NATIONAL SERVICES AUTHORITY

One endpoint. Seven technical components. The full attack, start to finish.

TARGET HOSTFIN-LT-042Sally Morgan · FinancePLATFORMWindows 11 · Managed · Domain-joined

SIGNAL

NO MATCHSIGNAL

Invoice_Q3_Remittance.docm has no signature and no reputation history. There is nothing yet to convict on.

LIVE

Standing by.

TRELLIXEndpoint Security checks the attachment against signature and reputation and finds no match; the EDRF agent records its arrival regardless. Nothing this file yet — which is why the nine stages after this one exist.

Ready · Press play

Ten stages, one endpoint, from first contact to a hardened estate.

STAGE 01 · PREVENTArrivalWeaponised supplier attachment opened

No conviction · File is unknown

WHAT HAPPENS IN THIS STAGE

01
Message delivered
A spoofed supplier domain sends the attachment; it passes mail transport into the mailbox.
02
File opened
Sally saves and opens Invoice_Q3_Remittance.docm. Macros are enabled for this trusted-looking sender.
03
On-access scan
The file is scanned the moment it is touched, and checked against local and global reputation.

WHAT TRELLIX COULD DO TO PREVENT IT

WHAT TRELLIX WILL SEE AND COLLECT021 volatile

file

Invoice_Q3_Remittance.docm

Macro-enabled document, unknown hash, delivered from a spoofed supplier domain.

processVOLATILE

winword.exe (PID 4188)

Parent process. Opened by the user at 09:14:02 local time.

02:45/ 02:45