>_ Security Circus

Welcome to Security Circus

What this blog is, how the write-ups are structured, and how indicators are shared.

This is where I’ll write up interesting phishing emails I come across: the clever ones, the new tricks, and the occasional campaign that’s just bad enough to be funny.

What each write-up covers

Every analysis follows roughly the same structure, so they’re easy to compare and skim:

  1. Summary. What was impersonated and what the attacker wanted.
  2. The email. A redacted screenshot, the sender details and the lure.
  3. Header analysis. SPF, DKIM and DMARC results, and where the email really came from.
  4. Infrastructure. The links, redirects, domains and hosting behind it.
  5. Landing page or payload. What happens if someone clicks.
  6. TTPs. The techniques used, mapped to MITRE ATT&CK.
  7. Indicators of compromise. A table of defanged IOCs for defenders to hunt with.
  8. Takeaways. Detection ideas and lessons.

How indicators look here

All URLs, domains and IPs are defanged so they can’t be clicked by accident. The examples below use reserved documentation addresses, not real indicators:

Type Indicator Notes
Domain example[.]com Landing page
URL hxxps://example[.]com/login Credential form
IP 192.0.2[.]10 Hosting

To use an indicator in your own tools, “refang” it by replacing hxxp with http and [.] with ..

More soon.