๐ง Step 8: Identify Social Engineering
Look beyond technical indicators.
Ask:
What emotion is the email trying to create?
Common tactics include:
Fear ๐จ
Urgency โฐ
Curiosity ๐
Authority ๐
Greed ๐ฐ
Example:
"Your payroll account requires immediate verification."
The attacker wants you to react before thinking.
๐จ Step 9: Create a Phishing Detection Workflow
Your workflow can be:
Email Received
โ
Check Sender
โ
Inspect Headers
โ
Check SPF/DKIM/DMARC
โ
Inspect Links
โ
Check Attachments
โ
Analyze Social Engineering
โ
Determine Risk
โ
Report / Quarantine
๐ Step 10: Create a Phishing Investigation Report
Use this structure:
Incident:
Suspicious Email Investigation
Sender:
[Sender]
Subject:
[Subject]
Date/Time:
[Timestamp]
Indicators:
โข Suspicious sender
โข Suspicious URL
โข Authentication failure
โข Urgent request
SPF:
[Result]
DKIM:
[Result]
DMARC:
[Result]
Risk:
Low / Medium / High
Conclusion:
[Legitimate / Suspicious / Phishing]
Recommended Action:
[Block / Report / Delete / Investigate]
๐ฏ Mini Challenge
Find 5 safe sample phishing emails from security-awareness training resources.
For each one:
โ Identify the social-engineering tactic.
โ Check the sender information.
โ Identify suspicious links or attachments.
โ Examine available authentication results.
โ Decide whether the message is legitimate or suspicious.
โ Document your reasoning.
๐ก๏ธ Real-World SOC Scenario
Imagine an employee reports:
"I received an email saying my Microsoft account will be disabled."
A SOC analyst might:
1. Examine the sender.
2. Inspect email headers.
3. Check SPF/DKIM/DMARC.
4. Analyze the URL.
5. Search security intelligence for indicators.
6. Determine whether other employees received the same message.
7. Block or quarantine confirmed malicious indicators.
8. Alert affected users.
That's how a simple phishing report can become a real SOC investigation.
๐ก Easy Trick to Remember
STOP โ CHECK โ VERIFY โ REPORT
๐ Don't react immediately.
๐ Check the details.
โ Verify through an independent channel.
๐จ Report suspicious messages.
๐ Double Tap โค๏ธ For More
