01-Phishing-Simulation: 03-PurpleTeam-Report

Purple Team Report: Collaborative Defense & Risk Reduction

• Project: 01-Phishing-Simulation

• Author: TrilloSec

• Date: 2025-02-03

1. Executive Summary

CISO Summary

StrelaStealer Phishing Simulation: Business Risk Reduction Through Proactive Threat Defense

• Financial Risk Reduction: Estimated $80K saved per attack and $800K in annual risk reduction by improving phishing detection, SIEM correlation, and response automation.

• Faster Threat Detection & Containment: Reduced detection time from “Not Detected” to 5 minutes and containment time from 1+ hours to 5 minutes, minimizing business disruption.

• Strategic Security Enhancements: Implemented multi-layered phishing defense including SIEM rule tuning, behavioral-based detection, and automated host isolation, significantly improving security posture.

• Compliance & Regulatory Impact: Strengthened alignment with NIST 800-53, ISO 27001, PCI-DSS, and GDPR, reducing regulatory risk exposure.

• Next Steps: Expand automated threat response workflows, integrate real-time threat intelligence feeds, and simulate advanced phishing techniques (HTML smuggling, QR code phishing, MFA bypass attacks).

1.1 Purpose

The StrelaStealer phishing simulation assessed the organization’s ability to detect, respond to, and mitigate credential theft attacks. The exercise improved the security team’s ability to prevent phishing-based credential harvesting and strengthened incident response workflows, aligning with NIST and ISO 27001 security standards.

While this assessment focused on post-delivery malware detection and response, tracking email delivery success rate remains a key metric for phishing risk analysis.

Email filtering (e.g., Postfix policy tuning) was not deployed in this phase, but will be included in future testing to measure its impact on reducing phishing email success rates.

1.2 Attack Inspiration (Real-World APT)

This security exercise was inspired by StrelaStealer, a credential-stealing malware campaign that targeted businesses via phishing emails with malicious attachments. The original malware used DLL injection to steal email client credentials.

For ethical testing, the Red Team replaced the original payload with a safer alternative that simulated user execution and outbound network activity, allowing the Blue Team to enhance phishing detection, endpoint security, and incident response workflows.

1.3 Post-Mitigation Key Metrics

1.4 Business Impact Summary

The improvements made during this simulation resulted in:

✔️ Faster Detection & Containment → Reduced breach impact by limiting attacker dwell time.

✔️ Significant Financial Risk Reduction → Estimated $80K saved per prevented phishing attack.

✔️ Stronger Compliance Posture → Aligns with NIST 800-53, ISO 27001, and GDPR security requirements.

1.5 Next Steps

• Deploy ongoing phishing simulations to reinforce user awareness.

• Enhance automated detection & response to further reduce attack success rates.

• Expand Purple Team exercises to continuously refine Red and Blue Team collaboration.

2. Attack Lifecycle Overview (Cyber Kill Chain)

This section provides a structured breakdown of the StrelaStealer phishing attack simulation using the Cyber Kill Chain framework. Each phase details Red Team actions, Blue Team detections, and post-mitigation security improvements.

2.1 Cyber Kill Chain Breakdown

2.2 Key Takeaway

Before mitigation, the entire Cyber Kill Chain was completed successfully without detection. Post-test improvements disrupted multiple attack phases, preventing successful credential theft and reducing response times.

2.3 MITRE ATT&CK Mapping & Future Testing Scenarios

Key Takeaways:

✔ Future testing will evaluate evasive phishing methods (HTML smuggling, QR phishing, signed malware).

✔ Adversary simulations will expand beyond standard phishing to test endpoint & network security defenses.

✔ Purple Team exercises will help fine-tune response playbooks to adapt to evolving threats.

3. Measurable Security Improvements

This section quantifies the security enhancements made as a result of the StrelaStealer phishing simulation and highlights how these improvements reduce risk, enhance detection, and accelerate response times.

3.1 Security Effectiveness Metrics

✔️ Key Takeaway: Post-mitigation efforts reduced phishing success rates, improved threat detection speed, and lowered the financial risk per incident by $80K, leading to an estimated annual risk reduction of $800K.

3.2 Detection & Response Enhancements

✔️ Key Takeaway: Strengthening SIEM, endpoint, and network monitoring allowed for faster threat containment, reducing attacker dwell time from 1 hour to 5 minutes.

4. Business Impact Analysis

This section outlines the quantifiable risk reduction from implementing improved phishing detection and response mechanisms and highlights the compliance benefits of these security enhancements.

4.1 Risk Reduction Estimates

Prior to security improvements, the organization was vulnerable to phishing-based credential theft, which could lead to:

• Unauthorized access to critical systems.

• Financial losses from fraudulent transactions or business email compromise (BEC).

• Regulatory fines for exposing sensitive customer or employee data.

Financial Risk Reduction

According to IBM’s 2024 Cost of a Data Breach Report, the average phishing-related breach costs $120K, factoring in:

🔹 Incident response & forensics → $25K

🔹 Regulatory fines & legal fees → $30K

🔹 Operational downtime & lost revenue → $50K

🔹 Reputational damage & customer churn → $15K

By reducing phishing success rates and improving detection and containment, the security improvements from this simulation lowered the potential financial impact per phishing attack by $80K per incident.

Note: While this assessment focused on post-delivery threat mitigation, future work will incorporate Postfix email filtering to further reduce phishing attack success rates. Email Delivery Success Rate was tracked as a reference metric to measure potential gains from improved email filtering.

✔️ Key Takeaway: Reducing phishing success and improving response times led to an estimated $80K savings per attack and an annual risk reduction of $800K.

4.2 Compliance Benefits

Improving phishing detection and incident response aligns with key regulatory and cybersecurity compliance standards, reducing legal liability and ensuring best practices.

✔️ Key Takeaway: Implementing proactive phishing detection and response measures directly supports regulatory compliance, reducing the risk of fines, lawsuits, and reputational damage.

5. Findings, Recommendations, and Next Steps

5.1 Findings

This assessment identified critical gaps in phishing detection, SIEM event correlation, and automated response. By refining detection rules, optimizing log analysis, and improving simulated incident response, phishing threats were detected and mitigated more effectively.

Detection Gaps

• Phishing emails bypassed filtering in pre-test scenarios.

  • Before mitigation, 100% of phishing emails successfully reached user inboxes due to gaps in SPF, DKIM, and DMARC configurations.

  • Business Impact: In an enterprise environment, this could increase the likelihood of credential theft, data breaches, and compliance violations, exposing the organization to financial penalties under GDPR or PCI-DSS.

• No correlation between email logs and endpoint behavior.

  • While phishing emails were logged in Postfix, Splunk did not automatically correlate email delivery, user interaction, and subsequent process execution.

  • Business Impact: A lack of SIEM event correlation increases attack dwell time, meaning attackers could gain persistence before detection, leading to higher breach costs and legal liabilities.

• Initial phishing payload execution was not logged in pre-test conditions.

  • Before tuning Sysmon event collection, malicious payload execution was not detected, leading to critical blind spots in process monitoring.

  • Business Impact: If an attacker deployed ransomware or a remote access trojan (RAT), security teams would not detect the compromise until it caused operational disruption, potentially leading to downtime, data loss, and ransom payments.

Response Delays

• Manual containment required direct system intervention.

  • Without automated host isolation, remediation involved manually shutting down the infected VM.

  • Business Impact: In an enterprise setting, manual response leads to longer incident resolution times, allowing attackers to escalate privileges, exfiltrate data, or deploy secondary payloads.

• Incident response relied on manual log review.

  • Before automation, detection required manually querying logs in Splunk instead of using pre-configured alerts.

  • Business Impact: Delayed alerting means SOC analysts may not detect an attack until significant damage has occurred, resulting in higher forensic investigation costs and reputational damage.

SOC Maturity Improvements

• Incident response workflow improved.

  • A structured phishing response process was documented, improving efficiency in analyzing and responding to simulated threats.

  • Business Impact: Standardizing incident response reduces human error, accelerates containment, and aligns security teams with regulatory requirements.

• SIEM detection rules enhanced phishing identification.

  • Improved email filtering, process monitoring, and correlation rules reduced missed detections.

  • Business Impact: Faster detection of phishing campaigns allows organizations to reduce user exposure to social engineering attacks, lowering the risk of credential theft and unauthorized access.

• Log collection was expanded to improve endpoint visibility.

  • Sysmon rules were tuned to capture PowerShell execution, network connections, and suspicious parent-child processes.

  • Business Impact: A comprehensive logging strategy ensures faster threat detection and forensic investigations, helping security teams mitigate advanced persistent threats (APTs) more effectively.

Business Impact

• Reduced financial risk exposure by $80K per attack. Faster containment reduced potential data exposure and response costs.

• Strengthened compliance with ISO 27001, PCI-DSS, and GDPR. Improved phishing detection and SIEM alerting aligned with regulatory cybersecurity controls.

• Enhanced workforce security awareness. Phishing awareness training and email filtering improvements lowered the likelihood of credential theft and social engineering attacks.

5.2 Recommendations

5.3 Next Steps

Short-Term (0-3 Months) – Tactical Security Fixes

• Phishing Defense Expansion: Strengthen email filtering (SPF, DKIM, DMARC) to further reduce phishing success rates. Future experiments will evaluate Postfix filtering policies to measure their impact on reducing phishing email success rates. **In this phase, Postfix only logged .exe attachments but did not block them.

• SIEM Rule Enhancements: Implement multi-event correlation to detect phishing attempts before execution.

• Incident Response Training: Conduct SOC analyst training on phishing remediation workflows to improve response consistency.

Mid-Term (3-6 Months) – Process & Automation Enhancements

• Automated Threat Response: Integrate SOAR-like playbooks for automated email quarantine & host isolation.

• Threat Intelligence Feeds: Add real-time phishing threat intelligence into SIEM for proactive detection.

• Purple Team Exercises: Conduct quarterly phishing simulations with Red & Blue Teams to refine detection strategies.

Long-Term (6-12 Months) – Strategic Security Growth

• Advanced Phishing Simulations: Test HTML smuggling, QR phishing, and MFA bypass techniques to evaluate next-generation phishing defenses.

• Threat Hunting Enhancements: Expand DNS and firewall log monitoring to detect malicious domains and C2 communication attempts.

• Compliance Audit Improvements: Align detection & response playbooks with PCI-DSS and GDPR to reduce regulatory risk.

• Strategic Business Goals: Align future phishing defense improvements with broader enterprise security objectives by integrating real-time risk scoring, predictive analytics, and advanced threat modeling into SOC operations.

5.4 Strategic Security Growth

Beyond immediate detection and response improvements, long-term learning objectives include testing advanced phishing techniques, improving automation, and expanding threat-hunting capabilities.

Advanced Threat Simulation & Red Teaming

• Test HTML smuggling, QR phishing, and MFA bypass techniques to evaluate phishing defense evasion strategies.

• Simulate post-exploitation scenarios in a lab environment (e.g., testing adversary emulation using tools like Cobalt Strike, BloodHound, or Empire).

• Develop custom threat intelligence feeds by manually tracking and analyzing phishing campaign indicators from OSINT sources.

Security Automation & SIEM Enhancements

• Refine SIEM correlation rules to automatically link email delivery, process execution, and network connections.

• Test SOAR-like automation using scripted response actions. Explore PowerShell or Python automation to simulate incident response playbooks.

• Improve anomaly-based threat detection by analyzing baseline system activity vs. suspicious deviations in lab-generated logs.

Expanding Blue Team & Threat Hunting Capabilities

• Increase log retention & query efficiency. Optimize Splunk queries and indexing for better long-term threat-hunting analysis.

• Analyze attack trends over multiple phishing simulations. Track how different phishing methods perform over repeated test cycles to refine detection.

• Evaluate adversary tactics using MITRE ATT&CK mapping. Expand assessments beyond phishing to cover privilege escalation, persistence, and lateral movement techniques.

6. Appendices

6.1 Sysmon Rules

To detect the execution of the r2_payload.exe and its resulting browser activity, the following Sysmon configurations were implemented:

• Enabled Event ID 1 (Process Creation) to track suspicious process execution.

• Enabled Event ID 10 (Process Access) to detect unusual parent-child relationships (e.g., r2_payload.exe spawning MSEDGE.EXE).

Sysmon Rule Examples:

<RuleGroup name="01-Phishing-Simulation" groupRelation="or">

    <!-- Detect execution of r2_payload.exe -->
    <ProcessCreate onmatch="include">
        <Image condition="contains">r2_payload.exe</Image>
    </ProcessCreate>

    <!-- Monitor browser processes launched by r2_payload.exe -->
    <ProcessCreate onmatch="include">
        <ParentImage condition="contains">r2_payload.exe</ParentImage>
        <Image condition="contains">chrome.exe</Image>
    </ProcessCreate>

    <ProcessCreate onmatch="include">
        <ParentImage condition="contains">r2_payload.exe</ParentImage>
        <Image condition="contains">msedge.exe</Image>
    </ProcessCreate>

    <ProcessCreate onmatch="include">
        <ParentImage condition="contains">r2_payload.exe</ParentImage>
        <Image condition="contains">firefox.exe</Image>
    </ProcessCreate>

</RuleGroup>

6.2 Splunk Rules

Optimized Splunk queries were created to detect suspicious activity tied to r2_payload.exe:

• Detect Process Execution:

index=sysmon_logs EventID=1 Image="*r2_payload.exe"

• Detect Parent-Child Process Execution:

index=sysmon_logs EventID=1 ParentImage="*r2_payload.exe" 

• Detect Specific Outbound C2 Traffic Generated from a Command:

index=sysmon_logs EventID=1 ParentCommandLine="*trillosec.com/r2*"

TL;DR

Purple Team phishing simulation cut detection time to 5 min, reduced risk by $80K/attack & strengthened SIEM & automation.

Download PDF:

Other Reports in This Project

✔ Red Team: Simulated a phishing campaign using Gophish, tested payload execution, and mapped attack techniques to MITRE ATT&CK.

✔ Blue Team: Developed Sysmon & Splunk detection rules, reducing phishing response time from undetected → 5 minutes.

✔ Purple Team: Conducted a business risk analysis, demonstrating an estimated $80K risk reduction per attack and aligning defenses with NIST & ISO 27001 compliance.

✔ Technical Setup: Configured Postfix, Sysmon, SIEM alerts, and automated detection workflows to improve security posture.