HB-01Level 4 · Breach scenarioDBIR pattern: Social Engineering · VERIS: Social
Phishing & social engineering
- Level 4 · Breach scenario
- 42 signals
- 5 risk domains
A breach that begins with a person deceived through email, SMS, voice, QR or a deepfake, including help-desk pretexting.
Classification
- Fed by risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Anchor
-
- DBIR pattern: Social Engineering · VERIS: Social
- NIST CSF 2.0
-
- PR.AT-01
- DE.AE-06
- MITRE ATT&CK
-
- T1566
- T1684.001
- T1204
-
0
Sequences
End in this breach scenario.
-
6
Cohorts
Predict it.
-
42
Signals
Feed it.
-
5
Risk domains
Where those signals come from.
Sequences that lead here
No sequence ends here.
None of the 11 sequences in this version ends in Phishing & social engineering. The 6 cohorts below predict it, and 42 signals feed it.
-
CR-SE-01
Clicks simulations while targeted by real phishing
SE-B-01 + SE-T-01
-
CR-SE-03
Social engineering critical triad
SE-B-01 + SE-T-01 + IA-A-01
-
CR-SE-04
Silent repeat clicker
SE-B-08 + SE-B-10
-
CR-SE-07
Human sensor
SE-T-01 + SE-B-12
-
CR-RR-01
Exception holder who clicks
RR-A-01 + SE-B-04
-
CR-SC-01
Overconfident clicker
SC-B-01 + SE-B-01
The definition, in detail
Definition
It is the Social Engineering pattern in the Verizon DBIR and the Social action in VERIS: deception, manipulation or intimidation used to exploit the human element of an information asset.
Example
A fake document-share email leads an employee to a credential-harvesting page, and the harvested password is used the same day.
How it is measured
- Anchor
- DBIR pattern: Social Engineering · VERIS: Social
- SOC signals
- Phishing, user-reported email
- Fed by
- 42 signals across 5 risk domains
How it is used
Programs measure toward Phishing & social engineering by counting the 42 signals, 6 cohorts and 0 sequences that point to it, and tie them to the incidents the SOC records as phishing, user-reported email.
A breach scenario names what the evidence beneath it points toward. The organization’s own incidents confirm it; the signals, cohorts and sequences show where it is likely.
Technical mappings
Framework mappings; validate for your use case.
Continue exploring
"Phishing & social engineering" (HB-01), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/breach-scenarios/hb-01-phishing-and-social-engineering
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one breach scenario.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.