Phishing Reset Link Leads to Credential Theft | Let’s Defend SOC275 Investigation скачать в хорошем качестве

Phishing Reset Link Leads to Credential Theft | Let’s Defend SOC275 Investigation

In this Let’s Defend SOC investigation, we analyze a confirmed phishing interaction where a user submitted data to a malicious reset-password page. The user gloriana@letsdefend.io interacted with a suspicious external domain over port 8081, first triggering a redirect (HTTP 302) and then submitting a POST request to a /reset-password endpoint with a token parameter. The server responded with HTTP 200, confirming successful form submission. This behaviour strongly indicates credential harvesting and potential account takeover. 🧠 MITRE ATT&CK Techniques Covered T1566.002 – Phishing: Spearphishing Link T1056 – Input Capture T1078 – Valid Accounts 🔍 Investigation Breakdown What Happened? A phishing reset-password link hosted on homespottersf.com was accessed and interacted with. When? 19 April 2024 – 08:23 UTC Source: 172.16.17.172 Destination: 23.82.12.29:8081 The user didn’t just click the link — they submitted form data via POST request. 🚨 Why This Matters POST request confirms user interaction beyond simple clicking Token parameter suggests credential harvesting HTTP 200 response confirms the attacker received the data High risk of credential compromise 🛡 Containment Action The affected endpoint was immediately isolated to prevent: Further malicious communication Credential abuse Lateral movement inside the network If you're learning SOC analysis, phishing detection, or working toward a blue team role, this is a realistic example of how credential harvesting looks in logs. I upload regular Let’s Defend investigations, SOC alerts, and blue team walkthroughs as I build hands-on experience toward a SOC Analyst role. #SOCAnalyst #LetsDefend #Phishing #BlueTeam #CyberSecurity #MITREATTACK