01WHAT HAPPENSWhat is happening, and why
STAGE 01 · PREVENTArrivalWeaponised supplier attachment opened
WHAT'S HAPPENINGA macro-enabled document arrives from a spoofed supplier domain and Sally opens it. The file has never been seen before — no signature, no reputation history, nothing to match against.
STAGE OBJECTIVEAdvance the attack through weaponised supplier attachment opened.
ATTACK SEQUENCE⌄
- 01
Message deliveredA spoofed supplier domain sends the attachment; it passes mail transport into the mailbox.
- 02
File openedSally saves and opens Invoice_Q3_Remittance.docm. Macros are enabled for this trusted-looking sender.
- 03
On-access scanThe file is scanned the moment it is touched, and checked against local and global reputation.
02DETAILED ACTIVITYThe live signal and current environment activity
SIGNAL
!NO MATCHSIGNAL
Invoice_Q3_Remittance.docm has no signature and no reputation history. There is nothing yet to convict on.
03TRELLIX PLATFORMPrevention, coverage and outcome
OUTCOMENo conviction · File is unknown
WHAT TRELLIX COULD DO TO PREVENT ITThreat Prevention: Scans the file on access and checks it against Trellix GTI reputation. · Trace collection: Records the file write, its hash and the process that opened it. · IVX detonation: Detonates the unknown object across 200+ simultaneous executions in a purpose-built hypervisor.⌄
04VISIBILITY & EVIDENCEWhat Trellix can prove and investigate
WHAT TRELLIX SEESaf-doc af-winword
INVESTIGATION CONTEXTThis is the honest starting point. Signature and reputation engines cannot convict what has never been seen. Everything that follows exists because this moment is unavoidable — and it is why forensic depth matters rather than being optional.
WHAT TRELLIX COLLECTS02 collected⌄
file
Invoice_Q3_Remittance.docmMacro-enabled document, unknown hash, delivered from a spoofed supplier domain.
processVOLATILE
winword.exe (PID 4188)Parent process. Opened by the user at 09:14:02 local time.
