After a successful phish, a court clerk's mailbox now forwards all mail to an external Gmail address. What continuing attack should the analyst name?
Select an answer to reveal the explanation.
Short Explanation
The click got them in; the silent forward is how they stay in. A clerk mailbox shipping every message to outside Gmail is email compromise with a persistence rule, not last Tuesday's phish by itself. Hunt the rule, not just the original lure.
Full Explanation
After a successful phish, a court clerk's mailbox that now forwards all mail to an external Gmail address is email compromise using a hidden forwarding rule for persistence. The click got them in; the silent forward is how they stay in and continue reading sealed or sensitive court correspondence. Civic SOCs must name the continuing attack correctly rather than freezing the incident narrative at the initial lure alone.
Saying it is only the initial phishing click with no further persistence fails by concept: the forwarding rule is ongoing persistence and access. Calling it ransomware on the clerk's workstation fails by concept: no encryption or ransom behavior is described. Calling it a watering-hole on the court's public docket site fails by concept: delivery already occurred via phish; the live issue is mailbox rules.
Exam caveat: Post-phish hidden forwarding equals email compromise with persistence; distinguish initial access from continuing mailbox abuse on the exam.
Operational check: Inventory inbox rules and forwarding on the clerk account, revoke sessions, reset credentials and MFA, hunt similar rules across court mailboxes in ES, and document chain-of-custody concerns for any exposed case correspondence.