Phishing to Payroll: Severity and the Notification Clock
An insurer's 24/7 SOC has four analysts on shift and receives about 900 alerts per day; only 12% are escalated. At 09:10 on a Monday, the phishing mailbox reports 60 clicks on a fake payroll page, three credential submissions, and one inbox rule forwarding finance mail to an external address. EDR flags certutil decoding a file on the same user's laptop. The SOC's IR plan was last tested 14 months ago and names a single incident commander who is on leave. The legal team wants all evidence preserved and asks whether notification is required. The insurer has 9,000 employees and 2.3 million policyholders; the state breach law has a 30-day notification clock. The SOC manager must decide severity, containment, and who leads.
1. Set the severity and justify it. What facts would move it up or down?
Read the worked answer
Set this at SEV-2 high initially, not SEV-1, because there is confirmed credential compromise and an external mailbox forwarding rule, but no confirmed data exfiltration or lateral movement yet. Factors that raise severity: certutil decoding a payload on the same host, successful mailbox access, finance mail being forwarded, multiple credential submissions, and an untested IR plan with the named commander unavailable. Factors that lower it: only a phishing page, no MFA bypass evidence, no data transfer evidence, and a user report. Severity criteria should weight identity compromise, data sensitivity, spread, and the regulatory clock, not just alert volume. Assign a deputy incident commander immediately; do not wait for the named commander. If forensics shows the rule was active for days, finance mail left the organization, or the host shows lateral movement, escalate to SEV-1. Engage legal now because the 30-day clock may start at discovery, not at confirmation.
2. What containment sequence would you order in the first four hours?
Read the worked answer
Preserve evidence before remediation. Isolate the laptop through EDR network containment rather than shutting it down, capture memory if possible, and export mailbox audit logs and the forwarding rule. Then disable the compromised account, revoke sessions and tokens, reset the password, and force MFA re-registration. Remove the inbox rule and check for other rules, delegation, and mailbox permissions. Search the estate for the certutil command line and payload hash, block the hash and phishing domains, and identify the other users who submitted credentials and force resets. Check email logs for external forwarding and finance mail exfiltration. Brief legal and communications and start a timeline. Order matters: evidence capture before deleting the rule, identity containment before broad hunting. Keep email flowing for unaffected users. Document each action with time and owner, and escalate to full incident response if domain administrator compromise is suspected.
3. Legal asks whether the 30-day notification clock applies. How do you advise, and what do you need to decide?
Read the worked answer
Advise that the clock likely starts at discovery of unauthorized acquisition, not merely access, and that the facts are insufficient. Security should provide the data inventory, not a legal conclusion: what the mailbox contained, whether the forwarding rule sent messages externally, whether the attacker logged in, whether the data was encrypted, and whether policyholder PII was involved. Preserve evidence and avoid definitive legal claims. If exfiltration of PII is confirmed, recommend that legal notify within 30 days; if only credential access occurred, document the risk assessment and rationale. Notify the cyber insurer and consider law enforcement. Set an internal decision deadline, such as 72 hours, to preserve the 30-day window. Do not wait for complete forensics before legal makes a preliminary risk determination. Keep communications privileged where possible and coordinate any customer message with legal and communications.