At 02:14 local time, a CrowdStrike Falcon detection fired on a domain controller in one of the customer's regional hospitals. Process tree showed a credential-dumping LOLBin chain; the on-call analyst escalated within 90 seconds.
By 02:30 we had isolated the host, cut off lateral movement paths via Active Directory, and confirmed the initial vector: a phished MFA token reused against a VPN appliance with no conditional-access policy.
By 04:00 we had contained the blast radius to 3 hosts, restored from clean backups, and rotated 1,800 credentials. No patient data was exfiltrated; no clinical systems were taken offline.
The 72-hour post-incident report covered root cause, timeline, response gaps (the VPN appliance), and a 30/60/90-day hardening plan. The customer adopted all 14 recommendations.