How to Identify and Analyze an Internal Phishing Campaign Using Email and System Logs

Phishing campaigns aim to trick users into divulging sensitive information or executing malicious payloads. Detecting an internal phishing campaign involves monitoring email, user activity, and system logs for suspicious behavior.

---

1. Analyze Email Logs for Phishing Indicators

What to Look For:

• Suspicious Emails:

  • Emails from external domains mimicking legitimate internal domains.

  • Attachments with executable or macro-enabled files.

  • Links directing to unfamiliar or malicious URLs.

• Header Analysis:

  • Check for mismatched sender names and domains.

  • Look for spoofed email headers or unusual reply-to addresses.

Red Flags: Emails with typos in domain names (e.g., "example.com" vs. "examp1e.com"), unexpected attachments, or links with long, obfuscated URLs.

---

2. Check User Activity After Receiving Suspicious Emails

What to Look For:

• User Logon Events:

  • Event ID 4624: Logs successful logons. Correlate user activity with email receipt times.

• Unusual Behavior:

  • Increased logon attempts or unusual patterns, such as logons from new devices or locations.

Analysis Tip: Focus on users who received suspicious emails and then displayed unusual or heightened system activity.

---

3. Examine Web Proxy Logs for Malicious Link Clicks

What to Look For:

• Domain Access Patterns:

  • Proxy logs showing clicks on links contained in phishing emails.

  • Access to newly registered domains or domains with low reputation scores.

• Timing:

  • Traffic to malicious URLs shortly after email delivery.

Red Flags: Connections to domains with no prior history in your organization or flagged in threat intelligence feeds.

---

4. Investigate Endpoint Logs for Malicious File Execution

What to Look For:

• Process Creation Events:

  • Event ID 4688: Logs the execution of processes. Look for:

    • Files or scripts originating from temporary or download directories.

    • Execution of known malicious file types (e.g., .exe, .js, .vbs).

• Unexpected Application Behavior:

  • Applications like cmd.exe or powershell.exe launched by unknown or suspicious executables.

Red Flags: Processes spawned from email attachments or files downloaded via suspicious links.

---

5. Monitor for Credential Harvesting Attempts

What to Look For:

• Explicit Credential Use:

  • Event ID 4648: Indicates attempts to use credentials for logons.

• Unusual Authentication Activity:

  • Concurrent logon attempts from multiple locations for the same account.

  • Logons from IPs or geolocations not associated with the user.

Red Flags: Credential use patterns suggesting unauthorized attempts to access internal systems.

---

6. Immediate Mitigation

What to Do:

• Notify Users:

  • Inform users who received the phishing emails about the threat. Provide guidance on how to recognize phishing attempts and avoid interacting with suspicious content.

• Reset Compromised Credentials:

  • Force password resets for accounts showing signs of compromise.

• Block Malicious Domains and URLs:

  • Update email filters, firewalls, and proxy settings to block the identified malicious sources.

• Quarantine Affected Systems:

  • Disconnect any endpoints showing signs of malicious activity to prevent further spread.

Long-Term Measures:

• Train Employees:

  • Conduct regular phishing awareness training to reduce susceptibility.

• Enhance Email Security:

  • Implement robust email filtering solutions with advanced threat detection capabilities.

• Deploy Multi-Factor Authentication (MFA):

  • Add an extra layer of security to reduce the impact of stolen credentials.

---

Conclusion

Detecting and analyzing an internal phishing campaign requires correlating email logs, user activity, and system logs to uncover patterns of malicious behavior. Early detection and swift response are critical to mitigating the risk of compromised accounts and data breaches.