Skip to content
HRM Framework 2.0 , home
Start the assessment

SQ-ATO-01Level 3 · Sequence5 steps in 72 hours

Phish to takeover

A real phishing message reaches the inbox, the person clicks the link, an unusual sign-in follows, a new MFA factor is approved after repeated prompts, and the account starts sending malicious mail, all within 72 hours.

View in explorer Suggest a change

Classification

Risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
Dimensions Every signal answers one of 3 questions.
Evidence level
Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
ATT&CK tactics
  • Initial Access
  • Execution
  • Persistence
  • Lateral Movement
NIST CSF 2.0 (from its signals)
  • DE.CM-01
  • DE.CM-03
  • PR.AA-03
MITRE ATT&CK (from its signals)
  • T1566
  • T1204.001
  • T1078
  • T1621
  • T1534

The sequence, step by step

SQ-ATO-015 stepsPeak: Stage 4 Suspected

  1. Step 01ATT&CK tactic: Initial Access

    Real phish delivered

    SE-T-02Real phishing delivered to inbox

    Stage 1Exposed

  2. Step 02ATT&CK tactic: Execution

    Link clicked

    SE-B-04Clicks links in real phishing

    Stage 3Exploited

  3. Step 03ATT&CK tactic: Persistence

    Unusual login

    IA-B-04Signs in from unusual contexts

    Stage 4Suspected

  4. Step 04ATT&CK tactic: Persistence

    New MFA device

    IA-B-05Approves MFA after repeated prompts

    Stage 4Suspected

  5. Step 05ATT&CK tactic: Lateral Movement

    Malicious mail sent from the account

    SE-T-06Account sending malicious or phishing mail

    Stage 4Suspected

  6. Breach scenarioHB-02

    Credential abuse & account takeover

    Inside 72 hours

Phish to takeover, 5 steps inside 72 hours: Real phish delivered (SE-T-02 Real phishing delivered to inbox, Initial Access, Stage 1 Exposed); then Link clicked (SE-B-04 Clicks links in real phishing, Execution, Stage 3 Exploited); then Unusual login (IA-B-04 Signs in from unusual contexts, Persistence, Stage 4 Suspected); then New MFA device (IA-B-05 Approves MFA after repeated prompts, Persistence, Stage 4 Suspected); then Malicious mail sent from the account (SE-T-06 Account sending malicious or phishing mail, Lateral Movement, Stage 4 Suspected). It leads to HB-02 Credential abuse & account takeover.

A completed sequence is evidence that its steps happened in order inside 72 hours: a suspicion to triage, with the outcome still open. Here the person reaches Stage 4 Suspected; Stage 5 Confirmed follows only when the SOC opens an incident.

The definition, in detail

Definition

The delivery places the person at Stage 1, the click moves them to Stage 3, and the unusual sign-in completes the sequence at Stage 4.

Example

An HR coordinator clicked a fake benefits-portal link at 09:10; by 11:00 the account had signed in from a new network and approved a push, and by the next morning it had mailed the same lure to the whole department.

The steps

5 steps, in order.

  1. Real phish delivered

    SE-T-02 Real phishing delivered to inbox

    ATT&CK tactic: Initial Access · Stage 1 Exposed

  2. Link clicked

    SE-B-04 Clicks links in real phishing

    ATT&CK tactic: Execution · Stage 3 Exploited

  3. Unusual login

    IA-B-04 Signs in from unusual contexts

    ATT&CK tactic: Persistence · Stage 4 Suspected

  4. New MFA device

    IA-B-05 Approves MFA after repeated prompts

    ATT&CK tactic: Persistence · Stage 4 Suspected

  5. Malicious mail sent from the account

    SE-T-06 Account sending malicious or phishing mail

    ATT&CK tactic: Lateral Movement · Stage 4 Suspected

How it is measured

Steps
5
Window
72 hours
Sources
Email security, Identity provider & MFA

How it is used

Programs watch the 5 steps in order inside 72 hours; a completed run moves the person to Stage 4 Suspected and points at Credential abuse & account takeover.

A completed path is evidence that the steps happened in order inside the window: a suspicion to triage, with the outcome still open. A vigilant behavior at any step breaks the path.

Continue exploring

Cite this term

"Phish to takeover" (SQ-ATO-01), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/sequences/sq-ato-01-phish-to-takeover

Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one sequence.

Same breach scenario

3 other sequences end in Credential abuse & account takeover.

HB-02 Credential abuse & account takeover: every sequence, cohort and signal that points to it.

  • SQ-ATO-023 steps · 30 days

    Leak to login

    1. Step 1: Credential leaked (IA-T-01 Credentials leaked in a public breach)
    2. Step 2: Failed-login spike (IA-T-04 Targeted by malicious login attempts)
    3. Step 3: Unusual successful login (IA-B-04 Signs in from unusual contexts)
    4. Breach scenario: HB-02 Credential abuse & account takeover

  • SQ-ATO-033 steps · 24 hours

    MFA fatigue

    1. Step 1: Repeated MFA prompts (IA-T-04 Targeted by malicious login attempts)
    2. Step 2: Odd-hour approval (IA-B-05 Approves MFA after repeated prompts)
    3. Step 3: New factor registered (IA-B-05 Approves MFA after repeated prompts)
    4. Breach scenario: HB-02 Credential abuse & account takeover

  • SQ-ATO-044 steps · 24 hours

    Help-desk takeover

    1. Step 1: Voice pretext (SE-T-04 Receives callback or voice phishing)
    2. Step 2: MFA reset ticket (SE-A-03 Can reset passwords or MFA for others)
    3. Step 3: New device (IA-B-05 Approves MFA after repeated prompts)
    4. Step 4: Admin login (IA-A-01 Holds admin or privileged roles)
    5. Breach scenario: HB-02 Credential abuse & account takeover

The initial assessment

Find your level.Then fix what matters.

18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.

Start the assessment Explore the taxonomy

Suggest a change

What kind of change?

Only if you would like a reply. See the privacy notice.

 Feedback
Start the assessment