Overdue Invoice, Compromised Endpoint: Tracing a Finance Workstation Intrusion

A finance clerk worked through her inbox this morning and, inside the hour, her workstation started producing endpoint events that no invoice review generates. Before you dig in, get oriented on how you are going to work it.

The gateway logged every message that reached the clerk's mailbox that morning. One of them did not carry a document; its attachment was a container. Name what the gateway recorded inside that container, exactly as it was written down.

The program that ran next did not stay in memory. It decrypted a payload and put it on disk so that the next stage could be unpacked and run. Identify the file it created, by name.

Marcus on the helpdesk needs to know exactly what to strip out so the infection does not come back at the next logon. Something in the chain arranged for that. Identify the name of the registry value it created.

Once persistence was in place, the same process reached out to the internet. Two external endpoints were contacted within six minutes of each other. Identify the domain the host reached first.

Step back and label how this attack actually fired. Everything you have traced so far, from the first execution through persistence to the callouts, hangs off one earlier event. More than one ATT&CK technique is visible in the recap. You want the one that describes the pivot itself: not the one that got the message into the mailbox, not the interpreter the pivot handed off to, and not the one that kept the chain alive across a logoff. Name it, down to the sub-technique.