sync: auto-sync from HOWARD-HOME at 2026-07-15 13:59:09

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-15 13:59:09

clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-phish-investigation-amu54618.md

@@ -0,0 +1,104 @@
+# Session Log — Cascades Tucson phishing investigation + remediation (AMU54618)
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Investigated a suspected phishing email reported by Chris Knight at Cascades Tucson:
+"Past Due - AMU54618 - AMYSH Solutions" from Dax Howard <info@syufway.com>, sent
+2026-07-14 to accounting@cascadestucson.com with a PDF attachment. Used the
+remediation-tool skill (Security Investigator tier, read-only) against tenant
+207fa277-e9d8-4eb7-ada1-1064d2221498.
+
+Found the message delivered to the accounting shared mailbox at 17:32 UTC. Message
+trace showed TWO copies sent ~10 seconds apart: the first quarantined by Defender as
+High Confidence Phish (never released), the second delivered to the Inbox. The only
+recipient in the tenant was accounting@cascadestucson.com. Reply-To header was
+mismatched (dax.howard@steqm.com vs sender info@syufway.com) — BEC indicator.
+
+Downloaded and analyzed the attachment (W9_AMYSH_Solutions54618.pdf, 84 KB): a filled
+IRS W-9 for "AMYSH Solutions", EIN 92-4058031, 75 E Santa Clara St, San Jose CA 95113.
+No URLs, no QR codes, no active content — pure vendor-fraud/BEC setup (goal: onboard
+fake vendor, get invoice paid). MailItemsAccessed audit showed the email was opened by
+ashley.jensen (Outlook Android, 17:32 + 18:16 UTC) and Chris.Knight (Outlook desktop,
+17:33 + 18:54 UTC). Message trace confirmed ZERO outbound mail to either attacker
+address — nobody replied or acted. Verdict: no compromise; risk limited to paying the
+fake invoice.
+
+With Howard's approval, remediated: moved the delivered copy to Deleted Items in the
+accounting mailbox (Graph, exchange-op-graph tier) and added syufway.com + steqm.com to
+the Tenant Allow/Block List (Sender block, no expiration). Wrote the investigation
+report, drafted a client-facing summary explaining findings and why no urgent response
+was needed (low threat, client had already identified it as fake), then trimmed it and
+DM'd it to Howard on Discord (message_id 1527005883177898024).
+
+## Key Decisions
+
+- Used Graph $search on the mailbox instead of $filter (filter with date-range +
+  subject silently returned nothing).
+- Soft-deleted (move to deleteditems) rather than hard delete — recoverable as evidence.
+- Left the quarantined first copy in quarantine untouched.
+- Blocked both the visible sender domain AND the hidden reply-to domain.
+- Classified as low-threat BEC (no payload) — justified non-urgent response to client.
+
+## Problems Encountered
+
+- get-token.sh exited 3: vault_path not found — the script read
+  /c/Users/Howard/.claude/identity.json (empty) rather than the repo identity.json.
+  Fixed by exporting VAULT_ROOT_ENV=/d/vault.
+- Get-QuarantineMessage rejected a scalar SenderAddress — parameter is String[];
+  must pass a JSON array: {"SenderAddress":["info@syufway.com"]}.
+- PreToolUse hook block-tmp-path.sh blocked writing the attachment under /tmp —
+  used repo-relative scratch (./.x_*.json) instead, cleaned up after.
+- base64 -d failed on Graph contentBytes until CR/LF stripped (tr -d '\r\n').
+- Get-MessageTraceV2 (not Get-MessageTrace) is the working cmdlet via adminapi.
+
+## Configuration Changes
+
+- Created: clients/cascades-tucson/reports/2026-07-15-phish-investigation-amu54618.md
+- Created: this session log
+- M365 tenant changes (cascadestucson.com):
+  - Phish message moved to Deleted Items in accounting@cascadestucson.com
+  - Tenant Allow/Block List: syufway.com, steqm.com (Sender block, NoExpiration,
+    note "BEC/vendor-fraud phish 2026-07-14 AMU54618 - blocked by ACG")
+
+## Credentials & Secrets
+
+- None new. Used existing remediation-tool app tiers (investigator, investigator-exo,
+  exchange-op, exchange-op-graph) via SOPS vault at D:/vault (VAULT_ROOT_ENV=/d/vault).
+
+## Infrastructure & Servers
+
+- Tenant: cascadestucson.com = 207fa277-e9d8-4eb7-ada1-1064d2221498
+- accounting@cascadestucson.com is a licensed user mailbox "Accounting Dept."
+  (id 8540c638-d7d4-456f-a6f6-98bf13c7f087) with FullAccess delegates:
+  ashley.jensen, lauren.hasselman, zachary.nelson, Chris.Knight.
+
+## Commands & Outputs
+
+- Message trace: POST https://outlook.office365.com/adminapi/beta/{tenant}/InvokeCommand
+  Get-MessageTraceV2 {SenderAddress, StartDate, EndDate} → Quarantined @17:30:23,
+  Delivered @17:30:34 (2026-07-14 UTC).
+- Audit: Search-UnifiedAuditLog Operations=["MailItemsAccessed"]
+  FreeText="NSCCVAyTgUFD3cMIwaf4nl5G1cSc5xC4W4Cr1Rrk0c" → 5 Bind records (ashley.jensen,
+  Chris.Knight).
+- Delete: POST /users/accounting@cascadestucson.com/messages/{id}/move
+  {"destinationId":"deleteditems"} → HTTP 201.
+- Block: New-TenantAllowBlockListItems {ListType:"Sender",Block:true,
+  Entries:["syufway.com","steqm.com"],NoExpiration:true} → both created.
+
+## Pending / Incomplete Tasks
+
+- Howard to forward the client-facing summary (in his Discord DM) to Cascades.
+- Optional: submit the sample to Microsoft as phish (not done).
+
+## Reference Information
+
+- Report: clients/cascades-tucson/reports/2026-07-15-phish-investigation-amu54618.md
+- Internet-Message-Id: <NSCCVAyTgUFD3cMIwaf4nl5G1cSc5xC4W4Cr1Rrk0c@localhost>
+- Attacker: info@syufway.com (sender), dax.howard@steqm.com (reply-to),
+  "AMYSH Solutions" EIN 92-4058031, invoice ref AMU54618.
+- Discord DM message_id: 1527005883177898024 (to howard).