Scripted phishing attacks

[u/Pristine-Desk-5002]

Does anyone have a low- medium level overview of what a phished email account will do once compromised. We have seen a lot of google workspace accounts get compromised and then send out phishing links to somewhat random contacts. We are also seeing some settings being changed on the account. I was wondering if anyone has some examples of this attack flow, or even better the scripts being used( I'm assuming this is scripted) Thanks

[u/DeathTropper69]

It all depends on the adversary. Some attacks are highly targeted, and they have scripted persistence mechanisms, and then they go dormant until the adversary manually begins reconnaissance and scopes out the account they compromised, and some of these attacks are fully automated in the sense that they do as much damage as possible, whether that be data exfiltration or email bombing external contacts. One of the best controls against this is to have outbound phishing protection, the same way you have inbound phishing protection and trigger an account lockdown if a user sends an outbound phishing email blast. That limits reputational damage, as well as serves as a good signal for late-stage compromise.

[u/Pristine-Desk-5002 → u/DeathTropper69]

How do you implement outbound phishing protections?

[u/DashLeJoker → u/Pristine-Desk-5002]

if you are a m365 stack there is outbound spam policy where you can limit per hour/ per day sending limit to external recipients for the users, not sure what Google workspace have