azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
claudetools/clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-phish-investigation-amu54618.md
Howard Enos 4e3cf71851 sync: auto-sync from HOWARD-HOME at 2026-07-15 13:59:09 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-15 13:59:09
2026-07-15 13:59:40 -07:00

5.2 KiB
Raw Permalink Blame History

Session Log — Cascades Tucson phishing investigation + remediation (AMU54618)

User

  • User: Howard Enos (howard)
  • Machine: Howard-Home
  • Role: tech

Session Summary

Investigated a suspected phishing email reported by Chris Knight at Cascades Tucson: "Past Due - AMU54618 - AMYSH Solutions" from Dax Howard info@syufway.com, sent 2026-07-14 to accounting@cascadestucson.com with a PDF attachment. Used the remediation-tool skill (Security Investigator tier, read-only) against tenant 207fa277-e9d8-4eb7-ada1-1064d2221498.

Found the message delivered to the accounting shared mailbox at 17:32 UTC. Message trace showed TWO copies sent ~10 seconds apart: the first quarantined by Defender as High Confidence Phish (never released), the second delivered to the Inbox. The only recipient in the tenant was accounting@cascadestucson.com. Reply-To header was mismatched (dax.howard@steqm.com vs sender info@syufway.com) — BEC indicator.

Downloaded and analyzed the attachment (W9_AMYSH_Solutions54618.pdf, 84 KB): a filled IRS W-9 for "AMYSH Solutions", EIN 92-4058031, 75 E Santa Clara St, San Jose CA 95113. No URLs, no QR codes, no active content — pure vendor-fraud/BEC setup (goal: onboard fake vendor, get invoice paid). MailItemsAccessed audit showed the email was opened by ashley.jensen (Outlook Android, 17:32 + 18:16 UTC) and Chris.Knight (Outlook desktop, 17:33 + 18:54 UTC). Message trace confirmed ZERO outbound mail to either attacker address — nobody replied or acted. Verdict: no compromise; risk limited to paying the fake invoice.

With Howard's approval, remediated: moved the delivered copy to Deleted Items in the accounting mailbox (Graph, exchange-op-graph tier) and added syufway.com + steqm.com to the Tenant Allow/Block List (Sender block, no expiration). Wrote the investigation report, drafted a client-facing summary explaining findings and why no urgent response was needed (low threat, client had already identified it as fake), then trimmed it and DM'd it to Howard on Discord (message_id 1527005883177898024).

Key Decisions

  • Used Graph $search on the mailbox instead of $filter (filter with date-range + subject silently returned nothing).
  • Soft-deleted (move to deleteditems) rather than hard delete — recoverable as evidence.
  • Left the quarantined first copy in quarantine untouched.
  • Blocked both the visible sender domain AND the hidden reply-to domain.
  • Classified as low-threat BEC (no payload) — justified non-urgent response to client.

Problems Encountered

  • get-token.sh exited 3: vault_path not found — the script read /c/Users/Howard/.claude/identity.json (empty) rather than the repo identity.json. Fixed by exporting VAULT_ROOT_ENV=/d/vault.
  • Get-QuarantineMessage rejected a scalar SenderAddress — parameter is String[]; must pass a JSON array: {"SenderAddress":["info@syufway.com"]}.
  • PreToolUse hook block-tmp-path.sh blocked writing the attachment under /tmp — used repo-relative scratch (./.x_*.json) instead, cleaned up after.
  • base64 -d failed on Graph contentBytes until CR/LF stripped (tr -d '\r\n').
  • Get-MessageTraceV2 (not Get-MessageTrace) is the working cmdlet via adminapi.

Configuration Changes

  • Created: clients/cascades-tucson/reports/2026-07-15-phish-investigation-amu54618.md
  • Created: this session log
  • M365 tenant changes (cascadestucson.com):
    • Phish message moved to Deleted Items in accounting@cascadestucson.com
    • Tenant Allow/Block List: syufway.com, steqm.com (Sender block, NoExpiration, note "BEC/vendor-fraud phish 2026-07-14 AMU54618 - blocked by ACG")

Credentials & Secrets

  • None new. Used existing remediation-tool app tiers (investigator, investigator-exo, exchange-op, exchange-op-graph) via SOPS vault at D:/vault (VAULT_ROOT_ENV=/d/vault).

Infrastructure & Servers

  • Tenant: cascadestucson.com = 207fa277-e9d8-4eb7-ada1-1064d2221498
  • accounting@cascadestucson.com is a licensed user mailbox "Accounting Dept." (id 8540c638-d7d4-456f-a6f6-98bf13c7f087) with FullAccess delegates: ashley.jensen, lauren.hasselman, zachary.nelson, Chris.Knight.

Commands & Outputs

  • Message trace: POST https://outlook.office365.com/adminapi/beta/{tenant}/InvokeCommand Get-MessageTraceV2 {SenderAddress, StartDate, EndDate} → Quarantined @17:30:23, Delivered @17:30:34 (2026-07-14 UTC).
  • Audit: Search-UnifiedAuditLog Operations=["MailItemsAccessed"] FreeText="NSCCVAyTgUFD3cMIwaf4nl5G1cSc5xC4W4Cr1Rrk0c" → 5 Bind records (ashley.jensen, Chris.Knight).
  • Delete: POST /users/accounting@cascadestucson.com/messages/{id}/move {"destinationId":"deleteditems"} → HTTP 201.
  • Block: New-TenantAllowBlockListItems {ListType:"Sender",Block:true, Entries:["syufway.com","steqm.com"],NoExpiration:true} → both created.

Pending / Incomplete Tasks

  • Howard to forward the client-facing summary (in his Discord DM) to Cascades.
  • Optional: submit the sample to Microsoft as phish (not done).

Reference Information

Reference in New Issue View Git Blame Copy Permalink