Hi Gents,
I have a query related to Dwell Time calculation in Security IR. Query is lets say one of the user who was on a leave for a week, returned back from holidays and one day while checking the emails, he opened the malicious attachment which result into his system compromise and further data exfiltration.
Now Incident Response Team detected this malicious activity after 5 days from the date of malicious code ran, so the question is what will be the Dwell time here?
From the time when that malicious email landed to colleague inbox or it will be when colleague opened that attachment and which result into system compromise?
