Phishing Emails 4

Prompts and answers

• What is the MITRE ID for Software Configuration?
  M1054
• https://dmarcian.com/what-is-the-difference-between-spf-all-and-all/
  v=spf1 ~all
• What is the meaning of the -all tag?
  fail
• Which email header shows the status of whether DKIM passed or failed?
  Authentication-Results
• Which DMARC policy would you use not to accept an email if the message fails the DMARC check?
  p=reject
• Check the Microsoft reference shared in the task.
  The uniqueness of a signature prevents the owner of the signature from disowning the signature.
• What Wireshark filter can you use to narrow down the packet output using SMTP status codes?
  smtp.response.code
• Per the network traffic, what was the message for status code 220? (Do not include the status code (220) in the answer)
  Service ready
• ![[Pasted image 20221017124150.png]]
  mailbox name not allowed
• The server is now waiting for the 'body' of the message.
  354
• What port is the SMTP traffic using?
  25
• How many packets are specifically SMTP?
  512
• What is the source IP address for all the SMTP traffic?
  10.12.19.101
• What is the filename of the third file attachment?
  attachment.scr
• How about the last file attachment?
  .zip
• Zebrocy is a Trojan that has been used by APT28 since at least November 2015. The malware comes in several programming language variants, including C++, Delphi, AutoIt, C#, VB.NET, and Golang.
  Zebrocy
• Per the playbook, what framework was used for the IR process?
  NIST