SPF:   Does sending IP match domain's SPF record?
DKIM:  Does cryptographic signature verify?
DMARC: Combined SPF+DKIM policy evaluation

# Extract email headers (from .eml file)
cat phishing.eml | grep -E "^(From|To|Subject|Date|Received|Return-Path|Reply-To|Message-ID|X-Originating|Authentication-Results):"

# Check authentication results
cat phishing.eml | grep "Authentication-Results" | tr ';' '\n'

# Extract URLs from email body
cat phishing.eml | grep -oE "https?://[a-zA-Z0-9./?=&_%-]+" | sort -u

# Extract attachment hashes
# If attachment is base64 encoded in .eml:
cat phishing.eml | sed -n '/Content-Disposition: attachment/,/^--/p' | \
  grep -v "^--\|Content-" | base64 -d | sha256sum

# Analyze Office document for macros
olevba suspicious_document.docx
mraptor suspicious_document.docx

# Check URL with URLScan.io
curl -s -X POST "https://urlscan.io/api/v1/scan/" \
  -H "API-Key: $URLSCAN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://suspicious-domain.com/login","visibility":"unlisted"}'

# Check URL/domain with VirusTotal
curl -s "https://www.virustotal.com/api/v3/urls/$(echo -n 'https://suspicious.com' | base64 -w0)" \
  -H "x-apikey: $VT_KEY" | jq '.data.attributes.last_analysis_stats'

# Analyze attachment hash
curl -s "https://www.virustotal.com/api/v3/files/$SHA256" \
  -H "x-apikey: $VT_KEY" | jq '.data.attributes.last_analysis_stats'

# Submit to ANY.RUN sandbox (via API or manual)
# Check domain registration date (newly registered = suspicious)
whois suspicious-domain.com | grep -i "creation\|registrar\|registrant"

# M365 — Find all recipients of phishing email (Message Trace)
Get-MessageTrace -SenderAddress "[email protected]" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) |
  Select-Object Received, RecipientAddress, Status, Subject

# M365 — Search by subject line
Get-MessageTrace -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) |
  Where-Object {$_.Subject -like "*Urgent Invoice*"} |
  Select-Object RecipientAddress, Status

# Google Workspace — Admin audit log
# Use Admin Console > Reports > Email Log Search

# Count: received, delivered, clicked, submitted credentials

# Block sender domain at email gateway
# Block phishing URL at web proxy / DNS sinkhole
echo "address=/phishing-domain.com/127.0.0.1" >> /etc/dnsmasq.d/sinkhole.conf

# M365 — Purge phishing email from all mailboxes
New-ComplianceSearch -Name "PhishPurge" -ExchangeLocation All \
  -ContentMatchQuery 'from:[email protected] AND subject:"Urgent Invoice"'
Start-ComplianceSearch -Identity "PhishPurge"
# After search completes:
New-ComplianceSearchAction -SearchName "PhishPurge" -Purge -PurgeType SoftDelete

# Reset credentials for users who submitted credentials
# Revoke active sessions

# Disable affected users and force password reset
$AffectedUsers = @("[email protected]", "[email protected]")
foreach ($user in $AffectedUsers) {
    Set-ADUser -Identity $user -ChangePasswordAtLogon $true
    Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser -ObjectId $user).ObjectId
}

# Block IOCs in security tools
# Update email filtering rules
# Notify affected users
# Report to anti-phishing working group ([email protected])
# Update phishing awareness training
# Add detection rule for this campaign pattern

title: Phishing Ir Detection
id: 1ba1a85f-5f5c-46be-aa2e-e62ed8c144b6
status: experimental
description: Detects suspicious activity related to performing phishing ir techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*phishing*"
  condition: selection
level: high
tags:
  - attack.t1566
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools