Thread by @chrissanders88

There are many paths you could take with this scenario. At a high level, the big question you want to be answered is whether the user or an attacker set up the forwarding rule. But, you've got to ask other, more specific questions to figure that out. #InvestigationPath #DFIR

https://twitter.com/chrissanders88/status/1633121837336121345

A lot of great responses this week so I won't rehash every path, but there's an opportunity to explore the disposition and prevalence of the client IP, the timing of the rule creation versus AD auth, potential outgoing spam activity,

A few folks pointed out the timing of the rule creation, which is undoubtedly significant. Was the rule created well before djenkins went on their trip? Right before? During it? Those timings all have different implications.

As a general focus, you could spend time finding anomalies from the user's normal baseline or identifying signs of compromise on their system. Either way, you'll build a timeline of relevant events and draw inferences from that.

Many folks jumped straight to containment, and I can understand why because that's an easy call in this scenario -- high risk and low-impact decision in some cases. However, you still have to investigate the scenario even after you've contained it.

My response of the week is from Seth, who was very detailed and covered a lot of meaningful angles.

By the way, how would you go about auditing the inbox/forwarding rules setup across your user base? Something to think about... 🚀

I post an investigation scenario every week!

❓Tuesday: I post the scenario to comment on ✅ Friday: I share some of my thoughts and pick a favorite response

If you like these scenarios, you’ll probably also like some of my writing and courses here: chrissanders.org/links/.