HackBlue

Tools · Incident response playbooks · 11 / 20

Playbook: responding to a reported phishing email

Handle a user-reported phish from intake to closure: analyze headers and links safely, find every recipient, purge the message, and check whether anyone clicked or entered credentials.

10 min read · practice only with authorization

Intake and first look

Get the original message as an attachment or through the report button, not a forward, so headers are preserved. Look at the sender address and domain, the Reply-To, the authentication results (SPF, DKIM, DMARC), the links’ real destinations, and any attachments. Do not click links or open attachments on your workstation; use a sandbox or URL analysis service that does not reveal your organization.

Scope the campaign

Search the mail platform for the same sender, subject, URLs, or attachment hash to find all recipients. In Microsoft 365, use Threat Explorer or Content Search; in Google Workspace, use the security investigation tool. Then check proxy, DNS, or endpoint logs for anyone who visited the URL, and sign-in logs for those users in the following hours.

Snippet
# Microsoft Defender advanced hunting
EmailEvents
| where Timestamp > ago(3d)
| where SenderFromAddress =~ "billing@invoices-example.net" or Subject has "Invoice 4471"
| project Timestamp, RecipientEmailAddress, DeliveryAction, NetworkMessageId

UrlClickEvents
| where Timestamp > ago(3d) and Url has "invoices-example.net"
| project Timestamp, AccountUpn, Url, ActionType

Lab: work a sample

Use a phishing sample from a public training corpus or one you craft in a lab mailbox with a harmless link to a domain you control. Extract the headers, decode any encoded URLs, identify the authentication results, and write the indicators: sender, domain, URL, IPs. Search your lab mailbox system for the indicators, simulate purging the message, and write the closure note.

Respond and close

Purge the message from all mailboxes, block the sender and URLs, and for anyone who entered credentials, reset the password, revoke sessions, review MFA registrations and mailbox rules. Thank the reporter and tell them the outcome: reporting is the behavior you want to reinforce.

Diagram

Phishing response

  1. Intake

    Get the original with headers; analyze safely.

  2. Scope

    Find all recipients and any clicks or credential entry.

  3. Contain

    Purge messages, block indicators, reset affected accounts.

  4. Close

    Document, thank the reporter, feed indicators to detections.

Check yourself

1. Why ask users to report the original message rather than forwarding it?

2. A user entered their password on the phishing page. Which step is essential?

3. Why give feedback to the person who reported the phish?