Context
At 09:14, a high-priority alert was triggered for a suspicious inbound email sent to two members of the finance team.
The message impersonated a known supplier and requested urgent payment confirmation through a link labeled “View Invoice”.
Investigation steps
- Validated sender reputation and checked SPF, DKIM, and DMARC alignment.
- Extracted URLs from the email body and analyzed redirection behavior in a sandbox.
- Reviewed mailbox activity and endpoint telemetry for both recipients.
- Correlated indicators with threat intel feeds and internal historical detections.
Findings
The sender domain was newly registered and failed DMARC alignment.
The embedded link redirected through two short-lived domains before landing on a fake Microsoft 365 login page.
One user clicked the link but did not submit credentials. No endpoint malware execution was detected.
MITRE ATT&CK
- Initial Access > Phishing: Spearphishing Link (T1566.002)
- Credential Access > Phishing: Input Capture (T1056) (attempted)
IOCs (Indicators of Compromise)
| Type | Indicator | Notes |
|---|---|---|
| Domain | invoice-secure-check.com | Newly registered domain used in initial redirect |
| Domain | m365-auth-verify.net | Hosted fake login page |
| IP | 185.244.25.91 | Server observed during sandbox resolution |
| Hash | N/A | No file attachment in this case |
| URL | hxxps://invoice-secure-check[.]com/open?id=8472 | Defanged malicious URL |
Timeline
| Time | Event |
|---|---|
| 09:14 | Alert received (suspicious sender + URL pattern) |
| 09:18 | Investigation started in email security console |
| 09:27 | Malicious redirect chain confirmed in sandbox |
| 09:34 | Message quarantined and sender/domain blocked |
| 09:42 | User contacted for validation (no credential submission) |
| 09:50 | Case documented and closed with monitoring actions |
Outcome
Containment and blocking were completed the same morning; the case was closed after L2 review with ongoing monitoring on the new detection logic.
Lessons learned
- Add automated domain-age enrichment during triage to reduce manual checks.
- Improve playbook with a dedicated step for user interaction verification.
- Create a reusable response template for finance-targeted phishing campaigns.
- Technical: The detection rule could have fired earlier if domain age (or registration recency) were weighted in the correlation logic — worth testing as an additional condition on similar campaigns.