investigating-phishing-email-incident

Investigates phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires full incident investigation to determine scope and impact.

Aller à l'installation

Dépôt: xalgord/xalgorix
Dernière activité de la source: 6 juin 2026 à 16:41
Langue détectée de SKILL.md: anglais
Étoiles: 813
Forks: 146

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Retour à la recherche Retour à l’installation

name	investigating-phishing-email-incident
description	Investigates phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires full incident investigation to determine scope and impact.
domain	cybersecurity
subdomain	soc-operations
tags	["soc","phishing","incident-response","email-security","splunk","defender","sandbox"]
mitre_attack	["T1566.001","T1566.002","T1204.001","T1598.003"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Investigating Phishing Email Incident

When to Use

Use this skill when:

A user reports a suspicious email via the phishing report button or helpdesk ticket
Email security gateway flags a message that bypassed initial filters
Automated detection identifies credential harvesting URLs or malicious attachments
A phishing campaign targeting the organization requires scope assessment

Do not use for spam or marketing emails without malicious intent — route those to email administration for filter tuning.

Detection Gaps & Validation

Clean attachment, weaponized link: triagers detonate the attachment, get a benign verdict, and close — missing that the body's credential-harvest URL is the real payload. Always extract and analyze every URL (including those inside PDFs, QR codes, and HTML attachments) even when the file sandboxes clean.
Delayed/cloaked payloads: the URL serves a benign page to sandboxes and the harvester only after a redirect, on a second visit, or when the geo/User-Agent matches the target. Re-scan from a realistic egress and follow the full redirect chain rather than trusting a single URLScan result.
SPF/DKIM "pass" ≠ legitimate: a dmarc=pass from a lookalike or freshly registered domain, or a compromised-but-authenticated internal mailbox (thread hijacking), still phishes. Check domain age, display-name spoofing, and Reply-To/Return-Path mismatch, not just auth results.
Scope undercounted: searching only the reported subject misses recipients who got the same campaign with a rotated subject/sender. Pivot on sending IP, URL domain, and message-body hash, and confirm "who clicked" with proxy POSTs (credentials submitted) — not just GETs.
Validate the verdict: confirm a true positive by matching submitted-credential POSTs or sandbox C2 callbacks to the IOC, then audit each impacted mailbox for attacker-created inbox forwarding rules before declaring "no lateral movement". Tune FPs by routing confirmed marketing/bulk senders to gateway filtering instead of incident queues.

Prerequisites

Access to email gateway logs (Proofpoint, Mimecast, or Microsoft Defender for Office 365)
Splunk or SIEM with email log ingestion (O365 Message Trace, Exchange tracking logs)
Sandbox access (Any.Run, Joe Sandbox, or Hybrid Analysis) for URL/attachment detonation
Microsoft Graph API or Exchange Admin Center for email search and purge operations
URLScan.io and VirusTotal API keys

Workflow

Step 1: Extract and Analyze Email Headers

import email
from email import policy

with open("phishing_sample.eml", "rb") as f:
    msg = email.message_from_binary_file(f, policy=policy.default)

# Extract key headers
print(f"From: {msg['From']}")
print(f"Return-Path: {msg['Return-Path']}")
print(f"Reply-To: {msg['Reply-To']}")
print(f"Subject: {msg['Subject']}")
print(f"Message-ID: {msg['Message-ID']}")
print(f"X-Originating-IP: {msg['X-Originating-IP']}")

# Parse Received headers (bottom-up for true origin)
for header in reversed(msg.get_all('Received', [])):
    print(f"Received: {header[:120]}")

# Check authentication results
print(f"Authentication-Results: {msg['Authentication-Results']}")
print(f"DKIM-Signature: {msg.get('DKIM-Signature', 'NONE')[:80]}")

import requests

# Submit URL to URLScan.io
url_to_scan = "https://evil-login.example.com/office365"
response = requests.post(
    "https://urlscan.io/api/v1/scan/",
    headers={"API-Key": "YOUR_KEY", "Content-Type": "application/json"},
    json={"url": url_to_scan, "visibility": "unlisted"}
)
scan_id = response.json()["uuid"]
print(f"Scan URL: https://urlscan.io/result/{scan_id}/")

# Check VirusTotal for URL reputation
import vt
client = vt.Client("YOUR_VT_API_KEY")
url_id = vt.url_id(url_to_scan)
url_obj = client.get_object(f"/urls/{url_id}")
print(f"VT Score: {url_obj.last_analysis_stats}")
client.close()

import hashlib

# Calculate file hashes
with open("attachment.docx", "rb") as f:
    content = f.read()
    md5 = hashlib.md5(content).hexdigest()
    sha256 = hashlib.sha256(content).hexdigest()

print(f"MD5: {md5}")
print(f"SHA256: {sha256}")

# Submit to MalwareBazaar for lookup
response = requests.post(
    "https://mb-api.abuse.ch/api/v1/",
    data={"query": "get_info", "hash": sha256}
)
print(response.json()["query_status"])

index=email sourcetype="o365:messageTrace"
(SenderAddress="attacker@evil-domain.com" OR Subject="Urgent: Password Reset Required"
 OR MessageId="<phishing-message-id@evil.com>")
earliest=-7d
| stats count by RecipientAddress, DeliveryStatus, MessageTraceId
| sort - count

import requests

headers = {"Authorization": f"Bearer {access_token}"}
params = {
    "$filter": f"subject eq 'Urgent: Password Reset Required' and "
               f"receivedDateTime ge 2024-03-14T00:00:00Z",
    "$select": "sender,toRecipients,subject,receivedDateTime",
    "$top": 100
}
response = requests.get(
    "https://graph.microsoft.com/v1.0/users/admin@company.com/messages",
    headers=headers, params=params
)
messages = response.json()["value"]
print(f"Found {len(messages)} matching messages")

index=proxy dest="evil-login.example.com" earliest=-7d
| stats count, values(action) AS actions, latest(_time) AS last_access
  by src_ip, user
| lookup asset_lookup_by_cidr ip AS src_ip OUTPUT owner, category
| sort - count
| table user, src_ip, owner, actions, count, last_access

index=proxy dest="evil-login.example.com" http_method=POST earliest=-7d
| stats count by src_ip, user, url, status

# Microsoft 365 Compliance Search and Purge
New-ComplianceSearch -Name "Phishing_Purge_2024_0315" `
    -ExchangeLocation All `
    -ContentMatchQuery '(From:attacker@evil-domain.com) AND (Subject:"Urgent: Password Reset Required")'

Start-ComplianceSearch -Identity "Phishing_Purge_2024_0315"

# After search completes, execute purge
New-ComplianceSearchAction -SearchName "Phishing_Purge_2024_0315" -Purge -PurgeType SoftDelete

# Force password reset for impacted users
$impactedUsers = @("user1@company.com", "user2@company.com")
foreach ($user in $impactedUsers) {
    Set-MsolUserPassword -UserPrincipalName $user -ForceChangePassword $true
    Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser -ObjectId $user).ObjectId
}

| makeresults
| eval incident_id="PHI-2024-0315",
       reported_time="2024-03-15 09:12:00",
       sender="attacker@evil-domain[.]com",
       subject="Urgent: Password Reset Required",
       url="hxxps://evil-login[.]example[.]com/office365",
       recipients_count=47,
       clicked_count=5,
       credentials_submitted=2,
       emails_purged=47,
       passwords_reset=2,
       domains_blocked=1,
       disposition="True Positive - Credential Phishing Campaign"
| table incident_id, reported_time, sender, subject, url, recipients_count,
        clicked_count, credentials_submitted, emails_purged, passwords_reset, disposition

Term	Definition
SPF (Sender Policy Framework)	DNS TXT record specifying which mail servers are authorized to send on behalf of a domain
DKIM	DomainKeys Identified Mail — cryptographic signature proving email content was not altered in transit
DMARC	Domain-based Message Authentication, Reporting and Conformance — policy combining SPF and DKIM alignment
Credential Harvesting	Phishing technique using fake login pages to capture username/password combinations
Business Email Compromise (BEC)	Social engineering attack using compromised or spoofed executive email for financial fraud
Message Trace	O365/Exchange log showing email routing, delivery status, and filtering actions for forensic analysis

PHISHING INCIDENT REPORT — PHI-2024-0315
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Reported:     2024-03-15 09:12 UTC by jsmith (Finance)
Sender:       attacker@evil-domain[.]com (SPF: FAIL, DKIM: NONE, DMARC: FAIL)
Subject:      Urgent: Password Reset Required
Payload:      Credential harvesting URL

IOCs:
  URL:        hxxps://evil-login[.]example[.]com/office365
  Domain:     evil-login[.]example[.]com (registered 2024-03-14, Namecheap)
  IP:         185.234.xx.xx (VT: 12/90 malicious)

Scope:
  Recipients: 47 users across Finance and HR departments
  Clicked:    5 users visited phishing URL
  Submitted:  2 users entered credentials (confirmed via POST in proxy logs)

Containment:
  [DONE] 47 emails purged via Compliance Search
  [DONE] Domain blocked on proxy and DNS sinkhole
  [DONE] 2 user passwords reset, sessions revoked
  [DONE] MFA enforced for both compromised accounts
  [DONE] Inbox rules audited — no forwarding rules found

Status:       RESOLVED — No evidence of lateral movement post-compromise