How do you investigate and triage a suspected phishing email as a Tier 1 SOC Analyst?

Phishing triage is one of the foundational duties of a Tier 1 Security Operations Center (SOC) analyst. A structured investigation follows this 5-stage protocol:

1. 1. Extract and Analyze Raw Email Headers:

   Do not open hyperlinks or preview attachments directly in a normal client. Export the message as an .eml or .msg file and inspect the Internet Headers:

   • Authentication-Results: Check whether SPF (IP authorization), DKIM (digital signature), and DMARC (policy enforcement) passed or failed.
   • Return-Path: Verify if the return address matches the display From: address (look for spoofed domains or lookalike typo-squatted domains).
   • Received: Trace the email path from bottom to top to identify the originating mail server IP address.
2. 2. Inspect and Defang Embedded Hyperlinks:

   Extract all URLs and immediately defang them (e.g., hxxps[://]bad-domain[.]com) to prevent accidental clicking. Submit defanged URLs to reputation databases like VirusTotal, URLScan.io, and Cisco Talos.

3. 3. Safely Detonate Attachments in a Sandbox:

   If an attachment exists (.pdf, .html, .zip, .docx), calculate its cryptographic hashes (MD5, SHA-256) and query threat intelligence databases. If unclassified, detonate the file inside an isolated automated sandbox (e.g., Any.Run or Joe Sandbox) to observe process trees, registry modifications, and outbound command-and-control (C2) callback attempts.

4. 4. Scoping and Enterprise Containment:

   If malicious: search the secure email gateway (SEG) for identical Message-ID, Subject, or Sender IP to determine how many other employees received the message. Purge the email globally from all user inboxes, block the malicious sender domain/IP at the firewall/gateway, and revoke active sessions for any user who entered credentials.

5. 5. User Communication and Documentation:

   Notify the reporting user with praise for adhering to security awareness training, close the ticket with detailed IOC artifacts, and update the SOC knowledge base.