A file the email asked you to open
A spreadsheet or an invoice arrived with a request to open it. Check the sender and the file before anything runs. Opening it is not how you decide the message is real.
The message and the file are separate
The display name can say the file is from finance. The header is what says which server delivered it. Read that before you touch the attachment. The header lab is three messages already collected. Use that shape on this one.
Do not reply to the address in the message to ask if it is real. That reply goes to the sender the message chose.
What to check before it runs
Look at the file name and the type you were told it is. A spreadsheet that asks you to enable content is asking you to run something. Do not enable it to see what it does.
The attachment lesson is a static look: hashes, file types, and whether a macro is present, without running the file. That is the check. Running the file is not a check.
An invoice that wants a new bank account
A payment change is a phone call to a number you already had for that vendor, not a spreadsheet to open. The file can wait. The bank detail in the message is not confirmed by how official the logo looks.
If the user already opened it, write down the time and the host, and do not forward the file around the team so more people can "take a look."
Where the rest of the reading is
The email-security workbench is the longer set of lessons: headers, authentication, and reported messages. Start with the header lab and the attachment lesson if the only question today is this file.