conducting-phishing-incident-response

name	conducting-phishing-incident-response
description	Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages across the organization, and remediating affected accounts. Covers email header analysis, URL/attachment sandboxing, and mailbox-wide purge operations. Activates for requests involving phishing response, email incident, credential phishing, spear phishing investigation, or phishing remediation.
domain	cybersecurity
subdomain	incident-response
tags	["phishing-response","email-security","credential-compromise","email-header-analysis","mailbox-remediation"]
version	1.0.0
author	mahipal
license	Apache-2.0

Conducting Phishing Incident Response

When to Use

• A user reports receiving a suspicious email via the phishing report button or abuse mailbox
• Email gateway detects a malicious email that bypassed initial filtering
• Threat intelligence indicates an active phishing campaign targeting the organization
• A user confirms they clicked a link or opened an attachment from a suspicious email
• Credentials have been entered on a suspected phishing page

Do not use for business email compromise (BEC) involving compromised internal accounts; use BEC response procedures which focus on account takeover investigation.

Prerequisites

• Email security gateway with message trace and quarantine capabilities (Microsoft Defender for Office 365, Proofpoint, Mimecast)
• Microsoft 365 admin access or Google Workspace admin for mailbox search and purge
• Malware sandbox for attachment and URL analysis (ANY.RUN, Joe Sandbox, Hybrid Analysis)
• Email header analysis tools (MXToolbox Header Analyzer, Google Admin Toolbox)
• Identity provider access for account remediation (Azure AD, Okta, Duo)
• Phishing report intake process (dedicated mailbox or integrated report button)

Workflow

Step 1: Receive and Triage the Phishing Report

Evaluate the reported email to determine if it is malicious:

• Extract the email as an .EML or .MSG file (preserves headers)
• Analyze email headers to determine the true sender, relay path, and authentication results

Email Header Analysis Checklist:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Return-Path:     billing@spoofed-domain[.]com
From:            "IT Support" <support@corp-lookalike[.]com>
Reply-To:        attacker@gmail[.]com (different from From)
SPF:             FAIL (sender IP not authorized for domain)
DKIM:            FAIL (signature invalid)
DMARC:           FAIL (policy: none - no enforcement)
Received:        from mail.attacker-infra[.]net [45.33.x.x]
X-Originating-IP: 45.33.x.x
Message-ID:      <[e-mail]>

Classification criteria:

• Confirmed Phishing: Malicious URL/attachment, spoofed sender, credential harvesting page
• Suspicious: Anomalous headers but no confirmed malicious content
• Spam/Marketing: Unwanted but not malicious
• Legitimate: Not a phishing email (false report)

Step 2: Analyze Malicious Content

Examine URLs and attachments in a safe environment:

URL Analysis: