Understanding Cyber Threats, IoCs, and Attack Methodology · Topic 3 of 4
Social Engineering, Email and Insider Attack TTPs
Recognize social engineering, phishing, email spoofing, BEC and insider threat TTPs, with the signs each leaves for SOC analysts, for CSA 312-39.
- 5 min
- Spear phishing targets specific people. Whaling targets executives. Vishing uses voice, smishing uses SMS.
- SPF checks the sending server, DKIM checks the signature, DMARC sets the policy when alignment fails.
- BEC aims at payments or data through a spoofed or compromised trusted mailbox.
What it is
Social engineering manipulates people into giving away information, access or money. It attacks trust, fear, urgency and helpfulness rather than software.
Email attacks are the most common delivery route for social engineering and malware. Insider attacks come from people who already have legitimate access, which makes them hard to spot with perimeter controls.
How it works
Social engineering TTPs
| Technique | How it works |
|---|---|
| Phishing | Mass messages that lure users to a fake site or a malicious attachment |
| Spear phishing | Phishing aimed at a specific person or group, using researched details |
| Whaling | Spear phishing aimed at senior executives |
| Vishing | Voice phishing by phone, often posing as IT support or a bank |
| Smishing | Phishing by SMS text message |
| Pretexting | An invented story gives the attacker a reason to ask for information |
| Baiting | Leaving infected media, such as a USB drive, for victims to use |
| Quid pro quo | Offering a service or reward in return for access or details |
| Tailgating and piggybacking | Following an authorized person through a secure door |
| Shoulder surfing and dumpster diving | Watching screens or keyboards, or searching discarded papers |
| Impersonation and deepfakes | Posing as a trusted person, now including faked voice or video |
Attackers exploit authority, urgency, scarcity, familiarity and fear. A request that combines urgency with bypassing normal process is the strongest warning sign.
Email attack TTPs
| Attack | What it is | What the SOC sees |
|---|---|---|
| Email spoofing | Forged From address that looks like a trusted sender | SPF, DKIM or DMARC failures in the Authentication-Results header |
| Lookalike domain | A domain that resembles the real one, such as a swapped letter | New domain, display name matching a real employee |
| Malicious attachment | Office files with macros, archives, ISO or HTML files carrying malware | Office app spawning a shell or PowerShell after an attachment opens |
| Malicious link (credential phishing) | Link to a fake login page | Clicks recorded by the proxy or mail gateway, then a logon from a new location |
| Business email compromise (BEC) | Attacker uses a spoofed or compromised executive or supplier mailbox to request payments | Changed bank details request, Reply-To different from From, new inbox rules |
| Account takeover | Attacker controls a real mailbox | New forwarding or deletion rules, mass outbound mail, logons from unusual places |
| Spam and email bombing | Floods of unwanted mail, sometimes to hide a real alert | Sudden inbound volume spike to one user |
SPF checks that the sending server is allowed for the domain, DKIM checks a digital signature on the message, and DMARC tells receivers what to do when SPF or DKIM alignment fails. Analysts read these results in the message header.
Insider attack TTPs
| Insider type | Description |
|---|---|
| Malicious insider | Deliberately steals data or sabotages systems, often for money or revenge |
| Negligent insider | Causes harm by carelessness, such as falling for phishing or mishandling data |
| Compromised insider | A legitimate user whose account or device is controlled by an outsider |
| Professional insider | Uses insider access as a paid job, for example for a competitor or foreign actor |
Insider TTPs include copying data to USB drives or personal cloud storage, emailing files to personal addresses, abusing excessive privileges, accessing data outside one's role, installing unauthorized tools, and deleting logs or files before leaving.
Signs the SOC watches for:
- Access at unusual hours or from unusual places
- Large downloads or file copies, especially near a resignation date
- Access to systems unrelated to the person's job
- Repeated attempts to reach restricted data
- Disabled security tools or cleared logs on the user's device
User and entity behavior analytics (UEBA) and data loss prevention (DLP) are the main tools, because insiders use valid credentials that signature based tools accept.
A worked example
The finance team gets an email that appears to come from the CFO, asking for an urgent transfer to a new supplier account before the end of the day. The header shows DMARC failed, and the Reply-To address is a free webmail account.
This is business email compromise by spoofing. The analyst blocks the sender, searches for the same message in other mailboxes, and asks finance to verify the request by phone using a known number.
How the exam asks about this
- "An attacker calls the help desk posing as a manager and asks for a password reset. Which technique is this?" → Vishing with pretexting.
- "Which email authentication result would most suggest a spoofed sender?" → A DMARC failure.
- "A user with valid access copies large volumes of data to USB just before leaving the company. Which threat is this?" → A malicious insider.
What to remember for the exam
- Spear phishing targets specific people. Whaling targets executives. Vishing uses voice, smishing uses SMS.
- SPF checks the sending server, DKIM checks the signature, DMARC sets the policy when alignment fails.
- BEC aims at payments or data through a spoofed or compromised trusted mailbox.
- Insider types: malicious, negligent, compromised and professional.
- UEBA and DLP detect insiders, because insiders use valid credentials.
A new inbox rule that forwards or deletes mail is a strong sign of account takeover. Attackers use it to hide replies and keep watching.
Common mistakes
Calling every insider malicious. Many insider incidents are negligent. The response, training versus legal action, depends on the type.
Trusting the display name. The display name is easy to fake. Check the real address, Reply-To and authentication results.
Assuming email passed because SPF passed. SPF can pass for a lookalike domain the attacker owns. Look at the domain itself as well.
Check yourself
What is whaling?
A spear phishing attack aimed at senior executives such as the CEO or CFO.
What is a compromised insider?
A legitimate user whose account or device has been taken over by an outside attacker.
Why do signature based tools struggle with insider threats?
Insiders use valid accounts and normal tools, so detection relies on behavior baselines from UEBA and on DLP.
Topic 3 of 4 in Understanding Cyber Threats, IoCs, and Attack Methodology
Test yourself on Understanding Cyber Threats, IoCs, and Attack Methodology
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.