SE-B-09Level 1 · Signal
Replies to or engages with suspicious senders
A risky behavior signal from email security: the person replied to, or started a conversation with, a sender flagged as suspicious or simulated.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- DE.CM-03
- MITRE ATT&CK
-
- T1566
The definition, in detail
Definition
Engagement is the first step of business email compromise and payment fraud.
Example
An executive assistant replies "Yes, I'm at my desk" to a message spoofing the CEO, which opens the way for a gift-card request.
How it is measured
- Source
- Email security
- Subject
- Person
- Event
- phishing.simulation.replied
- Risk domain
- Social engineering
- Provenance
- Verizon DBIR
How it is used
Programs count "Replies to or engages with suspicious senders" per person from Email security and read it beside the other Social engineering signals; it feeds 0 cohorts, 1 sequence and 2 breach scenarios.
A "replies to or engages with suspicious senders" event is evidence of behavior under pressure. It is one observed action, and on its own it is no proof of compromise.
Technical mappings
Framework mappings; validate for your use case.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0001Opens real phishing emails
- I.0005Clicks links in real phishing emails
- I.0013Replies to emails from unknown or spoofed senders
- I.0015Opens attachments from quarantined email messages
- I.0016Opens attachments from email messages with unknown senders
- I.0018Marks legitimate security alerts as junk messages
- I.0019Replies to flagged phishing emails after warning
- I.0020Downloads attachments from emails with mismatched display name and sender
- I.0021Configures a mailbox rule that bypasses security controls
- I.0026Accepts file transfers from unknown external contacts
- I.0028Attempts to bypass attachment blocking by renaming files
- I.0029Adds potentially risky domains to "safe senders" list
- I.0030Replies all with external recipients
- I.0031Deletes security banner before sending messages
- I.0037Interacts with calendar invites that may pose security risk
- I.0039Clicks links in SMS messages from unknown senders or as part of SMS phishing simulation
- I.0040Enables macros in untrusted documents
- I.0041Accesses shortened URLs from unknown sources
- I.0042Attempts to download content from email messages with blocked external images
- I.0043Accepts redirected links from unknown domains
- I.0044Accepts shared file invites from spoofed domains
- I.0045Clicks unsubscribe links in unsolicited newsletters
- I.0046Opens encrypted messages from unverified senders
- I.0050Disables or tampers with emails security controls
- I.0051Opens simulated phishing emails one or more times
- I.0052Clicks links in simulated phishing emails
- I.0053Enters credentials on websites linked from simulated phishing emails
- I.0054Opens file attachments to simulated phishing emails
- I.0055Fails to report simulated phishing emails after opening
- I.0056Deletes simulated phishing emails without reporting
- I.0057Responds to simulated phishing emails
- I.0061Opens simulated SMS phishing messages
- I.0062Responds to simulated SMS phishing messages
- I.0063Fails to report simulated SMS phishing messages
- I.0066Does not respond to simulated fraudulent MFA prompts
- I.0067Marks simulated fraudulent MFA prompts as mistaken
- I.0093Reports low confidence in phishing-related self assessments
- I.0117Opens shortened URLs from unknown senders
- I.0243Demonstrates susceptibility to authority exploitation
- I.0244Demonstrates susceptibility to urgency and scarcity pressure
- I.0245Demonstrates susceptibility to fear and intimidation
- I.0246Demonstrates susceptibility to trust and familiarity abuse
- I.0247Demonstrates susceptibility to reciprocity and obligation
- I.0248Demonstrates susceptibility to curiosity and novelty triggers
- I.0249Demonstrates susceptibility to greed and reward motivation
- I.0250Demonstrates susceptibility to empathy and helpfulness
- I.0251Demonstrates susceptibility to commitment and consistency
- I.0252Demonstrates susceptibility to social proof and herd mentality
- I.0253Demonstrates susceptibility to overconfidence exploitation
- I.0254Demonstrates susceptibility to fatigue and cognitive overload
- I.0255Demonstrates susceptibility to fear of missing out (FOMO)
- I.0256Demonstrates susceptibility to sympathy manipulation
- I.0257Demonstrates susceptibility to pretexting deception
Continue exploring
"Replies to or engages with suspicious senders" (SE-B-09), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/se-b-09-replies-to-or-engages-with-suspicious-senders
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.