| name | conducting-phishing-incident-response |
| description | Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages across the organization, and remediating affected accounts. Covers email header analysis, URL/attachment sandboxing, and mailbox-wide purge operations. Activates for requests involving phishing response, email incident, credential phishing, spear phishing investigation, or phishing remediation.
|
| domain | cybersecurity |
| subdomain | incident-response |
| tags | ["phishing-response","email-security","credential-compromise","email-header-analysis","mailbox-remediation"] |
| mitre_attack | ["T1566","T1204","T1534","T1598"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"] |
Conducting Phishing Incident Response
When to Use
- A user reports receiving a suspicious email via the phishing report button or abuse mailbox
- Email gateway detects a malicious email that bypassed initial filtering
- Threat intelligence indicates an active phishing campaign targeting the organization
- A user confirms they clicked a link or opened an attachment from a suspicious email
- Credentials have been entered on a suspected phishing page
Do not use for business email compromise (BEC) involving compromised internal accounts; use BEC response procedures which focus on account takeover investigation.
Common Misconfigurations & Verification
- Password reset without session/token revocation: the classic miss. AiTM kits (Evilginx, EvilProxy) steal the session cookie, so the attacker stays logged in after a password change. Always
Revoke-AzureADUserAllRefreshToken (or revoke sign-in sessions) AND reset the password — and re-verify MFA, since AiTM defeats it.
- Purge that tips off the campaign / misses copies: a soft-delete or subject-only search leaves the mail in some mailboxes and in Sent/forwarded copies. Use a precise Content Search (sender + URL + message-ID) and hard-delete, then confirm zero remaining hits.
- Attacker persistence left behind: after credential entry, check for inbox forwarding/redirect rules, mailbox delegation, and malicious OAuth app grants — resetting the password does not remove these. Removing them is required or the attacker keeps reading mail.
- Quishing/AiTM detection gaps: URL scanners can't decode QR images and rewrap-only gateways miss the real landing page; detonate the decoded URL in a sandbox.
Verify containment held: confirm the purge returned 0 remaining copies across all mailboxes; confirm old sessions are dead (no successful sign-ins post-revocation in the sign-in logs); confirm forwarding rules / OAuth grants are gone; and review the exposure-window sign-in and mail-access logs of each compromised account for exfiltration before closing.
Prerequisites
- Email security gateway with message trace and quarantine capabilities (Microsoft Defender for Office 365, Proofpoint, Mimecast)
- Microsoft 365 admin access or Google Workspace admin for mailbox search and purge
- Malware sandbox for attachment and URL analysis (ANY.RUN, Joe Sandbox, Hybrid Analysis)
- Email header analysis tools (MXToolbox Header Analyzer, Google Admin Toolbox)
- Identity provider access for account remediation (Azure AD, Okta, Duo)
- Phishing report intake process (dedicated mailbox or integrated report button)
