Who Was at the Keyboard? Session Evidence in Incident Response

MindVault Concept: Operator Continuity. The state in which available evidence supports that the authorized person is still in control of a session. In an investigation, it is the line on the timeline that shows when control may have changed hands.

Every incident responder knows this moment. The logs are clean in the most frustrating way:

• Valid credentials were used.
• MFA was satisfied.
• The endpoint agent saw nothing malicious.

And yet money moved, data left, or a setting changed that nobody will admit to changing.

That last bullet is not hypothetical. CISA, the NSA, and MS-ISAC have warned that criminals use legitimate remote management tools to take control of victims' computers, and that this software generally does not trigger antivirus defenses. A clean endpoint report does not mean no one else was driving.

The question on the whiteboard is always the same. Was it:

• our employee,
• someone who took over their session, or
• a script running under their account?

The answer shapes everything that follows: containment, HR, legal, and what you tell regulators. The usual evidence records the account, not the person. So it often cannot settle the question.

A new line on the timeline

Session confidence over time gives investigators something they rarely have. Instead of one login followed by hours of activity credited to one account, the team can see:

• when the interaction pattern matched the account owner,
• when it changed,
• whether the session switched to remote operation, and
• whether the evidence simply ran out.

That turns vague questions into specific ones.

• Confidence dropped at 2:14 p.m. and the wire request went out at 2:31 p.m.? The investigation starts at 2:14 and looks a little earlier too, because the first change spotted is not always the first bad action.
• Confidence stayed high the whole session? Focus on whether the employee was deceived or acted on their own. That is a very different investigation.

NIST's current incident response guidance, SP 800-61 Revision 3, places incident response inside broader cybersecurity risk management. In practice, that means evidence like this is worth planning for before an incident, not scrambling for during one.

Human, remote, or machine

Behavioral timing helps separate three cases that look identical in an access log:

• A different person at the controls tends to show a changed rhythm.
• A remote operator often leaves a rhythm change plus signs the session is being driven through a remote channel.
• Scripted or automated input tends to produce timing people do not produce.

One caution on that last point. Well-built automation can imitate human randomness. Treat it as a strong hint, not a guarantee.

MITRE ATT&CK catalogs related techniques, including remote service session hijacking (T1563) and remote access tools (T1219). Use an ID only when the evidence matches it. T1563, for example, covers taking over existing SSH or RDP sessions, not every stolen web cookie. Used that way, those IDs give responders, insurers, and outside counsel a shared language for what was found.

What it cannot tell you

Be clear about the limits.

• It is probabilistic. It supports a timeline, and it should always be presented alongside other evidence, never alone.
• A changed pattern can have ordinary causes. An injury, a new keyboard, a laggy remote desktop, or assistive technology can all change how someone types. A mismatch is a reason to look, not a name.
• It cannot tell you intent. A real employee pressured or tricked into sending a payment usually looks like themselves, because they are themselves.
• It covers monitored endpoints only. A stolen token replayed from an attacker's own computer leaves traces in identity provider and network logs, not on the employee's machine.
• Gaps must stay visible. A stretch with no usable measurement is not the same as a stretch where the pattern matched. Never let one pass for the other.
• Later analysis is labeled separately. A reanalysis should be kept apart from what the security team actually saw at the time.

Prepare the evidence now

Evidence is only useful later if it is kept now. Decide ahead of time:

• how long session confidence records are retained,
• how their clocks line up with your other logs, and
• who can access them.

Then the evidence is ready when legal or regulators ask for it.

This lesson is older than most security tools. In The Cuckoo's Egg, astronomer Clifford Stoll tells how a 75-cent accounting discrepancy at Lawrence Berkeley Laboratory in 1986 led him to an intruder. He found the trail because he kept careful records and actually read them. Session evidence works the same way: it only helps if someone kept it.

Add one question to your next tabletop

At your next incident response exercise, add one question to the identity scenario:

How would we show who was operating the account at the moment of the damaging action?

If the answer is "we would guess from IP addresses," that is the gap worth closing before the real incident.

That gap is Operator Continuity, the property we named in The Operator Problem. Keeping a confidence record of it across every session is what Continuous Identity Confidence is for.

MFA proves who logged in. MindVault measures who stayed.

Frequently asked questions

Sources: CISA, NSA, and MS-ISAC, Protecting Against Malicious Use of Remote Monitoring and Management Software, AA23-025A, January 2023 (cisa.gov). NIST SP 800-61 Revision 3, Incident Response Recommendations (csrc.nist.gov). MITRE ATT&CK T1563, Remote Service Session Hijacking (attack.mitre.org). MITRE ATT&CK T1219 (attack.mitre.org).

Ideas we learned from: Clifford Stoll, The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage, 1989 (wikipedia.org).