Respond to Phishing Incident – My Findings

Overview

In this lab, I followed our phishing playbook to triage alert A-2703 for a known-malicious file. I updated the ticket status, assessed the alert details against our procedures, and recorded clear comments and supporting information.

Scenario

As a Level-1 SOC analyst at a financial services firm, I received a phishing alert about a user downloading “bfsvc.exe” inside a password-protected spreadsheet. The SHA256 hash was already flagged by multiple vendors, so I needed to execute the playbook steps, decide whether to escalate, and complete the alert ticket.

Completed Alert Ticket

Ticket Comments

I noted that the sender address (76tguyhh6tgftrt7tg.su) did not match the display name “Def Communications” or the signature (“Clyde West”), and the body contained grammatical errors. The password-protected attachment “bfsvc.exe” was downloaded and executed. Given the previously confirmed malicious hash, I escalated this ticket to Level-2 for further containment and analysis.

Additional Information

← Back to Portfolio