April 5, 2022

How Darktrace Antigena Thwarted Cobalt Strike Attack

Learn how Darktrace's Antigena technology intercepted and delayed a Cobalt Strike intrusion. Discover more cybersecurity news and analyses on Darktrace's blog.

Written by

Dylan Evans

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Dylan Evans

Apr 2022

In December 2021 several CVEs^[1] were issued for the Log4j vulnerabilities that sent security teams into a global panic. Threat actors are now continuously scanning external infrastructure for evidence of the vulnerability to deploy crypto-mining malware.^[2] However, through December ‘21 – February ‘22, it was ransomware groups that seized the initiative.

Compromise

In January 2022, a Darktrace customer left an external-facing VMware server unpatched allowing Cobalt Strike to be successfully installed. Several IoCs indicate that Cuba Ransomware operators were behind the attack. Thanks to the Darktrace SOC service, the customer was notified of the active threat on their network, and Antigena’s Autonomous Response was able to keep the attackers at bay before encryption events took place.

Initially the VMware server breached two models relating to an anomalous script download and a new user agent both connecting via HTTP. As referenced in an earlier Darktrace blog, both of these models had been seen in previous Log4j exploits. As with all Darktrace models however, the model deck is not designed to detect only one exploit, infection variant, or APT.

Figure 1: Darktrace models breaching due to the malicious script download

Analyst investigation

A PCAP of the downloaded script showed that it contained heavily obfuscated JavaScript. After an OSINT investigation a similar script was uncovered which likely breached the same Yara rules.

Figure 2: PCAP of the Initial HTTP GET request for the Windows Script component

Figure 3: PCAP of the initial HTTP response containing obfuscated JavaScript

Figure 4: A similar script that has been observed installing additional payloads after an initial infection^[3]

While not an exact match, this de-obfuscated code shared similarities to those seen when downloading other banking trojans.

Having identified on the Darktrace UI that this was a VMware server, the analyst isolated the incoming external connections to the server shortly prior to the HTTP GET requests and was able to find an IP address associated with Log4j exploit attempts.

Figure 5: Advanced Search logs showing incoming SSL connections from an IP address linked to Log4j exploits

Through Advanced Search the analyst identified spikes shortly prior and immediately after the download. This suggested the files were downloaded and executed by exploiting the Log4j vulnerability.

Antigena response

Figure 6: AI Analyst reveals both the script downloads and the unusual user agent associated with the connections

Figure 7: Antigena blocked all further connections to these endpoints following the downloads

Cobalt Strike

Cobalt Strike is a popular tool for threat actors as it can be used to perform a swathe of MITRE ATT&CK techniques. In this case the threat actor attempted command and control tactics to pivot through the network, however, Antigena responded promptly when the malware attempted to communicate with external infrastructure.

On Wednesday January 26, the DNS beacon attempted to connect to malicious infrastructure. Antigena responded, and a Darktrace SOC analyst issued an alert.

Figure 8: A Darktrace model detected the suspicious DNS requests and Antigena issued a response

The attacker changed their strategy by switching to a different server “bluetechsupply[.]com” and started issuing commands over TLS. Again, Darktrace detected these connections and AI Analyst reported on the incident (Figure 9, below). OSINT sources subsequently indicated that this destination is affiliated with Cobalt Strike and was only registered 14 days prior to this incident.

Figure 9: AI Analyst summary of the suspicious beaconing activity

Simultaneous to these connections, the device scanned multiple internal devices via an ICMP scan and then scanned the domain controller over key TCP ports including 139 and 445 (SMB). This was followed by an attempt to write an executable file to the domain controller. While Antigena intervened in the file write, another Darktrace SOC analyst was issuing an alert due to the escalation in activity.

Figure 10: AI Analyst summary of the .dll file that Antigena intercepted to the Windows/temp directory of the domain controller

Following the latest round of Antigena blocks, the threat actor attempted to change methods again. The VMware server utilised the Remote Access Tool/Trojan NetSupport Manager in an attempt to install further malware.

Figure 11: Darktrace reveals the attacker changing tactics

Despite this escalation, Darktrace yet again blocked the connection.

Perhaps due to an inability to connect to C2 infrastructure, the attack stopped in its tracks for around 12 hours. Thanks to Antigena and the Darktrace SOC team, the security team had been afforded time to remediate and recover from the active threat in their network. Interestingly, Darktrace detected a final attempt at pivoting from the machine, with an unusual PowerShell Win-RM connection to an internal machine. The modern Win-RM protocol typically utilises port 5985 for HTTP connections however pre-Windows 7 machines may use Windows 7 indicating this server was running an old OS.

Figure 12: Darktrace detects unusual PowerShell usage

Cuba Ransomware

While no active encryption appears to have taken place for this customer, a range of IoCs were identified which indicated that the threat actor was the group being tracked as UNC2596, the operators of Cuba Ransomware.^[4]

These IoCs include: one of the initially dropped files (komar2.ps1,^[5] revealed by AI Analyst in Figure 6), use of the NetSupport RAT,^[6] and Cobalt Strike beaconing.^[7] These were implemented to maintain persistence and move laterally across the network.

Cuba Ransomware operators prefer to exfiltrate data to their beacon infrastructure rather than using cloud storage providers, however no evidence of upload activity was observed on the customer’s network.

Concluding thoughts

Unpatched, external-facing VMware servers vulnerable to the Log4j exploit are actively being targeted by threat actors with the aim of ransomware detonation. Without using rules or signatures, Darktrace was able to detect all stages of the compromise. While Antigena delayed the attack, forcing the threat actor to change C2 servers constantly, the Darktrace analyst team relayed their findings to the security team who were able to remediate the compromised machines and prevent a final ransomware payload from detonating.

For Darktrace customers who want to find out more about Cobalt Strike, refer here for an exclusive supplement to this blog.

‍

Appendix

Darktrace model detections

Initial Compromise:

Device / New User Agent To Internal Server
Anomalous Server Activity / New User Agent from Internet Facing System
Experimental / Large Number of Suspicious Successful Connections

Breaches from Critical Devices / DC:

Device / Large Number of Model Breaches
Antigena / Network / External Threat / Antigena File then New Outbound Block
Device / SMB Lateral Movement
Experimental / Unusual SMB Script Write V2
Compliance / High Priority Compliance Model Breach
Anomalous Server Activity / Anomalous External Activity from Critical Network Device
Experimental / Possible Cobalt Strike Server IP V2

Lateral Movement:

Antigena / Network / Insider Threat / Antigena Internal Anomalous File Activity
Compliance / SMB Drive Write
Anomalous File / Internal / Executable Uploaded to DC
Experimental / Large Number of Suspicious Failed Connections
Compromise / Suspicious Beaconing Behaviour
Antigena / Network / Significant Anomaly / Antigena Breaches Over Time Block
Antigena / Network / External Threat / Antigena Suspicious Activity Block
Anomalous Connection / High Volume of Connections to Rare Domain
Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Server Block

Network Scan Activity:

Device / Suspicious SMB Scanning Activity
Experimental / Network Scan V2
Device / ICMP Address Scan
Experimental / Possible SMB Scanning Activity
Experimental / Possible SMB Scanning Activity V2
Antigena / Network / Insider Threat / Antigena Network Scan Block
Device / Network Scan
Compromise / DNS / Possible DNS Beacon
Device / Internet Facing Device with High Priority Alert
Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Server Block

DNS / Cobalt Strike Activity:

Experimental / Possible Cobalt Strike Server IP
Experimental / Possible Cobalt Strike Server IP V2
Antigena / Network / External Threat / Antigena File then New Outbound Block
Antigena / Network / External Threat / Antigena Suspicious File Block
Anomalous Connection / New User Agent to IP Without Hostname
Anomalous File / Script from Rare External Location

MITRE ATT&CK techniques observed

IoCs

Thanks to Brianna Leddy, Sam Lister and Marco Alanis for their contributions.

Footnotes

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44530
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104

2. https://www.toolbox.com/it-security/threat-reports/news/log4j-vulnerabilities-exploitation-attempts

3. https://twitter.com/ItsReallyNick/status/899845845906071553

4. https://www.mandiant.com/resources/unc2596-cuba-ransomware

5. https://www.ic3.gov/Media/News/2021/211203-2.pdf

6. https://threatpost.com/microsoft-exchange-exploited-cuba-ransomware/178665/

7. https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-cuba-ransomware/

8. https://gist.github.com/blotus/f87ed46718bfdc634c9081110d243166

Written by

Dylan Evans

Inside the SOC

Written by

Dylan Evans

•

April 7, 2026

Nathaniel Bill

Malware Research Engineer

Director of Product Management | Darktrace

Watch the NIS2 Webinar

Blog

Cloud

April 9, 2026

Bringing Together SOC and IR teams with Automated Threat Investigations for the Hybrid World

The investigation gap: Why incident response is slow, fragmented and reactive

Modern investigations often fall apart the moment analysts move beyond an initial alert. Whether detections originate in cloud or on-prem environments, SOC and Incident Response (IR) teams are frequently hindered by fragmented tools and data sources, closed ecosystems, and slow, manual evidence collection just to access the forensic context they need. SOC analysts receive alerts without the depth required to confidently confirm or dismiss a threat, while IR teams struggle with inconsistent visibility across cloud, on‑premises, and contained endpoints, creating delays, blind spots, and incomplete attack timelines.

This gap between SOC and Digital Forensics and Incident Response (DFIR) slows response and forces teams into reactive and inefficient investigation patterns. Security teams struggle to collect high‑fidelity forensic data during active incidents, particularly from cloud workloads, on‑prem systems, and XDR‑contained endpoints where traditional tools cannot operate without deploying new agents or disrupting containment. The result is a fragmented response process where investigations slow down, context gets lost, and critical attacker activity can slip through the cracks.

What’s new at Darktrace

‍

Helping teams move from detection to root cause faster, more efficiently, and with greater confidence

The latest update to Darktrace / Forensic Acquisition & Investigation eliminates the traditional handoff between the SOC and IR teams, enabling analysts to seamlessly pivot from alert into forensic investigation. It also brings on-demand and automated data capture through Darktrace / ENDPOINT as well as third-party detection platforms, where investigators can safely collect critical forensic data from network contained endpoints, preserving containment while accelerating investigation and response.

Together, this solidifies / Forensic Acquisition & Investigation as an investigation-first platform beyond the cloud, fit for any organization that has adopted a multi-technology infrastructure. In practice, when these various detection sources and host‑level forensics are combined, investigations move from limited insight to complete understanding quickly, giving security teams the clarity and deep context required to drive confident remediation and response based on the exact tactics, techniques and procedures employed.

‍

Integrated forensic context inside every incident workflow

SOC analysts now have seamless access to forensic evidence at the exact moment they need it. There is a new dedicated Forensics tab inside Cyber AI Analyst™ incidents, allowing users to move instantly from detection to rich forensic context in a single click, without the need to export data or get other teams involved.

For investigations that previously required multiple tools, credentials, or intervention by a dedicated team, this change represents a shift toward truly embedded incident‑driven forensics – accelerating both decision‑making and response quality at the point of detection.

Figure 1: The forensic investigation associated with the Cyber AI Analyst™ incident appears in a dedicated ‘Forensics’ tab, with the ability to pivot into the / Forensic Acquisition & Investigation UI for full context and deep analysis workflows.

‍

Reliable automated and manual hybrid evidence capture across any environment

Across cloud, on‑premises, and hybrid environments, analysts can now automate or request on‑demand forensic evidence collection the moment a threat is detected via Darktrace / ENDPOINT. This allows investigators to quickly capture high-fidelity forensic data from endpoints already under protection, accelerating investigations without additional tooling or disrupting systems. Especially in larger environments where the ability to scale is critical, automated data capture across hybrid environments significantly reduces response time and enables consistent, repeatable investigations.

Unlike EDR‑only solutions, which capture only a narrow slice of activity, these workflows provide high‑quality, cross‑environment forensic depth, even on third‑party XDR‑contained devices that many vendor ecosystems cannot reach.

The result is a single, unified process for capturing the forensic context analysts need no matter where the threat originates, even in third-party vendor protected areas.

Figure 2: The ability to acquire, process, and investigate devices with the Darktrace / ENDPOINT agent installed using the ‘Darktrace Endpoint’ import provider

Figure 3: A Linux device that has the Darktrace / ENDPOINT agent installed has been acquired and processed by / Forensic Acquisition & Investigation

‍

Investigation‑first design flexible for hybrid organizations

Luckily, taking advantage of automated forensic data capture of non-cloud assets won’t be subject to those who purely use Darktrace / ENDPOINT. This functionality is also available where CrowdStrike, Microsoft Defender for Endpoint, or SentinelOne agents are deployed. In the case of CrowdStrike, Darktrace / Forensic Acquisition & Investigation can also perform a triage capture of a device that has been contained using CrowdStrike’s network containment capability. What’s critical here is the fact that investigators can safely acquire additional forensic evidence without breaking or altering containment. That massively improves investigation and response time without adding more risk factors.

Figure 4: ‘cado.xdr.test2’ has been contained using CrowdStrike’s network containment capability

Figure 5: Successful triage capture of contained endpoint ‘cado.xdr.test2’ using / Forensic Acquisition & Investigation

The benefits of extending forensics to on‑premises and endpoint environments

Despite Darktrace / Forensic Acquisition & Investigation originating as a cloud‑first solution, the challenges of incident response are not limited to the cloud. Many investigations span on‑premises servers, unmanaged endpoints, legacy systems, or devices locked inside third‑party ecosystems.

By extending automated investigation capabilities into on‑premises environments and endpoints, Darktrace delivers several critical benefits:

Unified investigations across hybrid infrastructure and a heterogeneous security stack
Consistent forensic depth regardless of asset type
Faster and more accurate root-cause analysis
Stronger incident response readiness

‍

Figure 6: Unified alerts from cloud and on-prem environments, grouped into incident-centric investigations with forensic depth

Simplifying deep investigations across hybrid environments

These enhancements move Darktrace / Forensic Acquisition & Investigation closer to a vision out of reach for most security teams: seamless, integrated, high‑fidelity forensics across cloud, on‑prem, and endpoint environments where other solutions usually stop at detection. Automated forensics as a whole is fueling faster outcomes with complete clarity throughout the end-to-end investigation process, which now takes teams from alert to understanding in minutes compared to days or even weeks. All without added agents, disruptions, or specialized teams. The result is an incident response lifecycle that finally matches the reality of modern infrastructure.

‍

Ready to see Darktrace / Forensic Acquisition & Investigation in your environment? Request a demo.

Hear from industry-leading experts on the latest developments in AI cybersecurity at Darktrace LIVE. Coming to a city near you.

[related-resource]

About the author

Paul Bottomley

Director of Product Management | Darktrace

Blog

AI

April 9, 2026

How to Secure AI and Find the Gaps in Your Security Operations

secuing AI testing gaps security operations

What “securing AI” actually means (and doesn’t)

Security teams are under growing pressure to “secure AI” at the same pace which businesses are adopting it. But in many organizations, adoption is outpacing the ability to govern, monitor, and control it. When that gap widens, decision-making shifts from deliberate design to immediate coverage. The priority becomes getting something in place, whether that’s a point solution, a governance layer, or an extension of an existing platform, rather than ensuring those choices work together.

At the same time, AI governance is lagging adoption. 37% of organizations still lack AI adoption policies, shadow AI usage across SaaS has surged, and there are notable spikes in anomalous data uploads to generative AI services.

First and foremost, it’s important to recognize the dual nature of AI risk. Much of the industry has focused on how attackers will use AI to move faster, scale campaigns, and evade detection. But what’s becoming just as significant is the risk introduced by AI inside the organization itself. Enterprises are rapidly embedding AI into workflows, SaaS platforms, and decision-making processes, creating new pathways for data exposure, privilege misuse, and unintended access across an already interconnected environment.

Because the introduction of complex AI systems into modern, hybrid environments is reshaping attacker behavior and exposing gaps between security functions, the challenge is no longer just having the right capabilities in place but effectively coordinating prevention, detection, investigation, response, and remediation together. As threats accelerate and systems become more interconnected, security depends on coordinated execution, not isolated tools, which is why lifecycle-based approaches to governance, visibility, behavioral oversight, and real-time control are gaining traction.

From cloud consolidation to AI systems what we can learn

We have seen a version of AI adoption before in cloud security. In the early days, tooling fragmented into posture, workload/runtime, identity, data, and more. Gradually, cloud security collapsed into broader cloud platforms. The lesson was clear: posture without runtime misses active threats; runtime without posture ignores root causes. Strong programs ran both in parallel and stitched the findings together in operations.

Today’s AI wave stretches that lesson across every domain. Adversaries are compressing “time‑to‑tooling” using LLM‑assisted development (“vibecoding”) and recycling public PoCs at unprecedented speed. That makes it difficult to secure through siloed controls, because the risk is not confined to one layer. It emerges through interactions across layers.

Keep in mind, most modern attacks don’t succeed by defeating a single control. They succeed by moving through the gaps between systems faster than teams can connect what they are seeing. Recent exploitation waves like React2Shell show how quickly opportunistic actors operationalize fresh disclosures and chain misconfigurations to monetize at scale.

In the React2Shell window, defenders observed rapid, opportunistic exploitation and iterative payload diversity across a broad infrastructure footprint, strains that outpace signature‑first thinking.

You can stay up to date on attacker behavior by signing up for our newsletter where Darktrace’s threat research team and analyst community regularly dive deep into threat finds.

Ultimately, speed met scale in the cloud era; AI adds interconnectedness and orchestration. Simple questions — What happened? Who did it? Why? How? Where else? — now cut across identities, SaaS agents, model/service endpoints, data egress, and automated actions. The longer it takes to answer, the worse the blast radius becomes.
‍

The case for a platform approach in the age of AI

Think of security fusion as the connective tissue that lets you prevent, detect, investigate, and remediate in parallel, not in sequence. In practice, that looks like:

Unified telemetry with behavioral context across identities, SaaS, cloud, network, endpoints, and email—so an anomalous action in one plane automatically informs expectations in others. (Inside‑the‑SOC investigations show this pays off when attacks hop fast between domains.)

Pre‑CVE and “in‑the‑wild” awareness feeding controls before signatures—reducing dwell time in fast exploitation windows.

Automated, bounded response that can contain likely‑malicious actions at machine speed without breaking workflows—buying analysts time to investigate with full context. (Rapid CVE coverage and exploit‑wave posts illustrate how critical those first minutes are.)

Investigation workflows that assume AI is in the loop—for both defenders and attackers. As adversaries adopt “agentic” patterns, investigations need graph‑aware, sequence‑aware reasoning to prioritize what matters early.

This isn’t theoretical. It’s reflected in the Darktrace posts that consistently draw readership: timely threat intel with proprietary visibility and executive frameworks that transform field findings into operating guidance.

The five questions that matter (and the one that matters more)

When alerted to malicious or risky AI use, you’ll ask:

What happened?

Who did it?

Why did they do it?

How did they do it?

Where else can this happen?

The sixth, more important question is: How much worse does it get while you answer the first five? The answer depends on whether your controls operate in sequence (slow) or in fused parallel (fast).

What to watch next: How the AI security market will likely evolve

Security markets tend to follow a familiar pattern. New technologies drive an initial wave of specialized tools (posture, governance, observability) each focused on a specific part of the problem. Over time, those capabilities consolidate as organizations realize the new challenge is coordination.

AI is accelerating the shift of focus to coordination because AI-powered attackers can move faster and operate across more systems at once. Recent exploitation waves show exactly this. Adversaries can operationalize new techniques and move across domains, turning small gaps into full attack paths.

Anticipate a continued move toward more integrated security models because fragmented approaches can’t keep up with the speed and interconnected nature of modern attacks.

Building the Groundwork for Secure AI: How to Test Your Stack’s True Maturity

AI doesn’t create new surfaces as much as it exposes the fragility of the seams that already exist.

Darktrace’s own public investigations consistently show that modern attacks, from LinkedIn‑originated phishing that pivots into corporate SaaS to multi‑stage exploitation waves like BeyondTrust CVE‑2026‑1731 and React2Shell, succeed not because a single control failed, but because no control saw the whole sequence, or no system was able to respond at the speed of escalation.

Before thinking about “AI security,” customers should ensure they’ve built a security foundation where visibility, signals, and responses can pass cleanly between domains. That requires pressure‑testing the seams.

Below are the key integration questions and stack‑maturity tests every organization should run.
‍

1. Do your controls see the same event the same way?

Integration questions

When an identity behaves strangely (impossible travel, atypical OAuth grants), does that signal automatically inform your email, SaaS, cloud, and endpoint tools?
Do your tools normalize events in a way that lets you correlate identity → app → data → network without human stitching?

Why it matters

Darktrace’s public SOC investigations repeatedly show attackers starting in an unmonitored domain, then pivoting into monitored ones, such as phishing on LinkedIn that bypassed email controls but later appeared as anomalous SaaS behavior.

If tools can’t share or interpret each other's context, AI‑era attacks will outrun every control.

Tests you can run

Shadow Identity Test

Create a temporary identity with no history.
Perform a small but unusual action: unusual browser, untrusted IP, odd OAuth request.
Expected maturity signal: other tools (email/SaaS/network) should immediately score the identity as high‑risk.

Context Propagation Test

Trigger an alert in one system (e.g., endpoint anomaly) and check if other systems automatically adjust thresholds or sensitivity.
Low maturity signal: nothing changes unless an analyst manually intervenes.

‍

2. Does detection trigger coordinated action, or does everything act alone?

Integration questions

When one system blocks or contains something, do other systems automatically tighten, isolate, or rate‑limit?
Does your stack support bounded autonomy — automated micro‑containment without broad business disruption?

Why it matters

In public cases like BeyondTrust CVE‑2026‑1731 exploitation, Darktrace observed rapid C2 beaconing, unusual downloads, and tunneling attempts across multiple systems. Containment windows were measured in minutes, not hours.

Tests you can run

Chain Reaction Test

Simulate a primitive threat (e.g., access from TOR exit node).
Your identity provider should challenge → email should tighten → SaaS tokens should re‑authenticate.
Weak seam indicator: only one tool reacts.

Autonomous Boundary Test

Induce a low‑grade anomaly (credential spray simulation).
Evaluate whether automated containment rules activate without breaking legitimate workflows.

‍

3. Can your team investigate a cross‑domain incident without swivel‑chairing?

Integration questions

Can analysts pivot from identity → SaaS → cloud → endpoint in one narrative, not five consoles?
Does your investigation tooling use graphs or sequence-based reasoning, or is it list‑based?

Why it matters

Darktrace’s Cyber AI Analyst and DIGEST research highlights why investigations must interpret structure and progression, not just standalone alerts. Attackers now move between systems faster than human triage cycles.

Tests you can run

One‑Hour Timeline Build Test

Pick any detection.
Give an analyst one hour to produce a full sequence: entry → privilege → movement → egress.
Weak seam indicator: they spend >50% of the hour stitching exports.

Multi‑Hop Replay Test

Simulate an incident that crosses domains (phish → SaaS token → data access).
Evaluate whether the investigative platform auto‑reconstructs the chain.

‍

4. Do you detect intent or only outcomes?

Integration questions

Can your stack detect the setup behaviors before an attack becomes irreversible?
Are you catching pre‑CVE anomalies or post‑compromise symptoms?

Why it matters

Darktrace publicly documents multiple examples of pre‑CVE detection, where anomalous behavior was flagged days before vulnerability disclosure. AI‑assisted attackers will hide behind benign‑looking flows until the very last moment.

Tests you can run

Intent‑Before‑Impact Test

Simulate reconnaissance-like behavior (DNS anomalies, odd browsing to unknown SaaS, atypical file listing).
Mature systems will flag intent even without an exploit.

CVE‑Window Test

During a real CVE patch cycle, measure detection lag vs. public PoC release.
Weak seam indicator: your detection rises only after mass exploitation begins.

‍

5. Are response and remediation two separate universes?

Integration questions

When you contain something, does that trigger root-cause remediation workflows in identity, cloud config, or SaaS posture?
Does fixing a misconfiguration automatically update correlated controls?

Why it matters

Darktrace’s cloud investigations (e.g., cloud compromise analysis) emphasize that remediation must close both runtime and posture gaps in parallel.

Tests you can run

Closed‑Loop Remediation Test

Introduce a small misconfiguration (over‑permissioned identity).
Trigger an anomaly.
Mature stacks will: detect → contain → recommend or automate posture repair.

Drift‑Regression Test

After remediation, intentionally re‑introduce drift.
The system should immediately recognize deviation from known‑good baseline.

‍

6. Do SaaS, cloud, email, and identity all agree on “normal”?

Integration questions

Is “normal behavior” defined in one place or many?
Do baselines update globally or per-tool?

Why it matters

Attackers (including AI‑assisted ones) increasingly exploit misaligned baselines, behaving “normal” to one system and anomalous to another.

Tests you can run

Baseline Drift Test

Change the behavior of a service account for 24 hours.
Mature platforms will flag the deviation early and propagate updated expectations.

Cross‑Domain Baseline Consistency Test

Compare identity’s risk score vs. cloud vs. SaaS.
Weak seam indicator: risk scores don’t align.

‍

Final takeaway

Security teams should ask be focused on how their stack operates as one system before AI amplifies pressure on every seam.

Only once an organization can reliably detect, correlate, and respond across domains can it safely begin to secure AI models, agents, and workflows.

About the author

Nabil Zoldjalali

VP, Field CISO

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: How Darktrace Antigena Thwarted Cobalt Strike Attack

How Darktrace Antigena Thwarted Cobalt Strike Attack

Compromise

Analyst investigation

Antigena response

Cobalt Strike

Cuba Ransomware

Concluding thoughts

Appendix

Darktrace model detections

MITRE ATT&CK techniques observed

IoCs

Footnotes

Darktrace Identifies New Chaos Malware Variant Exploiting Misconfigurations in the Cloud

Bringing Together SOC and IR teams with Automated Threat Investigations for the Hybrid World

Enjoying the blog?

More in this series

How Chinese-Nexus Cyber Operations Have Evolved – And What It Means For Cyber Risk and Resilience

Phantom Footprints: Tracking GhostSocks Malware

When Reality Diverges from the Playbook: Darktrace Identifies Encryption in a World Leaks Ransomware Attack

Blog

Cloud

April 9, 2026

Bringing Together SOC and IR teams with Automated Threat Investigations for the Hybrid World

The investigation gap: Why incident response is slow, fragmented and reactive

What’s new at Darktrace

Helping teams move from detection to root cause faster, more efficiently, and with greater confidence

Integrated forensic context inside every incident workflow

Reliable automated and manual hybrid evidence capture across any environment

Investigation‑first design flexible for hybrid organizations

The benefits of extending forensics to on‑premises and endpoint environments

Simplifying deep investigations across hybrid environments

Blog

AI

April 9, 2026

How to Secure AI and Find the Gaps in Your Security Operations

What “securing AI” actually means (and doesn’t)

From cloud consolidation to AI systems what we can learn

The case for a platform approach in the age of AI

What to watch next: How the AI security market will likely evolve

Building the Groundwork for Secure AI: How to Test Your Stack’s True Maturity

1. Do your controls see the same event the same way?

2. Does detection trigger coordinated action, or does everything act alone?

3. Can your team investigate a cross‑domain incident without swivel‑chairing?

4. Do you detect intent or only outcomes?

5. Are response and remediation two separate universes?

6. Do SaaS, cloud, email, and identity all agree on “normal”?

Final takeaway