Phishing email playbook

1. 1. Read the email like a strangerCheck the From address, the sender's domain letter by letter, the Reply-To address, and any pressure to act fast or share money or login details.
2. 2. Check who really sent itLook at the SPF, DKIM and DMARC results and the sending IP. A failure on a message that claims to be from our own company is a strong warning sign.
3. 3. Examine the link or attachment without opening itLook at the domain's age, any redirects and its reputation. Use the Intel lookup. Never open an attachment on your own machine.
4. 4. Find out who else received itCheck how many mailboxes got the same email. Real campaigns usually hit many people; a normal newsletter hits many too, so move on to the next step.
5. 5. Find out who acted on itSearch the web proxy for visits to the link, especially form submissions (POST requests), and the endpoint logs for attachments that were opened.
6. 6. Decide and actTrue positive: block the domain and sender, pull the email from all mailboxes, and reset credentials for anyone who entered them. False positive: note why it is safe and close it.

Tools you will use

Practice with this playbook

• SL-1001Suspicious email: sender domain similar to internal domainhigh
• SL-1002Email contains URL with external redirectlow
• SL-1033User-reported phishing: multiple recipients clicked URLhigh
• SL-1048Mail gateway: outbound volume spike from one senderlow