respond-phishing

name	respond-phishing
description	Respond to a reported phishing email following PICERL methodology. Use when a phishing email is reported or detected. Analyzes artifacts, identifies recipients who clicked, contains malicious IOCs, and removes emails from mailboxes.
required_roles	{"chronicle":"roles/chronicle.editor","soar":"roles/chronicle.soarAdmin","gti":"GTI Enterprise"}
personas	["incident-responder"]

Phishing Incident Response Skill

Structured workflow for responding to reported phishing emails using the PICERL model.

Inputs

• CASE_ID - SOAR case ID for the incident
• ALERT_GROUP_IDENTIFIERS - Alert group identifiers from SOAR
• REPORTED_EMAIL_ARTIFACTS - Information about the email:
  • Email headers
  • Email body
  • Attached files (hashes)
  • URLs in email
  • Recipient user ID(s)
  • Sender address/domain

Required Outputs

After completing each phase, you MUST report these outputs:

Identification Phase

Output	Description
PHISHING_URLS	URLs extracted from email body
PHISHING_IOCS	Confirmed malicious indicators (URLs, domains, hashes)
AFFECTED_USERS	All users who received the email
CLICKED_USERS	Users who clicked/interacted with malicious content
PHISHING_CATEGORY	Type: credential phish, spear phishing, BEC, malware delivery

Containment Phase

Output	Description
BLOCKED_IOCS	IOCs blocked at email gateway/proxy/firewall
CONTAINED_USERS	User accounts with restrictions applied
ISOLATED_ENDPOINTS	Endpoints isolated due to suspicious activity

Eradication Phase

Output	Description
DELETED_EMAILS	Count of malicious emails removed from mailboxes
QUARANTINED_EMAILS	Emails moved to quarantine

Recovery Phase

Output	Description
RESTORED_ACCOUNTS	User accounts restored to normal access
USER_NOTIFICATIONS	Users notified of incident and required actions

PICERL Phases

Phase 2: Identification

Step 2.1: Get Context & Check Duplicates

secops-soar.get_case_full_details(case_id=CASE_ID)

Use /check-duplicates.

Step 2.2: Analyze Email Artifacts

Extract from email:

• All URLs → EXTRACTED_URLS
• Sender domain/IP
• Attachment hashes → EXTRACTED_HASHES
• Reply-to addresses
• Header anomalies (SPF/DKIM failures)

Step 2.3: Enrich Extracted IOCs

For each IOC (URLs, domains, IPs, hashes):

Use /enrich-ioc:

/enrich-ioc IOC_VALUE IOC_TYPE

Identify confirmed malicious IOCs → MALICIOUS_IOCs.

Step 2.4: Categorize Phishing Type

Category	Indicators
Generic Credential Phish	Broad targeting, brand impersonation (Microsoft, Google)
Spear Phishing	Personalized, targets specific individuals
Whaling	Targets executives
BEC	Wire transfer requests, no malicious links
Brand Impersonation	Mimics known brands
Malware Delivery	Focus on attachments or download links

Document: PHISHING_CATEGORY

Step 2.5: Search for Related Activity (SIEM)

secops-mcp.search_security_events(
    text="Network connections or DNS to MALICIOUS_IOCs",
    hours_back=72
)

Look for:

• Other emails with same subject/sender
• URL clicks to malicious URLs
• File executions of malicious hashes
• Suspicious activity from recipients

Step 2.6: Identify Impact

• SIMILAR_EMAIL_RECIPIENTS - Who else received it
• POTENTIAL_COMPROMISED_USERS - Who clicked/interacted
• SUSPICIOUS_ENDPOINTS - Endpoints with related activity

Step 2.7: Document Identification

Use /document-in-case with findings.

---

Phase 3: Containment

Step 3.1: Block Network IOCs

For each IOC in MALICIOUS_IOCs:

Use /confirm-action:

"Block domain/IP/URL [VALUE]?"

If confirmed, implement blocks at:

• Email gateway
• Web proxy
• Firewall
• DNS

Step 3.2: Contain Potentially Compromised Users

For each user in POTENTIAL_COMPROMISED_USERS:

Trigger /respond-compromised-account

Step 3.3: Isolate Suspicious Endpoints

For each endpoint in SUSPICIOUS_ENDPOINTS:

Use /confirm-action:

"Isolate endpoint [HOSTNAME]?"

Step 3.4: Verify Containment

Monitor for continued activity to blocked IOCs.

Use /document-in-case with containment status.

---

Phase 4: Eradication

Step 4.1: Delete Malicious Emails

(Requires Email Gateway/Platform tools)

Search all mailboxes for:

• Same subject line
• Same sender
• Contains malicious URLs/attachments

Delete/quarantine identified emails. Document count of emails removed.

Step 4.2: Address Malware (If Applicable)

If phishing led to malware execution: → Trigger /respond-malware

Step 4.3: Document Eradication

Use /document-in-case with email deletion counts and actions.

---

Phase 5: Recovery

Step 5.1: User Account Recovery

If accounts disabled during containment:

• Verify threat is removed
• Re-enable accounts
• Force password change if credentials potentially compromised

Step 5.2: Endpoint Recovery

If endpoints isolated:

• Verify clean before reconnecting
• Follow malware response recovery if infected

Step 5.3: Validate Countermeasures

After lifting blocks, verify legitimate traffic isn't blocked.

Step 5.4: User Communication

Notify affected users:

• What happened
• Actions taken
• What they should do (change passwords, be vigilant)

---

Phase 6: Lessons Learned

Use /generate-report with:

• Phishing category
• Impact assessment
• Response timeline
• Emails deleted count
• Recommendations

Conduct review:

• How did it bypass email filters?
• Detection effectiveness
• User awareness gaps
• Recommended filter/rule updates

---

Critical Warnings

• DO check who else received the email
• DO NOT leave malicious emails in mailboxes
• DO NOT block legitimate business domains (verify first)
• VERIFY extracted domains against company-owned domains list

Phishing Response Checklist

• Email artifacts analyzed
• IOCs enriched and categorized
• All recipients identified
• Click/interaction assessed
• Malicious IOCs blocked
• Compromised users contained
• Malicious emails deleted from ALL mailboxes
• Users notified
• Report generated