azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
347b2d30a9a1a7b0f7882ccf5ce5920e277a3d62
claudetools/clients/cascades-tucson/reports/2026-04-20-john-trozzi-spoof-email-check.md
Howard Enos a92d2d3f2c report: Cascades Tucson phishing sweep - deleted 14 phish across 7 users 
Triggered by John Trozzi reporting a spoof email. Single-user check
confirmed him clean (reported, not compromised). Tenant-wide sweep
found a sustained ~1 month campaign from 4 external IPs (UA/US/DE/AT
- deltahost + ColoCrossing) plus a compromised-M365-tenant relay
vector. Deleted 14 messages (Groups A+B) per Mike's explicit
authorization. Preserved legitimate HR thread (HRPYDBRUN xlsx) and
user outbound forwards as evidence.

Recommendations in report: DMARC p=quarantine/reject for
cascadestucson.com (biggest leverage), TABL IP blocks, zoom.nl
URL block, Defender impersonation protection.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-20 09:39:22 -07:00

7.9 KiB
Raw Blame History

John Trozzi — Spoof Email Report / Follow-up Breach Check

Date: 2026-04-20 Tenant: Cascades Tucson (cascadestucson.com, 207fa277-e9d8-4eb7-ada1-1064d2221498) Subject: John Trozzi (john.trozzi@cascadestucson.com, a638f4b9-6936-4401-a9b7-015b9900e49e) Tool: Claude-MSP-Access / ComputerGuru - AI Remediation (App ID fabb3421-8b34-484b-bc17-e46de9703418) Scope: Read-only (no remediation actions executed) Trigger: John told Mike he received a spoof email. He forwarded it to howard@azcomputerguru.com at 12:23 UTC today.

Summary

  • No breach indicators. John reported the phishing email himself — he is not a victim. He forwarded the message to Howard and then emailed Mike about it.
  • The phishing lure: subject "ATTN!! — Pending 5 (Pages) Documents expires in 2 days REF, ID:f1bb60a2a1d6ae023a3c3e0c0f959a8d" — classic DocuSign/fake-document-expiry style.
  • Mailbox posture is clean across all 10 checks: zero inbox rules (including hidden), no forwarding, no delegates, no SendAs grants, no new OAuth consents in the attack window, all MFA methods predate the event, sign-ins are 100% Phoenix AZ.
  • Identity Protection riskyUser.riskState = remediated from the prior 2026-04-16 incident (userPerformedSecuredPasswordReset). Current risk level none. That risk event is closed and unrelated to today's report.
  • Recommended next step: confirm with John he did not click or enter credentials; block the sender tenant-wide; add to phish training examples. No account action required.

Target details

Field Value
UPN john.trozzi@cascadestucson.com
Object ID a638f4b9-6936-4401-a9b7-015b9900e49e
Account Enabled true
Created 2022-02-18T18:31:39Z
Last Password Change 2026-04-16T16:05:11Z (4 days ago, self-change after admin-initiated IR reset)

Per-check findings

1. Inbox rules (Graph) — CLEAN

/users/{upn}/mailFolders/inbox/messageRules → value: []. No rules.

2. Mailbox forwarding / settings — CLEAN

  • forwardingSmtpAddress: null
  • Mailbox settings: no forwarding configured.

3. Exchange REST (hidden rules, delegates, SendAs, Get-Mailbox) — CLEAN

  • Get-InboxRule -IncludeHidden: 0 rules beyond system defaults.
  • Get-MailboxPermission: only NT AUTHORITY\SELF. No delegates.
  • Get-RecipientPermission (SendAs): only NT AUTHORITY\SELF. No SendAs grants.
  • Get-Mailbox: ForwardingAddress=null, ForwardingSmtpAddress=null, DeliverToMailboxAndForward=null.

4. OAuth consents + app role assignments — CLEAN

Single longstanding consent:

  • BlueMail (clientId 3508ac12-63ff-4cc5-8edb-f3bb9ca63e4e)
    • Graph scope: User.Read
    • Exchange Online scope: EAS.AccessAsUser.All Exchange.Manage
    • App role assignment created 2022-02-18 (account creation day — legitimate and pre-dates any attack window).
  • No new consents in the attack window.

5. Authentication methods — CLEAN (strong posture)

  • Password (last changed 2026-04-16T16:05:11Z)
  • Phone
  • 2x Microsoft Authenticator
  • FIDO2 security key

All non-password methods predate the 2026-04-16 IR event. No new method added in the attack window.

6. Sign-ins (30d, interactive) — CLEAN

  • 12 sign-ins, all successful, all from 184.191.143.62 (Phoenix, AZ, US — CenturyLink/Qwest residential).
  • 0 non-US sign-ins.
  • Apps: Microsoft Authentication Broker, My Signins, Microsoft Account Controls V2 (all legitimate portal/auth flows).
  • Devices: Android (Chrome Mobile) and Windows 10 (Chrome). Consistent with John's normal devices.

7. Directory audits (30d, filtered to John) — CLEAN

41 events, all clustered on 2026-04-16 and attributable to:

  • sysadmin@cascadestucson.com (MSP admin running the IR reset)
  • John himself (self-service password change post-reset)
  • Microsoft system actors (Substrate Management, MFA StrongAuthenticationService)

No audit events in the last 3 days. No unauthorized changes.

8. Risky users / risk detections

  • riskyUser.riskLevel: none
  • riskyUser.riskState: remediated
  • riskyUser.riskDetail: userPerformedSecuredPasswordReset
  • riskyUser.riskLastUpdatedDateTime: 2026-04-16T15:45:55Z
  • riskDetections (30d): 0

The remediated flag is the closure marker for the prior 2026-04-16 incident. No new risk detections since.

9. Sent items (recent 25) — CLEAN + evidence of the report

Top of the list is John reporting the phishing to us:

Sent (UTC) Subject To
2026-04-20 12:26:51 Spoof emails mike@azcomputerguru.com
2026-04-20 12:23:50 Fw: ATTN!! — Pending 5 (Pages) Documents expires in 2 days REF, ID:f1bb60a2a1d6ae023a3c3e0c0f959a8d howard@azcomputerguru.com
2026-04-17 20:15:58 312 FLOORING 2OF 2 prods_0478@homedepot.com
2026-04-17 20:04:01 312 CABINETS 1 OF 2 prods_0478@homedepot.com
2026-04-17 19:58:12 FW: Caregivers & medtech howard@azcomputerguru.com
2026-04-17 18:47:03 Re: Model 1 Commercial Vehicles Follow Up AFreer@model1.com
2026-04-17 15:26:51 RE: Cascades of Tucson - UE Revised Door Access Control Design Estimate wpeterson@unwiredengineering.com
2026-04-17 14:57:30 Fw: Cascades of Tucson - UE Revised Door Access Control Design Estimate mike@azcomputerguru.com
2026-04-16 21:47:22 Re: license upgrade meredith.kuhn@cascadestucson.com (+ mike, howard, crystal)
... ... ...

All other outbound is legitimate vendor/internal business correspondence (Home Depot, Model 1, Unwired Engineering, internal Cascades, DirecTV). No blast patterns, no external bulk sends, no credential-harvest style outbound.

10. Deleted items (recent 25) — CLEAN

Normal marketing (Wayfair, BestBuy, Spotify, Floor & Decor), 8x8 voicemail notifications, vendor promotional email, and a few legitimate business messages. No deleted security alerts, MFA prompts, or password-reset confirmations — the tells of an attacker cleaning their tracks are absent.

Suspicious items

None arising from this check. The only noteworthy item is the phishing email itself, which John handled correctly (reported rather than clicked).

Gaps — checks not completed

None. All 10 checks completed successfully. Exchange REST and Identity Protection permissions are both in place for this tenant after the 2026-04-16 remediation.

Relationship to prior investigation

On 2026-04-16, John was flagged as a risky user and an IR sequence was executed (see clients/cascades-tucson/reports/2026-04-16-john-breach-check.md). That incident was remediated via self-service secured password reset. Today's event is separate — John received a phishing email, recognized it, and reported it. No fresh compromise indicators.

Next actions

  1. Talk to John — confirm he did not click the link or enter credentials. Ask if he sees additional copies of the message or variations still arriving. If he did click, run revoke-sessions + force password reset immediately.
  2. Block the sender — pull the original message headers from Howard's inbox; add sender domain to Exchange Online Tenant Allow/Block List or the anti-phish policy.
  3. Check other recipients — query mail trace for the same Message-ID/subject across the tenant; if other Cascades users received the same lure, flag them for the same conversation.
  4. Add to phishing training catalog — this is a textbook DocuSign-style impersonation. Worth using as a training example for staff.
  5. No account remediation required at this time.

Remediation actions

None executed. Read-only check.

Data artifacts

Raw JSON at /tmp/remediation-tool/207fa277-e9d8-4eb7-ada1-1064d2221498/user-breach/john_trozzi_cascadestucson_com/:

  • 00_user.json
  • 01_inbox_rules_graph.json
  • 02_mailbox_settings.json
  • 03a_InboxRule_hidden.json
  • 03b_MailboxPermission.json
  • 03c_RecipientPermission.json
  • 03d_Mailbox.json
  • 04a_oauth_grants.json
  • 04b_app_role_assignments.json
  • 05_auth_methods.json
  • 06_signins.json
  • 07_dir_audits.json
  • 08a_risky_user.json
  • 08b_risk_detections.json
  • 09_sent.json
  • 10_deleted.json
Reference in New Issue View Git Blame Copy Permalink