Initial commit - 611 cybersecurity skills across all subdomains

skills/implementing-mimecast-targeted-attack-protection/references/standards.md

@@ -0,0 +1,41 @@
+# Standards & References: Implementing Mimecast Targeted Attack Protection
+
+## MITRE ATT&CK References
+- **T1566.001**: Phishing: Spearphishing Attachment
+- **T1566.002**: Phishing: Spearphishing Link
+- **T1534**: Internal Spearphishing
+- **T1598**: Phishing for Information
+- **T1656**: Impersonation
+- **T1204.001**: User Execution: Malicious Link
+- **T1204.002**: User Execution: Malicious File
+
+## Mimecast TTP Components
+| Component | Version | Key Feature |
+|---|---|---|
+| URL Protect | Current | Pre-delivery hold (Nov 2025 default) |
+| Attachment Protect | Current | Safe File + Dynamic sandbox |
+| Impersonation Protect | Current | Hit 1 (VIP) / Hit 3 (Default) |
+| Internal Email Protect | Current | Journal-based internal scanning |
+
+## Compliance Alignment
+- **CIS Controls v8 Control 9.2**: Use DNS filtering services
+- **CIS Controls v8 Control 9.6**: Block unnecessary file types
+- **NIST SP 800-177**: Trustworthy Email
+- **SOC 2 CC6.1**: Logical and physical access controls
+- **ISO 27001 A.8.23**: Web filtering
+
+## Impersonation Protection Indicators
+| Indicator | Description | Weight |
+|---|---|---|
+| Display name match | External sender uses internal VIP display name | High |
+| Domain similarity | Sender domain visually similar to internal domain | High |
+| Reply-to mismatch | Reply-to differs from From address | Medium |
+| Newly observed | First-time sender to recipient | Medium |
+| Header anomaly | Unusual mail routing or missing authentication | Medium |
+
+## Integration Points
+- Microsoft 365 via connector and journaling
+- Google Workspace via gateway routing
+- SIEM via syslog or API (Splunk, QRadar, Sentinel)
+- SOAR platforms via Mimecast API
+- Directory sync via Active Directory / Azure AD

skills/implementing-mimecast-targeted-attack-protection/references/workflows.md

@@ -0,0 +1,95 @@
+# Workflows: Implementing Mimecast Targeted Attack Protection
+
+## Workflow 1: URL Protect Processing
+
+```
+Inbound email with URLs arrives
+  |
+  v
+[Pre-delivery URL check]
+  +-- Extract all URLs from body and attachments
+  +-- Check against Mimecast threat intelligence
+  +-- KNOWN MALICIOUS --> Hold/Block message
+  +-- SUSPICIOUS --> Hold for deeper analysis
+  +-- CLEAN --> Proceed to rewriting
+  |
+  v
+[URL rewriting]
+  +-- Replace original URLs with Mimecast proxy URLs
+  +-- Preserve original URL in encoded format
+  +-- Apply per-policy rewriting rules
+  |
+  v
+[Message delivered to user inbox]
+  |
+  v
+[User clicks rewritten URL]
+  |
+  v
+[Time-of-click analysis]
+  +-- Real-time page scan and sandbox
+  +-- Check for credential harvesting forms
+  +-- Check for malware downloads
+  |
+  v
+[Decision]
+  +-- SAFE: Redirect to original URL
+  +-- MALICIOUS: Display block page
+  +-- SUSPICIOUS: Display warning with proceed option
+```
+
+## Workflow 2: Attachment Protect Pipeline
+
+```
+Email with attachment arrives
+  |
+  v
+[Static analysis]
+  +-- File type identification
+  +-- Signature matching
+  +-- Known malware hash check
+  |
+  v
+[Policy evaluation]
+  +-- Safe File mode: Convert to safe format (PDF)
+  +-- Dynamic mode: Full sandbox detonation
+  +-- Bypass: Whitelisted sender/type
+  |
+  v
+[Dynamic sandbox (if configured)]
+  +-- Execute in isolated environment
+  +-- Monitor for malicious behavior
+  +-- Check for C2 callbacks, file drops, registry changes
+  +-- Timeout: up to 7 minutes
+  |
+  v
+[Verdict]
+  +-- CLEAN: Deliver original attachment
+  +-- MALICIOUS: Quarantine, notify admin
+  +-- TIMEOUT: Deliver with warning or hold per policy
+```
+
+## Workflow 3: Impersonation Protect Analysis
+
+```
+Inbound email arrives
+  |
+  v
+[Identifier check against VIP list]
+  +-- Compare display name to VIP names
+  +-- Check domain similarity to internal domains
+  +-- Verify reply-to alignment
+  +-- Check if sender is newly observed
+  |
+  v
+[Hit scoring]
+  +-- Hit 1 policy (VIP): 1+ indicator match
+  +-- Hit 3 policy (Default): 3+ indicator matches
+  |
+  v
+[Action based on hit level]
+  +-- QUARANTINE: High confidence impersonation
+  +-- TAG: Moderate confidence, add warning banner
+  +-- LOG: Low confidence, record for analysis
+  +-- DELIVER: No indicators matched
+```