◇ OpenCyber Academy
Rapid course · Chapter 2 · English

Chapter 2 — Spotting the signs

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Spotting the signs

Lesson map

Lesson 02 published. Map, example, EX014.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Sign-in records"]
  N2["Lab — unusual sign-ins"]
  N3["2.2 Lab result"]
  N4["2.3 Forwarding rules"]
  N5["2.4 The story"]
  N6["2.5 Not jumping to conclusions"]
  N7["2.6 ATT&CK"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX014"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Sign-in records"]
  N2["Lab — unusual sign-ins"]
  N3["2.2 Lab result"]
  N4["2.3 Forwarding rules"]
  N5["2.4 The story"]
  N6["2.5 Not jumping to conclusions"]
  N7["2.6 ATT&CK"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX014"]

[Learning outcomes]
    |
    v
[2.1 Sign-in records]
    |
    v
[Lab — unusual sign-ins]
    |
    v
[2.2 Lab result]
    |
    v
[2.3 Forwarding rules]
    |
    v
[2.4 The story]
    |
    v
[2.5 Not jumping to conclusions]
    |
    v
[2.6 ATT&CK]
    |
    v
[Worked example] --> [Exercise EX014]

Learning outcomes

You will (1) read sign-in records for unusual country and time; (2) find mailbox forwarding rules; (3) connect signals into a story; (4) avoid jumping to conclusions.

2.1 Sign-in records

The email service records each sign-in with user, time and approximate country. NIST SP 800-92 (Kent and Souppaya, 2006) explains why such logs must be kept and checked; Leo asks BrightPath to keep 90 days.

Ninety days matters here. Elaine entered her password on the fake page on Thursday, and the client phoned on Monday, so the records needed went back only a few days. In many cases a stolen password is used weeks later, and if BrightPath kept only a week of sign-ins, the first criminal sign-in could already be gone by the time anyone looked.

Lab — unusual sign-ins

"""Flag synthetic mailbox sign-ins from unusual countries or at unusual hours."""
usual = {"UK"}
signins = [("e.finch", "Fri 08:52", "UK"), ("e.finch", "Fri 13:05", "UK"), ("e.finch", "Fri 23:47", "BR"),
           ("s.marlow", "Fri 09:10", "UK"), ("l.barros", "Fri 08:30", "UK"), ("e.finch", "Sat 00:02", "BR")]
for user, when, country in signins:
    hour = int(when.split()[1][:2])
    flags = [f for f, bad in (("new country", country not in usual), ("night", hour < 6 or hour >= 22)) if bad]
    print(f"{user:9} {when} {country} {'CHECK: ' + ', '.join(flags) if flags else 'ok'}")

Run with python3 lab_signins.py. Verified output:

e.finch   Fri 08:52 UK ok
e.finch   Fri 13:05 UK ok
e.finch   Fri 23:47 BR CHECK: new country, night
s.marlow  Fri 09:10 UK ok
l.barros  Fri 08:30 UK ok
e.finch   Sat 00:02 BR CHECK: new country, night

2.2 Lab result

Two of Elaine's sign-ins are flagged: Friday 23:47 and Saturday 00:02, both from Brazil (BR) and both at night. Her daytime sign-ins from the UK, and other staff's, are normal.

The lab flags each sign-in for two separate reasons, a country not on the usual list and a time between 22:00 and 06:00, and prints both when both apply. Both of Elaine's Brazil sign-ins carry both flags, which makes them stronger leads than a sign-in with only one. Elaine's Friday 08:52 and 13:05 sign-ins from the UK show her own normal pattern.

2.3 Forwarding rules

BrightPath checks Elaine's mailbox: at 23:51 on Friday a rule was created that forwards any email containing "invoice" or "payment" to an outside address and deletes the copy. This hid the fraud from Elaine.

The rule explains the timeline: the criminal signed in from Brazil at 23:47 and set up the rule four minutes later. Forwarding then deleting means Elaine never saw clients' replies about the new bank account. That is why no one at the firm noticed, and why the fraud came to light only when a client phoned.

2.4 The story

Thursday: Elaine entered her password on a fake "document shared with you" page. Friday night: a criminal signed in, created the rule and sent the fake invoice to two clients. MFA was not enabled on her account.

Each step has evidence. The fake page appears in Elaine's browser history. The two Brazil sign-ins appear in the sign-in records. The 23:51 forwarding rule appears in her mailbox settings. The two fake invoices appear in her sent items. Because each step has its own source, Leo can tell the partners what happened without guessing, and BrightPath knows what to undo.

2.5 Not jumping to conclusions

A new country can be travel; Leo checks Elaine was at home. Night sign-ins can be a phone syncing; the country rules this out.

Here both checks point the same way. Elaine was at home in the UK that weekend, so the Brazil sign-ins were not her travelling; and a phone syncing at night would sign in from the UK, not from Brazil. With travel and syncing ruled out, the two sign-ins become strong evidence that someone else used her password.

2.6 ATT&CK

MITRE ATT&CK (Strom et al., 2018) lists email forwarding rules as a known collection technique; BrightPath uses this to check for similar rules on other mailboxes.

The ATT&CK entry gives BrightPath a name to search for. It searched all 12 mailboxes for rules forwarding to outside addresses, found that only Elaine's had one, and checked that no other staff member had unusual sign-ins. That is how the firm knows the problem was limited to one account, not just assumed so.

Worked example

Before relying on Elaine's account of the weekend, Leo phones her rather than emailing, since her mailbox may still be controlled by the criminal. She confirms she was at home in the UK that weekend, the fact 2.5 needs to rule out travel as the reason for the Brazil sign-ins.

Synthetic case. Sign-ins and rules are synthetic.

Errors and limits

Country information is approximate and can be hidden by services that route traffic.

Exercises

Synthesis

Unusual sign-ins plus a hidden forwarding rule told the story; check innocent explanations first.

Continue studying — chapter 02 of 04

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →