A Foothold Is Not an Attack. It Is an Option.

During a firewall migration, a senior engineer reviewing the legacy configuration found a site-to-site VPN tunnel pointing to a commercial hosting provider in a foreign country. The tunnel was established two years prior. The logs showed it connected for exactly four seconds every Sunday at 3:00 AM. It had never transferred more than a few kilobytes of data. The security dashboard was entirely green.

Incident response starts with an incident, and that is the problem. An active incident is loud. Ransomware encrypts file shares, data exfiltration spikes outbound bandwidth, and wipers crash domain controllers. But a state-sponsored foothold is designed to be invisible.

A foothold is not an attack. It is prepositioned logistics. The intruder pays the premium at the point of intrusion—the cost of the exploit, the compromised credential, the supply-chain insertion. Maintaining the access is cheap. Reacquiring it is expensive. The access is a call option with no expiry and no observable premium. The rational intruder holds it. Using it burns it. Access is scarce, and use is expensive.

You do not find this kind of persistence by looking for malware. You find it by looking for impossible administration. Quiet persistence rarely relies on exotic payloads. It relies on living off the land. It looks like a sysadmin doing their job poorly, or a migration that was never fully cleaned up.

A federal police force investigates a failed login on an evidence management system. The account belongs to an external database administrator whose contract ended eighteen months ago. It was disabled in the directory, but recently re-enabled, with the password changed and conditional access bypassed. The account queried no records. It logged in, checked permissions, and logged out.

A trust relationship between two domains was established for a joint exercise and never removed. The partner domain suffered a compromise six weeks ago. The trust was in the architecture diagram, but it was not in the change log.

A service account with domain admin rights, created by a contractor during a platform migration three years ago, authenticates from a residential IP range. The pattern is one login every 36 hours, jittered. It is not in the privileged access review because it was never added to the inventory.

These artifacts persist because quiet persistence does not fit any team’s mandate. The security operations center needs an alert. Incident response needs an active incident. Vulnerability management needs a CVE. Insider threat needs an insider. Audit needs a control failure. When an adversary simply logs in, checks a permission, and waits, the activity falls to nobody. This is an organizational design problem before it is a technology problem.

The adversary’s quiet is not the absence of intent. It is the presence of patience. They do not need to breach the network during a geopolitical crisis, a border mobilization, or a domestic emergency. They need to be inside the network when the crisis starts. During a crisis, emergency changes bypass review. Surge staffing introduces new credentials. Monitoring gets deprioritized because the operational noise is louder. The crisis does the adversary’s work for them, or provides cover for their action.

“No incidents this quarter” is a statement about detection, not exposure. Mean time to detect assumes there is something to detect. If the adversary is quiet, the metric is technically infinite, but no one reports it that way. The dashboard is green because the adversary has not done anything yet. If your detection strategy depends on the adversary doing something, you are depending on the adversary.

Incident response is a sprint. It is reactive, bounded by the alert, and measured by time to remediation. Threat hunting is a standing patrol. It is proactive, unbounded, and driven by hypotheses. Hunters do not look at alerts. They start with a question: if I already had domain admin privileges, how would I ensure I kept them after a password rotation? They then query the environment to prove or disprove that scenario.

If you assign your incident response team to hunt, they will only hunt when the ticket queue is empty. The queue is never empty. Hunting requires a separate mandate, separate metrics, and often separate infrastructure. A mature hunt team operates on a decoupled network segment with read-only access to enterprise logs, because a sophisticated adversary with administrative access will tamper with the primary security information and event management system.

Assume compromise is useful only when it changes decisions. It is an architectural posture, not a finding. It means segmenting the network as if the adversary is already inside. It means granting privilege as if the credential is already stolen. It means designing logging to survive a crisis, when logging is often turned down for performance, by writing to a system the crisis does not touch.

Log retention is a strategic capability. If an enterprise only stores authentication logs for thirty days, an intruder only needs to wait thirty-one days after initial compromise to make their entry invisible. State actors build their hibernation cycles around your storage budget. You cannot find a slow-moving adversary if your memory resets every month.

When a hunt team finally finds a dormant foothold, the immediate instinct is to sever it. But removal is not the same as closing the first account found. If you remove the access, you lose the intelligence. If you watch it, you risk disruption. Teams must establish how the access was obtained, what else trusted it, and whether the replacement path has the same weakness. In operational systems, an unknown dependency can make immediate removal disruptive to field teams. The hard containment decision is often made months earlier, when someone decides whether to map a dependency.

The adversary is not necessarily after the primary command and control servers first. They target the quiet systems. They look at the logistics database to see what is moving. They look at the human resources system to see who is being promoted or deployed. They look at the case management platform to see what the organization knows. Read-only access to case files is not read-only to the adversary. It is intelligence collection. These systems do not get the security operations center’s attention, but they hold the pattern.

The hunt is most valuable before the crisis gives the access a purpose. The work is about understanding the consequences of a quiet account while there is still time to verify dependencies and change them deliberately.