# Session Log — Cascades Tucson phishing investigation + remediation (AMU54618)

## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session Summary

Investigated a suspected phishing email reported by Chris Knight at Cascades Tucson:
"Past Due - AMU54618 - AMYSH Solutions" from Dax Howard <info@syufway.com>, sent
2026-07-14 to accounting@cascadestucson.com with a PDF attachment. Used the
remediation-tool skill (Security Investigator tier, read-only) against tenant
207fa277-e9d8-4eb7-ada1-1064d2221498.

Found the message delivered to the accounting shared mailbox at 17:32 UTC. Message
trace showed TWO copies sent ~10 seconds apart: the first quarantined by Defender as
High Confidence Phish (never released), the second delivered to the Inbox. The only
recipient in the tenant was accounting@cascadestucson.com. Reply-To header was
mismatched (dax.howard@steqm.com vs sender info@syufway.com) — BEC indicator.

Downloaded and analyzed the attachment (W9_AMYSH_Solutions54618.pdf, 84 KB): a filled
IRS W-9 for "AMYSH Solutions", EIN 92-4058031, 75 E Santa Clara St, San Jose CA 95113.
No URLs, no QR codes, no active content — pure vendor-fraud/BEC setup (goal: onboard
fake vendor, get invoice paid). MailItemsAccessed audit showed the email was opened by
ashley.jensen (Outlook Android, 17:32 + 18:16 UTC) and Chris.Knight (Outlook desktop,
17:33 + 18:54 UTC). Message trace confirmed ZERO outbound mail to either attacker
address — nobody replied or acted. Verdict: no compromise; risk limited to paying the
fake invoice.

With Howard's approval, remediated: moved the delivered copy to Deleted Items in the
accounting mailbox (Graph, exchange-op-graph tier) and added syufway.com + steqm.com to
the Tenant Allow/Block List (Sender block, no expiration). Wrote the investigation
report, drafted a client-facing summary explaining findings and why no urgent response
was needed (low threat, client had already identified it as fake), then trimmed it and
DM'd it to Howard on Discord (message_id 1527005883177898024).

## Key Decisions

- Used Graph $search on the mailbox instead of $filter (filter with date-range +
  subject silently returned nothing).
- Soft-deleted (move to deleteditems) rather than hard delete — recoverable as evidence.
- Left the quarantined first copy in quarantine untouched.
- Blocked both the visible sender domain AND the hidden reply-to domain.
- Classified as low-threat BEC (no payload) — justified non-urgent response to client.

## Problems Encountered

- get-token.sh exited 3: vault_path not found — the script read
  /c/Users/Howard/.claude/identity.json (empty) rather than the repo identity.json.
  Fixed by exporting VAULT_ROOT_ENV=/d/vault.
- Get-QuarantineMessage rejected a scalar SenderAddress — parameter is String[];
  must pass a JSON array: {"SenderAddress":["info@syufway.com"]}.
- PreToolUse hook block-tmp-path.sh blocked writing the attachment under /tmp —
  used repo-relative scratch (./.x_*.json) instead, cleaned up after.
- base64 -d failed on Graph contentBytes until CR/LF stripped (tr -d '\r\n').
- Get-MessageTraceV2 (not Get-MessageTrace) is the working cmdlet via adminapi.

## Configuration Changes

- Created: clients/cascades-tucson/reports/2026-07-15-phish-investigation-amu54618.md
- Created: this session log
- M365 tenant changes (cascadestucson.com):
  - Phish message moved to Deleted Items in accounting@cascadestucson.com
  - Tenant Allow/Block List: syufway.com, steqm.com (Sender block, NoExpiration,
    note "BEC/vendor-fraud phish 2026-07-14 AMU54618 - blocked by ACG")

## Credentials & Secrets

- None new. Used existing remediation-tool app tiers (investigator, investigator-exo,
  exchange-op, exchange-op-graph) via SOPS vault at D:/vault (VAULT_ROOT_ENV=/d/vault).

## Infrastructure & Servers

- Tenant: cascadestucson.com = 207fa277-e9d8-4eb7-ada1-1064d2221498
- accounting@cascadestucson.com is a licensed user mailbox "Accounting Dept."
  (id 8540c638-d7d4-456f-a6f6-98bf13c7f087) with FullAccess delegates:
  ashley.jensen, lauren.hasselman, zachary.nelson, Chris.Knight.

## Commands & Outputs

- Message trace: POST https://outlook.office365.com/adminapi/beta/{tenant}/InvokeCommand
  Get-MessageTraceV2 {SenderAddress, StartDate, EndDate} → Quarantined @17:30:23,
  Delivered @17:30:34 (2026-07-14 UTC).
- Audit: Search-UnifiedAuditLog Operations=["MailItemsAccessed"]
  FreeText="NSCCVAyTgUFD3cMIwaf4nl5G1cSc5xC4W4Cr1Rrk0c" → 5 Bind records (ashley.jensen,
  Chris.Knight).
- Delete: POST /users/accounting@cascadestucson.com/messages/{id}/move
  {"destinationId":"deleteditems"} → HTTP 201.
- Block: New-TenantAllowBlockListItems {ListType:"Sender",Block:true,
  Entries:["syufway.com","steqm.com"],NoExpiration:true} → both created.

## Pending / Incomplete Tasks

- Howard to forward the client-facing summary (in his Discord DM) to Cascades.
- Optional: submit the sample to Microsoft as phish (not done).

## Reference Information

- Report: clients/cascades-tucson/reports/2026-07-15-phish-investigation-amu54618.md
- Internet-Message-Id: <NSCCVAyTgUFD3cMIwaf4nl5G1cSc5xC4W4Cr1Rrk0c@localhost>
- Attacker: info@syufway.com (sender), dax.howard@steqm.com (reply-to),
  "AMYSH Solutions" EIN 92-4058031, invoice ref AMU54618.
- Discord DM message_id: 1527005883177898024 (to howard).
