Practical Cases: Detecting Threats Before Impact

Modern organizations cannot rely on preventive controls alone. Attackers may still gain access through phishing, compromised credentials, unmanaged endpoints, or overlooked internal systems. What matters most is how quickly security teams can detect suspicious behavior once it appears inside the environment. 

The following cases are based on real incidents detected in an organization environment protected by LABYRINTH. The network there is geographically and logically distributed, so the platform was deployed using a centralized architecture: one Admin VM acting as the Management Console and five Worker VMs responsible for running decoys across different network segments.  

Each case highlights a different attack scenario, but they all share a common outcome: security teams gained visibility into malicious activity before it escalated into a larger incident. 

Case 1: Credential Abuse Revealed an Active Intrusion

One of the most valuable opportunities to stop an attacker is during the early stages of an intrusion, before they gain broader access to the environment. 

In this case, the security team received a high-confidence alert indicating the use of credentials that did not belong to any legitimate user. These credentials had been intentionally placed inside a Seeder Task: a file-based decoy distributed by a Seeder Agent to a real host. In this scenario, the lure was an RDP shortcut file that appeared useful to an attacker searching for access paths inside the network. 

This is an important technical distinction. Seeder Tasks are not simple tokens that alert when opened. Their purpose is to act as realistic breadcrumbs that guide an attacker toward deception infrastructure. Alerts are generated when the attacker actually uses the information from the Seeder Task and interacts with the related Point or when fake credentials are observed. 

The investigation revealed that an attacker had gained access to an internal workstation through a phishing attack. After establishing a foothold, the attacker searched the host for useful artifacts: connection files, stored credentials, configuration files, passwords, and other information that could support lateral movement.  

After discovering the decoy RDP file, the attacker attempted to reuse the embedded credentials against several production systems. Because these credentials were known to Labyrinth and were never intended for legitimate use, the activity immediately indicated suspicious behavior. Using the SIEM integration, Labyrinth was able to detect the reuse attempt and create an actionable alert. 

This alert was valuable because it did not simply indicate that “something unusual” happened. It showed that an attacker had already compromised a host, searched it for credentials, and attempted to move laterally. Analysts could identify the affected endpoint, reconstruct the sequence of attacker actions, and begin containment before the attacker gained additional access. 

Case 2: A Forgotten Endpoint Became a Weakness 

Not every threat originates from a sophisticated external attacker. Sometimes risk enters the environment through systems that have simply been overlooked. 

In this case, an employee returned to the office after an extended absence and began using a desktop computer that had not participated in recent hardware replacement and modernization efforts. During the employee's absence, most workstations across the organization had been upgraded. This particular device remained unchanged and largely forgotten. 

Shortly after being reconnected to the corporate network, the host began generating suspicious traffic and attempted to exploit other systems.  

One of those attempts targeted Labyrinth Points. 

The interaction with the deception asset generated an alert and gave the security team immediate visibility into the source of the activity. Because Points behave as network-visible decoys with their own IP and MAC addresses, interaction with them is highly suspicious by design: normal users and legitimate systems have no operational reason to access them. In this case, the malware was identified as WannaCry-related activity. 

The response was accelerated through integrations with the customer’s SIEM and firewall infrastructure. Once the alert was generated, the source host was identified and isolated before the malware could spread further across the network. 

This case demonstrates a common enterprise problem: forgotten or unmanaged endpoints can become blind spots. They may run outdated operating systems, miss security updates, or remain outside standard monitoring workflows. Labyrinth added an additional layer of visibility by detecting the moment such a host interacted with deceptive infrastructure. 

Case 3: Early Visibility Into Activity Targeting SCADA Systems 

Industrial and operational technology environments present unique security challenges. Many organizations rely on systems that cannot be frequently modified, aggressively scanned, or disrupted without affecting critical operations. Because of these constraints, visibility becomes especially important. 

During a LABYRINTH configuration process, engineers created custom Universal Web Point that emulates present SCADA component operating within one of the customer's network segments. The platofrm can support SCADA deception both through dedicated Point types and through Universal Web Points, which can be customized to imitate specific web-based industrial interfaces. 

Several weeks later, the asset generated multiple alerts indicating attempts to access and interact with what appeared to be an industrial control interface. The activity did not match expected administrative behavior and raised concerns that someone inside the environment was actively exploring systems related to operational technology. 

At this stage, no production process had been disrupted and no operational system had been affected. However, the alerts gave the security team early evidence of activity that could otherwise have remained unnoticed. 

This is especially valuable in OT environments because threat actors rarely begin with disruptive actions. They usually spend time mapping systems, identifying interfaces, testing access paths, and understanding how operational assets are connected. Detecting this reconnaissance phase gives defenders time to investigate before activity reaches critical systems. 

Conclusion 

Although the incidents are different - stolen credentials, an unmanaged endpoint, and suspicious activity around industrial systems - they all show the same principle: the earlier malicious activity becomes visible, the more response options defenders have. 

Most incidents begin with small signals: a credential is tested, a forgotten device reconnects, or an unfamiliar system attracts attention. These events may seem minor, but they can reveal the earliest stages of an attack. 

The cases described above demonstrate a simple principle: attackers cannot interact with assets that appear valuable without leaving evidence behind. LABYRINTH helps security teams turn that interaction into actionable intelligence, providing visibility into malicious activity before it develops into a larger incident.