Investigation scenario: From malicious alert to root cause

Consider a scenario where a user receives a phishing email offering a “100% discount” through a shared download link. The message appears convincing enough to prompt interaction, leading the user to download a file from the provided link. Shortly after, Elastic Defend triggers an alert indicating that malware execution was detected and terminated. The payload is identified as Mimikatz, a well-known tool used for credential access. At this stage, the immediate threat has been blocked, but key questions remain unanswered.

How did the file reach the endpoint? Was it executed by the user? Was this an isolated event or part of a broader attack? Detection provides the signal but not the full story. To understand the root cause, the investigation shifts to Osquery.

The first step is to identify how the file was introduced onto the system. Since the initial vector is a phishing link, browser artifacts provide a natural starting point. We’ll use the suspicious browser history query that removes all possible false positives from the Elastic browser history table. This query helps identify whether the user accessed a suspicious link consistent with the phishing lure. We see that the user lab1 accessed through Edge browser a link that, in theory, contains a discount zip file to be downloaded, and we can consider these findings as new indicators of compromise (IoCs).

In order to confirm whether the file was actually downloaded and therefore, the user clicked on the previous link, we can use the file table, checking for the presence of this zip file on disk, meaning the user clicked on that previous link. We’ll use the Elastic file query that also checks the file hash of that file on VirusTotal. We can see that this discount. zip file has a malicious reputation, being in reality Mimikatz. Next, we validate whether a file was downloaded and executed as a result of that interaction.