject line reads "Action required", and the message asks him to review and approve a vendor document before a deadline.
The request doesn't seem unusual. The deadline adds a bit of urgency, but the email looks like ordinary business communication.
Bobby clicks the link.
He could have caught warning signs, including a suspicious sender address and a destination that doesn't match what he would expect from the message. But the email looks convincing enough that he doesn't stop to investigate.
This is how a cyberattack can begin: not with an obvious security failure, but with a moment that feels routine.
Phishing emails often imitate familiar coworkers, vendors, document-sharing services, or business processes. Attackers use urgency and familiarity to encourage people to act before thinking twice.
Security awareness training helps employees recognize these tactics, but even well-trained employees can make mistakes. That's why organizations need layers of protection beyond the inbox.
For Bobby, the click is only the beginning.
Step 2: The Login That Isn't What It Seems
The link opens a sign-in page that looks like a familiar Microsoft login screen. Bobby enters his credentials and completes a multifactor authentication (MFA) prompt.
From his perspective, everything works as expected.
In the simulated attack, however, the attacker captures information from the sign-in process, including Bobby's authenticated session token.
What is a session token?
Think of it like a wristband at an amusement park. Once you've checked in, the wristband helps establish that you're authorized to be there. You don't need to prove your identity from scratch every time you enter an attraction.
A session token serves a similar purpose online. After a user authenticates, it can allow applications to recognize that user's active session.
If an attacker steals a usable session token, they may be able to reuse that authenticated session to access resources as the legitimate user, potentially without triggering another password or MFA prompt.
The important distinction: an attacker may not need to log in again if they can take over an existing authenticated session.
MFA remains a critical security control, but it isn't foolproof. Organizations also need ways to identify suspicious activity after authentication has taken place.
And that brings us to the next stage of Bobby's story.
Step 3: The Clues Start Adding Up
Once the attacker has a foothold, suspicious activity may begin appearing across Acme's environment.
There isn't necessarily a dramatic warning or an obvious sign that something is wrong. Instead, investigators find clues in different places.
Here's what the team examines in the simulated scenario:
Identity activity: A sign-in or active session appears in circumstances that don't match what the team expects from Bobby.
Endpoint activity: A process accesses browser data in a way that raises suspicion.
Network activity: Bobby's laptop connects to a destination that needs further investigation.
User reporting: Bobby contacts the support team because the link didn't open the document he expected.
Any of these events could require more context before we can classify them as malicious. An unfamiliar sign-in might have a legitimate explanation. A process accessing certain data might be normal for a particular application.
But together, these events may tell a different story.
That's why effective cybersecurity monitoring looks beyond isolated alerts. By correlating activity across accounts, devices, networks, and user reports, security teams can identify relationships that might otherwise go unnoticed.
It also highlights why employees should report suspicious activity promptly, even if they're unsure whether they made a mistake. Bobby's report could help investigators connect the suspicious email to activity elsewhere in the environment.
Step 4: Security Teams Connect the Dots
An alert is a starting point for an investigation, not the final answer.
During the webinar, Jimmy C., Technical Account Manager at Huntress, walked through how investigators can piece together activity to understand what happened. Andrew B., BAE Networks' Internal Services Team Lead, shared how security tools and monitoring help BAE's team investigate suspicious behavior and respond.
The investigation isn't simply about finding one bad file or one unusual login; it's about establishing a timeline and understanding how the events relate to one another.
Investigators need to answer questions such as:
What happened first?
Which account and device were involved?
Does the activity match the user's normal behavior?
Could other accounts or devices be affected?
What evidence confirms a compromise, and what still needs validation?
What action is needed to contain the threat?
This process helps security teams distinguish between confirmed findings, likely explanations, and questions that need further investigation.
It also helps define the incident's scope. If Bobby's account was compromised, the team needs to determine whether the activity stopped there or whether other systems and accounts may be involved.
For organizations without a large internal security team, this level of investigation can be hard to manage alone, especially when alerts come from multiple tools.
That's where meaningful, correlated alerts and access to experienced security analysts can make a difference. Instead of leaving an organization to sort through disconnected warnings, security teams can use the evidence to make more informed decisions.
The goal is to understand the situation quickly enough to take the right action.
Step 5: Containing the Threat
Once a compromise is confirmed, or the evidence calls for immediate containment, the response team must limit further access and decide what to do next.
The right steps depend on the incident, but Bobby's scenario highlights several key considerations:
Revoke active sessions. If an attacker may have stolen a session token, invalidating active sessions can help prevent them from continuing to use it. Changing the password alone may not invalidate every existing session.
Reset compromised credentials. If Bobby's credentials were exposed, the team should reset them and review the account's authentication protections.
Isolate the affected device. Disconnecting a potentially compromised laptop from the network can help limit further activity while investigators assess the device.
Investigate the broader environment. The team should check whether other accounts, devices, or systems may have been affected rather than assuming the incident is limited to Bobby.
Preserve evidence. Rebooting or wiping a device too early can destroy useful investigative information. Organizations should follow their incident response team's guidance before taking actions that could interfere with an investigation.
Document the findings. An incident report should capture the timeline, evidence, potential impact, actions taken, and recommended next steps.
These actions aren't necessarily performed in a fixed order. Security teams must weigh the urgency of containment against the need to preserve evidence and maintain business operations.
The objective is to stop the threat, understand its impact, and give the organization a clear path toward recovery.
Step 6: Why Preparation Matters Before an Attack
In the simulated scenario, investigators can follow the clues and determine how to respond. In a real incident, the process may be messier.
The attack could happen overnight. The person responsible for approving a response might be unavailable. Multiple systems could be affected. Employees may not know whom to contact or what to avoid doing.
Organizations can prepare for these problems before an incident occurs.
A practical incident response plan should establish who to notify, who can isolate a device, how to preserve evidence, when to seek outside assistance, and how the organization will communicate during an incident.
Testing that plan through tabletop exercises or simulations helps identify gaps before the pressure is on.
Continuous monitoring also matters. Suspicious activity doesn't follow business hours, and an attacker doesn't need to wait until the IT team is back in the office.
At BAE Networks, our partnership with Huntress supports security monitoring, investigation, and response. Huntress provides security telemetry and analyst investigation, while our team uses that information to help customers understand suspicious activity and determine appropriate next steps.
With 24/7 monitoring and support, the goal is to identify meaningful activity, reduce the time an attacker may have access, and help customers respond with better information.
No single tool can prevent every attack. Effective security depends on layers of protection, meaningful monitoring, informed people, and a response process that works when it's needed.
What This Simulated Attack Teaches Us
Bobby's story illustrates three important lessons:
1. A normal-looking sign-in doesn't guarantee a safe session.
Attackers may exploit stolen credentials or session tokens to gain access. Organizations need security measures that look beyond the initial login.
2. Context is more valuable than isolated alerts.
Identity, endpoint, network, and user-reported activity can reveal more when investigators connect the dots.
3. Investigation turns suspicious activity into actionable decisions.
Security teams need to establish what happened, determine the scope, contain the threat, and document the response.
A single click doesn't automatically mean a business has been breached. But when something suspicious happens, what comes next matters. The right visibility, investigation, and response can help an organization understand the risk and act before the situation worsens.
Watch the Full Webinar: Anatomy of a Cyberattack
Reading about a simulated attack is one thing. Watching the scenario unfold is another.
In Anatomy of a Cyberattack, BAE Networks and Huntress walk through the fictional attack in greater detail, explaining how a seemingly ordinary email can lead to suspicious activity, how investigators connect the evidence, and what organizations should consider when responding.
Is Your Business Prepared?
Understanding how an attack unfolds is a useful first step. Knowing how your organization would detect, investigate, and respond is just as important.
BAE Networks helps businesses navigate managed IT, cybersecurity, and compliance with practical guidance and responsive, Michigan-based support.
If you're ready to evaluate how your security tools, monitoring, and incident response processes work together, contact BAE Networks to start the conversation.
Frequently Asked Questions
What is the first step in a cyberattack?
There isn't one universal starting point. An attack may begin with a phishing email, stolen credentials, a malicious download, an exposed system, or another method of gaining initial access.
What is a session token, and why does it matter?
A session token helps an application recognize an authenticated user's session. If an attacker steals a usable token, they may reuse that session to access resources without repeating the usual login process.
Can an attacker bypass multifactor authentication?
Some attacks can steal or hijack an authenticated session, allowing an attacker to reuse it without necessarily triggering another MFA prompt. MFA remains an important defense, but organizations should also monitor suspicious activity after authentication.
What should a business do if an employee clicks a suspicious link?
The employee should report it to the organization's IT or security team as soon as possible, even if nothing obvious happens. The team can assess the risk, review relevant activity, and decide whether to contain the issue or investigate further. Employees should avoid rebooting or wiping a potentially affected device unless the response team directs them to do so.
Why is cybersecurity monitoring important?
Monitoring helps identify suspicious activity across accounts, devices, and networks. Correlating those signals can help security teams distinguish isolated events from a broader incident and respond with better context.
How can a business prepare for a cyberattack?
Businesses can prepare by implementing layered security controls, enabling appropriate MFA protections, establishing an incident response plan, defining escalation procedures, and testing their response through exercises. Working with a qualified IT and security provider can also help identify gaps and determine appropriate next steps.
