SB081 Checks instant messages for signs of deception
Criminals will often use instant messaging (e.g. Whatsapp, Facebook and Slack) as an attack vector. Unexpected messages should always be checked for malicious characteristics. Malicious characteristics included links and requests to call back unknown phone numbers.
Why is it important?
Signs of deception can indicate an email or IM is malicious. Email and IM can contain malware or take people to fake or malicious websites.
Checking an email or IM for suspicious characteristics means harmful actions can be avoided.
Priority Tier
Behaviours in SebDB are ranked by their impact on risk. Tier 1 behaviours have the biggest impact, Tier 4 behaviours the least.
Risk Mitigated
Malware Infection
Malware infections occur when malicious software makes its way on to a device or network.
Account Compromise
Account compromise happens when unauthorised people access them.
Data Theft
Data theft is the intentional stealing of data.
Further reading
https://www.us-cert.gov/ncas/tips/ST04-016 https://www.ncsc.gov.uk/guidance/phishing https://www.forbes.com/sites/bradmoon/2016/01/14/how-to-avoid-becoming-a-victim-of-phishing/ http://lorrie.cranor.org/pubs/pap1162-sheng.pdf