Phishing & Email Investigation

# Example Received chain - read BOTTOM to TOP
# Bottom = origin, Top = destination

Received: from mail.yourcompany.com (10.0.0.5)   ← 3. Delivered to your server
  by mx.yourcompany.com; Wed, 26 Aug 2026 14:32:01 +0000

Received: from smtp-relay.sendgrid.net (167.89.x.x)  ← 2. Passed through relay
  by mail.yourcompany.com; Wed, 26 Aug 2026 14:31:58 +0000

Received: from attacker-server.ru (185.220.x.x)   ← 1. TRUE ORIGIN
  by smtp-relay.sendgrid.net; Wed, 26 Aug 2026 14:31:55 +0000

# Key fields to extract from each Received header:
# - Hostname claimed by sending server
# - Actual IP address in parentheses
# - Timestamp
# Cross-reference claimed hostname vs actual IP using reverse DNS

# Example DMARC DNS record
_dmarc.example.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com; pct=100"

# Key tags:
# p=none       → Monitor only, no enforcement (weak)
# p=quarantine → Failed emails go to spam
# p=reject     → Failed emails are rejected outright (strongest)
# rua          → Aggregate report email address
# ruf          → Forensic report email address
# pct          → Percentage of mail subjected to policy

# Defanging conventions
# Replace . with [.]
# Replace http with hxxp
# Replace :// with ://

# Original (dangerous)
http://malicious-domain.com/steal-creds

# Defanged (safe to share)
hxxp://malicious-domain[.]com/steal-creds

# Python defang
url = "http://malicious.com/phish"
defanged = url.replace("http", "hxxp").replace(".", "[.]")
print(defanged)  # hxxp://malicious[.]com/phish

# Common lookalike techniques to check
paypal.com      → paypa1.com      (character substitution - l→1)
microsoft.com   → mlcrosoft.com   (character swap)
amazon.com      → amazon-support.com  (subdomain trick)
apple.com       → apple.com.verify-account.net  (domain after legitimate name)
google.com      → goog1e.com      (homoglyph - l→1)
bankofamerica.com → bankofamerica.secure-login.com

# Tools for detecting lookalikes
dnstwist - generates and checks permutations of a domain
URLCrazy - similar domain generation
# Check registration date - recent = suspicious

# Analyze Office document for macros without opening
pip install oletools
olevba suspicious.docm        # Extract and display VBA macro code
oleid suspicious.docm         # Quick indicator check

# Analyze PDF without opening
pdfid suspicious.pdf          # Check for JavaScript, actions, embedded files
pdf-parser suspicious.pdf     # Deep structure analysis

# Get file metadata
exiftool suspicious.pdf       # Author, creation date, software used
exiftool suspicious.docx      # May reveal attacker's username or company

# Hash the file for IOC sharing
sha256sum suspicious.docm
md5sum suspicious.docm

# Check hash on VirusTotal
# https://www.virustotal.com/gui/file/[SHA256HASH]

PHISHING INVESTIGATION WORKFLOW

1. RECEIVE & TRIAGE (< 5 minutes)
   ├── Obtain raw email with full headers (EML format preferred)
   ├── Note: did user click link or open attachment?
   ├── Note: how many recipients received this email?
   └── Assign severity: Low / Medium / High / Critical

2. HEADER ANALYSIS (5-10 minutes)
   ├── Extract: From, Reply-To, Return-Path, X-Originating-IP
   ├── Trace Received chain - identify true origin IP
   ├── Check SPF / DKIM / DMARC results
   ├── Look up sending IP reputation (VirusTotal, AbuseIPDB)
   └── Check sender domain registration date (Whois)

3. CONTENT ANALYSIS (5-10 minutes)
   ├── Identify all URLs - defang before documenting
   ├── Identify all attachments - note file types and hashes
   ├── Check for urgency, generic greeting, grammar issues
   └── Assess BEC indicators if no links/attachments

4. URL ANALYSIS (5-15 minutes)
   ├── Submit all URLs to URLScan.io
   ├── Check each URL on VirusTotal
   ├── Verify destination - credential harvesting page?
   └── Check for redirect chains

5. ATTACHMENT ANALYSIS (10-20 minutes)
   ├── Hash file (SHA256) and check VirusTotal
   ├── Submit to Any.run or Hybrid Analysis sandbox
   ├── For Office docs: run olevba to extract macros
   └── Document all IOCs: IPs, domains, hashes, URLs

6. SCOPE ASSESSMENT
   ├── Query email gateway - how many mailboxes received this?
   ├── Query SIEM - did any user click the link?
   ├── Query SIEM - did any user open the attachment?
   └── Identify all potentially affected users

7. CONTAINMENT
   ├── Block sender domain/IP in email gateway
   ├── Pull/quarantine emails from all mailboxes
   ├── If link was clicked: isolate endpoint, reset credentials
   ├── If attachment opened: isolate endpoint, full IR process
   └── Notify affected users

8. DOCUMENTATION & ESCALATION
   ├── Document all findings and IOCs
   ├── Escalate based on severity and user interaction
   └── Submit IOCs to threat intel platform (MISP/OpenCTI)

PHISHING INVESTIGATION REPORT
Ticket: [ID]
Date: [Date]
Analyst: [Name]
Severity: Low / Medium / High / Critical

SUMMARY
Brief description of the phishing attempt and outcome.

EMAIL DETAILS
  From:          attacker@evil.com
  Display Name:  PayPal Security
  Reply-To:      different@other.com
  Subject:       Urgent: Your account has been suspended
  Date Received: 2026-08-26 14:32:01 UTC
  Recipients:    [N] users

AUTHENTICATION RESULTS
  SPF:   FAIL
  DKIM:  NONE
  DMARC: FAIL

SENDER ANALYSIS
  Sending IP:    185.220.x.x (TOR exit node)
  Domain Age:    3 days (registered 2026-08-23)
  Blacklisted:   Yes (VirusTotal 12/89)

INDICATORS OF COMPROMISE
  URLs:
    hxxp://paypa1[.]com/verify (VirusTotal: 45/89 malicious)
  Attachments:
    invoice.docm (SHA256: abc123...) - VBA macro detected
  IPs:
    185.220.x.x
  Domains:
    paypa1[.]com

USER INTERACTION
  [N] users clicked the link
  [N] users entered credentials
  [N] users opened attachment

CONTAINMENT ACTIONS TAKEN
  ✓ Sender domain blocked in email gateway
  ✓ Emails pulled from [N] mailboxes
  ✓ Credentials reset for affected users
  ✓ IOCs submitted to threat intel platform

RECOMMENDATIONS
  - Enable MFA for all users
  - Conduct phishing awareness training
  - Review email gateway filtering rules