Phishing Triage

What This Playbook Covers

• This playbook handles the most common SOC intake: a user reports a suspicious email via the phishing report button, a forwarded message to phish@company.com, or a ticket from the help desk.
• Goal: triage each submission and reach one of three dispositions within 15 minutes — (1) Benign: legitimate marketing, newsletter, or internal communication the user misidentified. (2) Phishing Simulation: company-run phishing test. Record that the user reported it correctly (or failed to report it). (3) Malicious: real phishing attack targeting the organization. Escalate.
• MITRE ATT&CK maps phishing to T1566 (Phishing) with sub-techniques T1566.001 (Spearphishing Attachment), T1566.002 (Spearphishing Link), and T1566.003 (Spearphishing via Service).

Phase 1: Intake and Quick Filter (0-5 minutes)

Email Metadata — Find the Headers

Extract the raw email headers (use OSINT Tools for automated header analysis). All the critical information is here:

The authentication fields map directly to SPF and DKIM — when these fail, the email is almost certainly forged.

SPL query — search for phishing emails sent to other users from same sender/domain:

index=email sourcetype=email_security
| search sender_address="*attacker-domain.com" OR from_domain="attacker-domain.com"
| stats count by sender_address, recipient_addresses, subject
| where count > 1
| eval alert = "HIGH — same sender sent phishing emails to " . mvjoin(recipient_addresses, ", ")
| table _time, sender_address, recipient_addresses, subject, count, alert

Quick Checks

Phase 2: URL and Attachment Analysis (5-10 minutes)

URL Analysis

Extract URLs from the email body:

# Extract all URLs from an email file
grep -oE 'https?://[A-Za-z0-9./?=_%:-]*' email.eml

# Look for obfuscated URLs
cat email.eml | grep -iE '(href|http|url|link|click|redirect)'

Common obfuscation techniques to check for:

Attachment Analysis

Phase 3: Threat Intelligence Checks (10-12 minutes)

Check the Sender Domain

# Check domain reputation
whois attacker-domain.com
dig attacker-domain.com mx
dig attacker-domain.com txt

# Check for recently registered domain
whois attacker-domain.com | grep -E "Creation Date"
# Domains registered < 30 days ago are highly suspicious

Check URLs Against Threat Intelligence

Phase 4: SIEM Correlation (12-15 minutes)

Check if Other Users Received the Same Email

SPL query — find other recipients of the same phishing email (run in Splunk):

index=email sourcetype=email_security
| search subject="*URGENT*Password*Reset*" OR subject="*Invoice*Overdue*" OR sender_address="*@evil-domain.com"
| stats count by subject, sender_address, sender_ip, recipients
| where count > 1
| eval alert = "MULTIPLE RECIPIENTS — " . count . " users received phishing email from " . sender_address . " with subject '" . subject . "'"
| table _time, sender_address, subject, count, recipients, alert

Check if Any Recipient Clicked the Link

SPL query — correlate email events with proxy/web events:

index=proxy sourcetype=access_combined
| search dest_domain="evil-domain.com" OR dest_ip="ATTACKER_IP"
| eval user = coalesce(username, client_ip)
| stats count, values(url) as URLs, values(dest_domain) as Domains by user
| table _time, user, count, URLs, Domains

Phase 5: Disposition and Escalation (15 minutes)

Decision Matrix

Escalation Thresholds

Common Phishing Triage Mistakes

Related

• Phishing — detection and response for T1566 techniques
• Business Email Compromise Response — detection and response for T1566, T1114, T1098, T1586 techniques
• Initial Access Response — detection and response for T1566, T1190, T1189, T1133 techniques
• Kill Chain — covers the kill chain concepts
• OSI Model — covers the osi model concepts

Sources

• Microsoft — Investigate Phishing in Microsoft 365
• MITRE ATT&CK T1566
• CISA Phishing Playbook
• URLScan.io
• PhishTank