This article discusses a phishing incident at a medium-sized FinTech company, where employees were affected by a fake software update notification. The response involved identifying the phishing scope, mitigating impacts, and reinforcing defenses through various security measures. Efforts included utilizing PowerShell scripts for payload execution and monitoring network events. Affected: Medium-sized FinTech company, employees, IT security systems
Keypoints :
- Incident involved a phishing campaign mimicking a software update notification.
- Employees reported unusual system behavior after clicking the suspicious notification.
- PowerShell scripts were used for malicious payload execution.
- Queries were executed to check device file, process, and network events for suspicious activities.
- Immediate containment, eradication, and recovery steps were taken to address the breach.
- Post-incident improvements included enhancing monitoring for phishing emails and user awareness training.
MITRE Techniques :
- [T1193] Spear Phishing Link: Employees received a phishing email with a link to a fake software update.
- [T1059.001] PowerShell Execution: Execution of malicious PowerShell script on victim devices was detected.
- [T1071.001] Web Protocols: Communication was established with a C2 server, indicating potential credential exfiltration.
- [T1210] Exploitation of Remote Services: Lateral movement and credential dumping techniques were referenced but not detailed.
Indicator of Compromise :
- [URL] https://github.com/TrevinoParker7/Powershell-test-payload-harmless/