Forum Discussion

catud's avatar
catud
Community Manager
7 days ago

Cybersecurity Challenge: Your Mission - Analyze, Report & Defend! 🫡

October is Cybersecurity Awareness Month and as professionals we know that recognizing a threat is only the first step - knowing how to triage, investigate and mitigate it is what builds true cyber resilience.

To kick off this special month, we’re challenging our community to put their incident response instincts to the test!

🔍 The Challenge: Threat Analysis & Response


Take a look at the attached simulated phishing email. It’s loaded with initial indicators of compromise and social engineering tactics.

Your Mission:

  1. Identify at least 5 distinct red flags hiding in this email.
  2. Go Beyond Awareness: Pick at least one red flag and explain how you or your organization would:
    • Investigate: What logs, headers, or telemetry would you pull to verify the threat scope?
    • Respond & Defend: What immediate remediation or control updates (e.g., mail gateway rules, SIEM detections, endpoint controls) would you implement to prevent impact?

✏️ How to Participate

  1. Examine the email screenshot above.
  2. Reply in the comments with your 5 identified red flags + your investigation/defense strategy.
  3. Check back on October 23rd when we share the answers!


🎁 Prizes & Bonus Entries

  • 🎟️ Every detailed submission enters you into a raffle for a prize!
  • 🚀 Want an extra entry? Share your response or this challenge on LinkedIn, tag/link back to the Community and paste the link in your comment reply!

🛡️ Why "Beyond Awareness" Matters

Threat actors constantly adapt their tactics, techniques and procedures. Moving beyond passive identification into active triage and defensive engineering ensures that every member of our community acts as a sensor and defender.

Drop your submission in the comments below! 👇

GENERAL

1 Reply

  • Shaqdiesel's avatar
    Shaqdiesel
    Day Hiker II
    5 hours ago

    Ooooh how fun!! I'm not necessarily the "security guy" so I won't be able to go TOO deep on the investigation but here we go:

    • Email address is attempting to look like an official everpure email. (everpvre instead of everpure)
    •  The logo inside the email does not match the official Everpure logo.
    • The link on the "verify my account now" button does not lead to an actual Everpure website
    • The HEAVY call to action in the subject does not match the stated action inside the email i.e Your acccount will be suspended but then stating the account will be deleted. 
    • The outside organization warning. (While not a dead giveaway, this is still a good warning sign to double check the email!)

    • The restore access option specifically states which MFA method is to be used to restore access, which is uncommon.

    For the sake of the question, I'm going to assume this email came to me rather than one of my end user. First things first, I'd click that "Report Phishing" button at the top of the screen! I'd send an organization wide email warning them to not click on any links from Everpure until told otherwise and to immediately report any email they received matching the description provided.

     I would begin the investigation with the email address. I would pull the send/receive logs from my my email sserver to check if anyone else received anything or corresponded with anyone from that email address/domain. Inside the email mail filter we use, I would check the email approval/authentication logs to see what rules it passed that should have or could have stopped it from getting through and add/edit rules to prevent this email and domain specifically. I know there are some tools  that can examine header information like return address and IP address, but that stuff would be a step above me 😅