105 lines
5.2 KiB
Markdown
105 lines
5.2 KiB
Markdown
# Session Log — Cascades Tucson phishing investigation + remediation (AMU54618)
|
|
|
|
## User
|
|
- **User:** Howard Enos (howard)
|
|
- **Machine:** Howard-Home
|
|
- **Role:** tech
|
|
|
|
## Session Summary
|
|
|
|
Investigated a suspected phishing email reported by Chris Knight at Cascades Tucson:
|
|
"Past Due - AMU54618 - AMYSH Solutions" from Dax Howard <info@syufway.com>, sent
|
|
2026-07-14 to accounting@cascadestucson.com with a PDF attachment. Used the
|
|
remediation-tool skill (Security Investigator tier, read-only) against tenant
|
|
207fa277-e9d8-4eb7-ada1-1064d2221498.
|
|
|
|
Found the message delivered to the accounting shared mailbox at 17:32 UTC. Message
|
|
trace showed TWO copies sent ~10 seconds apart: the first quarantined by Defender as
|
|
High Confidence Phish (never released), the second delivered to the Inbox. The only
|
|
recipient in the tenant was accounting@cascadestucson.com. Reply-To header was
|
|
mismatched (dax.howard@steqm.com vs sender info@syufway.com) — BEC indicator.
|
|
|
|
Downloaded and analyzed the attachment (W9_AMYSH_Solutions54618.pdf, 84 KB): a filled
|
|
IRS W-9 for "AMYSH Solutions", EIN 92-4058031, 75 E Santa Clara St, San Jose CA 95113.
|
|
No URLs, no QR codes, no active content — pure vendor-fraud/BEC setup (goal: onboard
|
|
fake vendor, get invoice paid). MailItemsAccessed audit showed the email was opened by
|
|
ashley.jensen (Outlook Android, 17:32 + 18:16 UTC) and Chris.Knight (Outlook desktop,
|
|
17:33 + 18:54 UTC). Message trace confirmed ZERO outbound mail to either attacker
|
|
address — nobody replied or acted. Verdict: no compromise; risk limited to paying the
|
|
fake invoice.
|
|
|
|
With Howard's approval, remediated: moved the delivered copy to Deleted Items in the
|
|
accounting mailbox (Graph, exchange-op-graph tier) and added syufway.com + steqm.com to
|
|
the Tenant Allow/Block List (Sender block, no expiration). Wrote the investigation
|
|
report, drafted a client-facing summary explaining findings and why no urgent response
|
|
was needed (low threat, client had already identified it as fake), then trimmed it and
|
|
DM'd it to Howard on Discord (message_id 1527005883177898024).
|
|
|
|
## Key Decisions
|
|
|
|
- Used Graph $search on the mailbox instead of $filter (filter with date-range +
|
|
subject silently returned nothing).
|
|
- Soft-deleted (move to deleteditems) rather than hard delete — recoverable as evidence.
|
|
- Left the quarantined first copy in quarantine untouched.
|
|
- Blocked both the visible sender domain AND the hidden reply-to domain.
|
|
- Classified as low-threat BEC (no payload) — justified non-urgent response to client.
|
|
|
|
## Problems Encountered
|
|
|
|
- get-token.sh exited 3: vault_path not found — the script read
|
|
/c/Users/Howard/.claude/identity.json (empty) rather than the repo identity.json.
|
|
Fixed by exporting VAULT_ROOT_ENV=/d/vault.
|
|
- Get-QuarantineMessage rejected a scalar SenderAddress — parameter is String[];
|
|
must pass a JSON array: {"SenderAddress":["info@syufway.com"]}.
|
|
- PreToolUse hook block-tmp-path.sh blocked writing the attachment under /tmp —
|
|
used repo-relative scratch (./.x_*.json) instead, cleaned up after.
|
|
- base64 -d failed on Graph contentBytes until CR/LF stripped (tr -d '\r\n').
|
|
- Get-MessageTraceV2 (not Get-MessageTrace) is the working cmdlet via adminapi.
|
|
|
|
## Configuration Changes
|
|
|
|
- Created: clients/cascades-tucson/reports/2026-07-15-phish-investigation-amu54618.md
|
|
- Created: this session log
|
|
- M365 tenant changes (cascadestucson.com):
|
|
- Phish message moved to Deleted Items in accounting@cascadestucson.com
|
|
- Tenant Allow/Block List: syufway.com, steqm.com (Sender block, NoExpiration,
|
|
note "BEC/vendor-fraud phish 2026-07-14 AMU54618 - blocked by ACG")
|
|
|
|
## Credentials & Secrets
|
|
|
|
- None new. Used existing remediation-tool app tiers (investigator, investigator-exo,
|
|
exchange-op, exchange-op-graph) via SOPS vault at D:/vault (VAULT_ROOT_ENV=/d/vault).
|
|
|
|
## Infrastructure & Servers
|
|
|
|
- Tenant: cascadestucson.com = 207fa277-e9d8-4eb7-ada1-1064d2221498
|
|
- accounting@cascadestucson.com is a licensed user mailbox "Accounting Dept."
|
|
(id 8540c638-d7d4-456f-a6f6-98bf13c7f087) with FullAccess delegates:
|
|
ashley.jensen, lauren.hasselman, zachary.nelson, Chris.Knight.
|
|
|
|
## Commands & Outputs
|
|
|
|
- Message trace: POST https://outlook.office365.com/adminapi/beta/{tenant}/InvokeCommand
|
|
Get-MessageTraceV2 {SenderAddress, StartDate, EndDate} → Quarantined @17:30:23,
|
|
Delivered @17:30:34 (2026-07-14 UTC).
|
|
- Audit: Search-UnifiedAuditLog Operations=["MailItemsAccessed"]
|
|
FreeText="NSCCVAyTgUFD3cMIwaf4nl5G1cSc5xC4W4Cr1Rrk0c" → 5 Bind records (ashley.jensen,
|
|
Chris.Knight).
|
|
- Delete: POST /users/accounting@cascadestucson.com/messages/{id}/move
|
|
{"destinationId":"deleteditems"} → HTTP 201.
|
|
- Block: New-TenantAllowBlockListItems {ListType:"Sender",Block:true,
|
|
Entries:["syufway.com","steqm.com"],NoExpiration:true} → both created.
|
|
|
|
## Pending / Incomplete Tasks
|
|
|
|
- Howard to forward the client-facing summary (in his Discord DM) to Cascades.
|
|
- Optional: submit the sample to Microsoft as phish (not done).
|
|
|
|
## Reference Information
|
|
|
|
- Report: clients/cascades-tucson/reports/2026-07-15-phish-investigation-amu54618.md
|
|
- Internet-Message-Id: <NSCCVAyTgUFD3cMIwaf4nl5G1cSc5xC4W4Cr1Rrk0c@localhost>
|
|
- Attacker: info@syufway.com (sender), dax.howard@steqm.com (reply-to),
|
|
"AMYSH Solutions" EIN 92-4058031, invoice ref AMU54618.
|
|
- Discord DM message_id: 1527005883177898024 (to howard).
|