Phishing
Phishing is a form of social engineering where attackers deceive individuals into revealing sensitive information (credentials, financial data) or performing actions (installing malware) by posing as a trustworthy entity in electronic communications.
Advanced Investigation Workflow
A professional response to a phishing alert goes beyond simple password resets; it involves a deep analysis of the impact and potential persistence.
- Header Analysis: Review the email headers to identify the true source, hop history, and any SPF/DKIM/DMARC failures.
- Log Correlation: Check sign-in logs (e.g., Azure AD/Entra ID) for successful or suspicious authentications originating from the attacker’s IPs or occurring around the time of the interaction.
- Persistence Check: Look for newly created inbox rules. Attackers often use rules to hide their activity (e.g., auto-moving security alerts to the trash) or for data exfiltration.
- Account Isolation: If a compromise is suspected, immediately isolate the account (revoke sessions, enable MFA) to prevent lateral movement.
- Detection Tuning: Update email security and SIEM detection rules based on the specific indicators of compromise (IoCs) found during the investigation.