JUMPSEC’s Detection and Response Team (DART) responds to many phishing threats targeting our clients. An interesting incident I recently had to respond to, was a critical alert titled "multi-stage alert involving Initial Access & Lateral Movement". This alert was triggered by a series of phishing emails targeting individuals with lures presenting a common theme. In this LABS post, I’ll walk you through the investigation, how we pieced together several bits of information to figure out the tactics and infrastructure used by the attackers, and the steps taken to mitigate the threat. Incident Overview Microsoft Defender XDR (eXtended Detection and Response) triggered the alert that four emails matched our alert policy relating to “malicious URL that were delivered and later removed”. Using the “Email Preview” feature in Defender, I was able to see that all the phishing emails shared a...
The Anatomy of a Phishing Investigation: How Attackers Exploit Health-Related Fears
read more
