Case-class playbook: vishing-initial-access-v1 (M-Trends 2026 #2 vector, 11%)

[Juwon1405]

Goal

Ship dart_playbook/vishing-initial-access-v1.yaml for cases where
voice phishing is the suspected initial vector.

Why specialized

Vishing leaves a different evidence trail than email phishing:

• Phone system call records (PBX logs)
• Help desk tickets opened around the time of compromise
• User self-reports of suspicious calls
• MFA push fatigue patterns (multiple denies, then one approve)
• First-time admin activity from accounts that historically
  didn't administer infrastructure

senior-analyst-v2.yaml lists vishing as a posture prior (11%
probability) but does not specialize the phase ordering.

Reference

• M-Trends 2026 — vishing now dart-corr correlation join OOMs on M57 dataset (~5.2M MFT rows) #2 initial vector (after exploits)
• Scattered Spider (FBI/CISA) — vishing → SaaS pivot pattern
• 2025 Aflac case (no encryption, 22.65M records exposed via
  vishing-driven access)

Acceptance

• Specialized P1 (initial vector triage) for vishing
• At least 3 vishing-specific contradiction_triggers
• References cite Scattered Spider methodology