Defensive Hardening Guides: Email, EDR, and Incident Response

Multi-Part Security Implementation Guide
Classification: Internal Use - Operational Security
Last Updated: September 2026

---

PART 1: EMAIL GATEWAY HARDENING

Microsoft 365 Defender Configuration

1. DMARC Policy Enforcement

powershell
Copy
1# Create DMARC record
2# DNS TXT Record:
3v=DMARC1; p=quarantine; rua=mailto:dmarc@acme.local; ruf=mailto:dmarc_forensics@acme.local; fo=1
4
5# Implementation in Microsoft 365:
6# Go to Admin Center → Settings → Domains
7# Add TXT record for domain
8# Test: https://dmarcian.com/dmarc-inspector/

Settings:

• p=quarantine (not p=reject initially - test first)
• rua= points to internal email for daily reports
• ruf= points to forensics team for forensic reports
• fo=1 sends report if any SPF/DKIM/DMARC fails

2. SPF Record Enhancement

# Current (weak):
v=spf1 include:_spf.google.com include:sendgrid.net ~all

# Enhanced (restrictive):
v=spf1 include:_spf.google.com include:sendgrid.net include:servers.mcsv.net -all
# Note: -all = hard fail (not ~all which is soft fail)

3. DKIM Key Rotation

powershell
Copy
1# Get current DKIM status
2Get-DkimSigningConfig | Select Identity, Enabled
3
4# Enable DKIM for domain
5Set-DkimSigningConfig -Identity acme.local -Enabled $true
6
7# Rotate DKIM keys (every 2-3 months recommended)
8Rotate-DkimSigningConfig -KeySize 2048
9
10# Publish new DKIM public key to DNS
11Get-DkimSigningConfig -Identity acme.local | Format-List
12# Note the selector1CNAME and selector2CNAME values
13# Create CNAME records in DNS pointing to Microsoft's DKIM servers

4. Email Authentication Policy

powershell
Copy
1# Create policy requiring authentication
2New-AuthenticationPolicy -Name "CRA_Spoofing_Protection" `
3  -AuthenticationFailAction Quarantine
4
5# Apply to specific users (executives, finance)
6Set-AuthenticationPolicy -Identity "CRA_Spoofing_Protection" `
7  -UserApplied $true
8
9# Monitor protected users
10Get-AuthenticationPolicyUserAssociation | Format-Table User, Policy

5. Phishing Rules via Advanced Threat Protection (ATP)

Rule 1: Block CRA Spoofing

powershell
Copy
1# Create mail flow rule
2New-TransportRule -Name "Block CRA Spoofing" `
3  -FromAddressContainsWords "cra", "revenue agency", "tax" `
4  -ExceptIfFromAddressMatchesPatterns "@cra.gc.ca" `
5  -RejectMessageReasonText "CRA spoofing detected" `
6  -Enabled $true

Rule 2: Block Suspicious Any.Run URLs

powershell
Copy
1New-TransportRule -Name "Block Any.Run Phishing" `
2  -BodyContainsWords "any.run/tasks" `
3  -RejectMessageReasonText "Suspicious malware analysis link detected" `
4  -Priority 1 `
5  -Enabled $true

Rule 3: Flag Tax Authority Emails

powershell
Copy
1New-TransportRule -Name "Flag Tax Authority Emails" `
2  -SubjectOrBodyContainsWords "cra", "uae tax", "vat audit", "tax compliance" `
3  -ExceptIfFromAddressMatchesPatterns "@cra.gc.ca", "@fmc.gov.ae" `
4  -SetSCL 7 `  # Mark as spam (7=high probability spam)
5  -Enabled $true

6. Advanced Threat Protection (ATP) Safe Attachment Scan

powershell
Copy
1# Update ATP policy to scan all attachments
2Set-AtpPolicyForO365 -Enable $true `
3  -EnableSafeAttachmentPolicy $true
4
5# Create ATP policy
6New-SafeAttachmentPolicy -Name "Block Executable Attachments" `
7  -Enable $true `
8  -Action Block
9
10# Apply to everyone
11New-SafeAttachmentRule -Name "Block Executables - All Users" `
12  -Policy "Block Executable Attachments" `
13  -RecipientDomainIs acme.local

7. User Training & Reporting

Phishing Simulation Campaign:

powershell
Copy
1# Use Microsoft 365's built-in phishing simulation
2# Admin Center → Learning & Development → Attack Simulation Training
3
4# Create simulation campaign
5# - Payload: Tax authority themed email
6# - Landing page: Fake CRA login form (educational)
7# - Target: All users
8# - Measure: Click rates, credential submission rates
9
10# Expected Results:
11# - Pre-training: 30-40% click rate (industry average)
12# - After 1 training: 20-25% click rate
13# - After 3 trainings: <15% click rate

Report to Users (who fell for phishing):

Subject: Security Training - You Clicked a Suspicious Link

Dear [USER],

Our security team recently sent a test phishing email to help improve our defenses.
You clicked the link, which is a common mistake!

WHAT TO LOOK FOR:
- Mismatched email domain (from: noreply@cra-audit-compliance.ca, NOT cra.gc.ca)
- Urgent language ("48-hour deadline", "account suspended")
- Requests for personal information (SIN, passwords)
- Suspicious links (hover over links to see real destination)
- Unexpected attachments (especially .exe, .zip)

NEXT STEPS:
- Take our 15-minute security awareness course
- Set a reminder to review phishing indicators quarterly
- Report suspicious emails to security@acme.local

Remember: CRA and government agencies NEVER ask for passwords via email!

---

PART 2: EDR TUNING GUIDE

CrowdStrike Falcon Configuration

1. Sensor Deployment

powershell
Copy
1# Download and deploy CrowdStrike Falcon
2# https://falcon.cloud.crowdstrike.com/
3
4# Automated deployment via Group Policy (AD environment):
5# Group Policy Editor → Computer Configuration → Administrative Templates
6# CrowdStrike Falcon → Enable → Configure Customer ID and API Key

2. Detection Rules for Operation AnyTax

Rule 1: RMM Tool Suspicious Execution

Detection Type: Behavioral
Rule Name: "RMM Tool Spawned from Non-Standard Process"
Triggers When:
  - Process: AnyDesk.exe, ScreenConnect.exe, TeamViewer.exe
  - Parent Process: NOT (explorer.exe, svchost.exe, services.exe)
  - Parent Process Name Contains: "Downloads", "Temp", "AppData"
  
Action: Alert + Quarantine
Severity: High

Rule 2: Reconnaissance Module Pattern

Detection Type: Behavioral
Rule Name: "Suspicious System Enumeration Activity"
Triggers When:
  - Process: cmd.exe or powershell.exe
  - Commands Executed:
    - ipconfig /all
    - net view
    - dsquery user -limit 0
    - nltest /dclist
    - gpresult /h
  - Parent: Unknown executable from Temp/Downloads
  
Action: Alert
Severity: Medium
Correlation: If 3+ commands in 1 minute = High severity

Rule 3: LSASS Memory Dumping

Detection Type: Memory Access
Rule Name: "Suspicious LSASS Process Access"
Triggers When:
  - Process tries to access LSASS.exe memory
  - Access Type: Read (GrantedAccess 0x1010, 0x1040, 0x143A)
  - Source Process: NOT (svchost.exe, wdiag.exe, MoNotificationUx.exe)
  
Action: Alert + Block + Investigate
Severity: Critical
Confidence: Very High (strong indicator of credential theft)

Rule 4: Scheduled Task Abuse

Detection Type: Registry/Process
Rule Name: "Suspicious Scheduled Task Creation"
Triggers When:
  - Registry Path: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache
  - New Task: Task description includes "Windows Update", "System Maintenance", "SR"
  - Task Action: Points to Temp, ProgramData, or suspicious location
  - Recurrence: At Startup or Logon
  
Action: Alert + Investigate
Severity: High

3. Indicator of Attack (IOA) Setup

CrowdStrike Custom IOA:

IOA Type: Behavioral
Name: "CRA Phishing Campaign - Full Chain"
Severity: Critical
Enabled: Yes

Trigger Conditions (ALL must be true):
1. Process Execution:
   - File named: *CRA*Tax*.exe OR *Compliance*Report*.exe
   - OR Hash matches: 7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d
   
2. C2 Communication:
   - DNS query: c2-control.xyz OR 185.220.101.45
   - HTTP POST to: /api/register OR /api/check
   
3. RMM Installation:
   - Service Created: AnyDesk OR ScreenConnect OR TeamViewer
   - Service Start Type: Automatic
   - Parent Process: Not legitimate installer

4. Persistence Mechanism:
   - Registry Modification: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
   - OR Task Scheduler: New task at system startup

Response Actions:
  - Isolate endpoint from network
  - Block process execution
  - Alert security team
  - Collect forensic data

4. EDR Tuning for False Positives

Whitelist Legitimate Applications:

Whitelist Name: "Approved RMM Tools"
Approvals:
  - ScreenConnect (official versions only)
    - Path: C:\Program Files\ScreenConnect\sc.exe
    - Publisher: ConnectWise (signed)
    - Version: >= 21.0
  
  - TeamViewer (official versions only)
    - Path: C:\Program Files\TeamViewer\TeamViewer.exe
    - Publisher: TeamViewer GmbH (signed)
    - Version: >= 15.0
  
  - Kaseya VSA (if deployed)
    - Publisher: Kaseya (signed)
    - Version: >= 9.0

Do NOT whitelist AnyDesk (less common in enterprise, higher abuse risk)

Tune Alert Thresholds:

Alert Sensitivity: HIGH (for this campaign)
  - Enable: Low confidence alerts
  - Alert if: Process behavior scores > 50 (not just 80+)
  
Reduce Noise:
  - Whitelist: Windows Update processes (WUAUServ)
  - Whitelist: Windows Defender processes
  - Whitelist: Legitimate antivirus processes

---

PART 3: EXPANDED INCIDENT RESPONSE PLAYBOOK

Response Scenarios

Scenario 1: Phishing Email Reaches Mailbox (No Click)

Timeline: 0-2 Hours

T+0:00   - User or admin reports suspicious email
T+0:05   - SOC analyst reviews email headers, confirms spoofing
T+0:10   - Email removed from all user mailboxes
         - Command: Search-Mailbox -SearchQuery 'from:noreply@cra-audit-compliance.ca' -DeleteContent
T+0:15   - User notification sent: "Phishing email removed from your mailbox"
T+0:30   - Email gateway rule created to block sender domain
T+0:45   - Threat intel team analyzes email for indicators
T+1:00   - All recipients of email identified
T+1:15   - Users who received email notified (awareness training link included)
T+1:30   - Lessons learned: Why email passed filtering? Update DMARC/SPF/DKIM
T+2:00   - Incident closed (low severity, no compromise)

Scenario 2: User Clicks Link but Doesn't Download

Timeline: 0-24 Hours

T+0:00   - EDR alerts: User clicked suspicious link to any.run
T+0:05   - Isolate endpoint from network (network cable disconnected)
T+0:10   - Initial analyst interview:
         - When did you click?
         - Did you see a file download prompt?
         - Did you enter any credentials?
T+0:30   - Forensic acquisition begins (memory + disk image)
T+1:00   - Proxy logs analyzed: Did user navigate to phishing page?
T+2:00   - Browser history extracted:
         - Did user visit tax-audit-check.ca (phishing site)?
         - If yes: Did user enter credentials?
T+4:00   - Preliminary forensic findings:
         - No executable downloaded
         - No malware executed
         - But: Credentials may have been harvested
T+6:00   - If credentials entered:
         - Force password reset for user
         - Check for credential misuse (failed logins elsewhere)
         - Enable MFA if not already active
T+24:00  - Forensic report completed
T+48:00  - User cleared to return to network (after sign-off)

Scenario 3: Malware Executes (Full Compromise)

Timeline: 0-72 Hours (Immediate Response)

Phase 1: Containment (0-30 minutes)

T+0:00   - EDR alert: Suspicious executable from Downloads folder
T+0:02   - Security team assembles (on-call incident commander, analyst, forensicist)
T+0:05   - Analyst confirms alert legitimacy
         - File hash: 7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d (MATCH!)
         - Yara rules triggered (RMM_Loader_Campaign_AnyTax)
T+0:10   - ISOLATION DECISION:
         Option A: Isolate endpoint only (keep running for forensics)
         Option B: Power down (preserve memory state)
         DECISION: Network isolate (unplug Ethernet)
T+0:15   - Memory dump initiated (DumpIt.exe on USB)
T+0:20   - Other suspicious processes identified:
         - cmd.exe (parent: unknown)
         - powershell.exe (parent: unknown)
         - svchost.exe (spoofed location)
T+0:25   - Check for other compromised systems:
         - Same user on other machines?
         - VPN access from this user?
         - Lateral movement attempts?
T+0:30   - Incident escalation initiated
         - Legal notified (potential breach)
         - PR prepared (if public disclosure needed)
         - C-level executives notified

Phase 2: Investigation (30 min - 12 hours)

T+0:30   - Memory dump completed
         - Volatility analysis begins
         - Identifies: AnyDesk process, C2 connections, reconnaissance module
         
T+1:00   - Domain Controller check:
         - Has attacker accessed DC?
         - Are domain admin credentials compromised?
         - RESPONSE: If yes → initiate Domain Controller rebuild
         
T+2:00   - Lateral movement search:
         - Check Event Logs (EventID 4624 - successful logins)
         - Check for RDP connections from compromised host
         - Check for admin share access (\\HOST\C$)
         
T+4:00   - Credential threat assessment:
         - What accounts has attacker accessed?
         - Domain admin compromised? (CRITICAL)
         - Service accounts compromised?
         
T+6:00   - Forensic timeline reconstruction:
         - When was phishing email sent?
         - When did user click?
         - When did malware execute?
         - When did RMM tool install?
         - When did lateral movement begin?
         
T+12:00  - Scope determination:
         - Single endpoint or network-wide compromise?
         - Is ransomware payload staged?
         - Has data been exfiltrated?

Phase 3: Eradication (12-48 hours)

T+12:00  - Eradication decision point:
         OPTION 1: Rebuild from clean backup (recommended)
         OPTION 2: Remove malware and monitor
         DECISION: Rebuild all affected systems
         
T+12:30  - Identify all compromised systems:
         - Any compromised by same user account? (Remove RMM tool)
         - Any accessed via lateral movement? (Check logs)
         
T+13:00  - Reset all passwords (especially domain admins):
         - Force password change
         - All domain admins must change password
         - Require new Kerberos tickets (logoff and login)
         
T+14:00  - Kill processes:
         - Task Manager: End all RMM processes
         - Services: Disable AnyDesk, ScreenConnect services
         - Registry: Remove startup entries
         
T+15:00  - Remove RMM tools:
         - Uninstall via Control Panel: Programs → Uninstall
         - Remove registry entries: HKLM\Services\AnyDesk
         - Verify removal: No service running, no registry key
         
T+18:00  - Rebuild compromised systems:
         - Restore from known-good backup (pre-compromise)
         - OR: Fresh Windows installation
         - DO NOT restore from incremental backups (may contain malware)
         
T+36:00  - Reintroduce systems to network:
         - Monitor heavily for 48 hours
         - Block C2 domains at perimeter
         - Alert if any C2 connections detected
         
T+48:00  - System cleanup complete

Phase 4: Recovery (48-72 hours)

T+48:00  - Operations return to normal
         - Users back at workstations (clean systems)
         - Monitor for re-compromise
         
T+72:00  - 72-hour check:
         - Any EDR alerts post-recovery?
         - Any C2 DNS queries?
         - Any suspicious login attempts?
         
T+7 Days - Post-incident review:
         - What went wrong? (Phishing email bypassed filters)
         - What went right? (EDR detected payload execution)
         - What to improve? (DMARC enforcement, RMM tool restrictions)
         - Root cause analysis (RCA) completed

Long-Term Remediation Checklist

• Email Security:

  • Implement DMARC p=reject
  • Strengthen SPF/DKIM
  • Deploy advanced phishing filters
  • Block Any.Run URLs

• Network Security:

  • Block C2 IP addresses/domains at firewall
  • Implement network segmentation
  • Deploy DNS sinkholing for malicious domains
  • Monitor for outbound C2 traffic

• Endpoint Security:

  • Deploy EDR across all endpoints
  • Update antivirus signatures
  • Enable Windows Defender (as minimum)
  • Restrict RMM tool deployment (whitelist only)

• Access Control:

  • Enforce MFA for all admin accounts
  • Implement Tier 0/1/2 access controls
  • Require strong passwords (14+ characters)
  • Conduct quarterly privileged access reviews

• Training & Awareness:

  • Mandatory phishing awareness training (all users)
  • Quarterly phishing simulation campaigns

---

End of Defensive Hardening Guides