Phishing Triage Like a SOC Analyst — Step by Step

08 NOV 2026 · 2 MIN READ · By Haroon Rasheed

// THREAT METADATA MITRE ATT&CK

Techniques:

T1566

Platforms:

microsoft365 google-workspace

Detection Tools:

Email Headers URLScan CyberChef

// TABLE OF CONTENTS (3)

Phishing remains the primary initial access vector for enterprise intrusions. For a SOC analyst, triaging a suspicious email submission requires rapid, structured extraction of artifacts without accidental detonation.

1. Inspecting Authentication Headers

Before clicking any links or opening sandbox environments, inspect the raw RFC 822 internet headers. Examine the following key authentication fields:

SPF (Sender Policy Framework): Verifies if the sending mail server is authorized by the domain’s DNS SPF record.
DKIM (DomainKeys Identified Mail): Validates cryptographic signatures to prove the email body and headers were not altered in transit.
DMARC (Domain-based Message Authentication): Specifies domain alignment policies when SPF or DKIM checks fail.

2. Analyzing Return Paths and Received Lines

Attackers often spoof the display name or From: address while routing messages through compromised third-party relays. Compare the visible header against the bottom-most Received: hops to identify the true originating IP address.

PARSE-HEADERS.SH

grep -Ei ’^(Received-SPF|Authentication-Results|Return-Path):’ raw-headers.txt

3. Extracting and Defanging URLs

Extract all hyperlinked references from both HTML and plaintext representations. Defang all extracted URLs (e.g., hxxps[://]malicious[.]example) to prevent accidental execution before submitting to sandbox environments or reputation lookups.

HUNTING-QUERY.KQL

EmailEvents
| where ThreatTypes has “Phish” or DeliveryAction == “Delivered”
| summarize Count=count() by SenderFromDomain, RecipientEmailAddress
| sort by Count desc

Haroon Rasheed

Islamabad, Pakistan

Senior Security Engineer | Detection Engineer | Threat Intelligence / OSINT

Certs: SC-900 · AZ-900 · CCSP-AWS | LinkedIn ↗ · Full bio →

Related Detection Lab Guides

ATT&CK / Topic Match

[08 NOV 2026] [detection] [T1059]

MITRE ATT&CK for Beginners, With a Ransomware Example — An introduction to the MITRE ATT&CK matrix for defensive engineers, breaking down tactical phases, adversary techniques, and detection telemetry.

1 MIN

An introduction to the MITRE ATT&CK matrix for defensive engineers, breaking down tactical phases, adversary techniques, and detection telemetry.

[08 NOV 2026] [awareness] [T1190]

How to Check If a CVE Affects You — The 5-Minute Workflow — A practical five-minute workflow for security analysts to verify vulnerability impact, inspect software inventory, and prioritize patching.

1 MIN

A practical five-minute workflow for security analysts to verify vulnerability impact, inspect software inventory, and prioritize patching.