IOC categories
- Sender and reply-to details.
- URLs and domains.
- Attachment names and hashes.
- Message timestamps.
- Redirects or landing pages.
- User and endpoint activity after interaction.
RR CYBERLAB • SOC Investigation
Phishing & IOC Investigation
Investigate suspicious email using message, URL, domain, attachment, endpoint and identity evidence.
QUICK READ
Phishing investigations combine email indicators with what the recipient actually did. A suspicious message is not the same as a confirmed compromise.
Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.
Workflow
- Preserve the message and headers where available.
- Inspect links safely using approved analysis methods.
- Check whether other users received the message.
- Determine whether the recipient clicked, opened or submitted credentials.
- Correlate endpoint, browser and authentication telemetry.
Example
A suspicious account-verification message links to a lookalike domain. If the user clicked but no credentials were submitted and endpoint telemetry shows no follow-on activity, the outcome may differ from a confirmed credential compromise.Common mistakes
- Treating a suspicious email as proof of compromise.
- Ignoring other recipients.
- Failing to check identity activity after a click.
Daily quiz hook
What should you investigate after a user receives a suspicious phishing email: only the email, or also what the user and endpoint did afterward?
Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.
Analyst practice note
A phishing investigation should preserve the original message and examine sender authentication, reply-to, links, attachment metadata, delivery scope, and recipient actions. Indicators of compromise need context and confidence; shared hosting and URL shorteners can complicate attribution.
In the fictional case, trace the message to endpoint and identity evidence and identify who else received it. Do not open suspicious attachments or visit questionable links in a normal environment; use approved analysis procedures and report the evidence source.
Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.