Finance Mailbox Takeover at MegaCorp Logistics

The case opened as a mailbox compromise on a finance analyst's account. Before tracing how the intrusion unfolded you need to scope it: which internal workstation produced the endpoint telemetry behind this incident? Work the SIEM around the automation binary that ran during the browser session and read the host it was recorded on.

Having scoped the affected workstation, follow what its browser did during the window in question. Shortly after the user opened a downloaded file, the host opened an HTTPS connection to an external host. Work the XDR timeline and network events and identify the external destination the browser connected to.

The connection you traced raised a detection on the affected host in the XDR Behaviors panel. Report the MITRE ATT&CK technique ID the platform mapped to that detection.

A second detection fired on the same host a few minutes after the first, on the artifact the browser was holding at that point. Determine the MITRE technique ID the platform assigned to it.

You have now mapped two related techniques on this host. In the ATT&CK model both roll up under a single tactic that describes the adversary's goal in this phase of the intrusion. Report that shared tactic.

With the endpoint activity understood, trace back to how it started. A file arrived by email and was opened from the user's Downloads folder shortly before the browser session. Correlate the inbound mail event with the process that opened the download and identify that file.

Opening that file was followed by a headless automation binary running on the same host. Walk the XDR process tree on the affected workstation and determine which immediate parent process launched that binary.

You have reconstructed how the account was taken over; now establish what was left behind for the containment plan. One detection fired on the mail server against the victim's mailbox after the account was reached. Report the technique name the platform assigned to it.