Detection and response in action: an end-to-end coverage story

Expel presents a staged customer incident where a phishing email with a malicious Word attachment resulted in Regsvr32.exe being spawned by Winword.exe and making network connections; the report walks through alert triage, collaborative investigation, containment/remediation actions (isolating hosts, blocking hashes/domains), subsequent threat hunting to validate resilience, and updates to detection rules to catch similar TTPs in the future.