dashboardmodule-01
HIGHPhishing & Dropper
A weaponized email attachment (.docm) uses malicious macros to spawn an abnormal process chain, secretly launching PowerShell hidden from the victim.
Outlook Web
URGENT: Outstanding Invoice #89432
From: billing@trusted-vendor.com
Dear Customer,
Please find attached your outstanding invoice for the previous billing cycle. Failure to process this payment within 24 hours will result in service suspension.
Please find attached your outstanding invoice for the previous billing cycle. Failure to process this payment within 24 hours will result in service suspension.
Invoice_89432.docm
142 KB
EDR Process Monitor
Phase 1 of 3
Attack Vector Flow