1. Prerequisites
- Full email headers (raw)
- Email body (raw + rendered)
- Sender address
- Attachments (if any)
- Embedded URLs
- Email security alert (if triggered)
Required Tools:
- Email platform: Microsoft 365 (Message Trace, Defender), Google Workspace (Email Log Search)
- Header analysis tools:
- Built-in analyzers / MXToolbox
- Threat intel:
- VirusTotal
- URLScan
- Internal logging:
- SIEM / log platform
2. Step-by-Step Instructions
- Collect Full Email Data
- Retrieve full email headers (not partial)
- Capture:
- Sender (From, Reply-To)
- Subject
- Timestamp
- Message-ID
- Analyse Authentication Results - Check:
- SPF → pass/fail
- DKIM → pass/fail
- DMARC → pass/fail/alignment.
- Indicators:
- SPF fail or softfail
- DKIM missing or invalid
- DMARC fail
- Validate Sender Identity
- Compare:
- Display Name vs Actual Email Address
- Domain similarity (typosquatting, homoglyphs)
- Check:
- Newly registered domains
- External sender spoofing internal user
- Compare:
- Review Email Routing
- Analyse
Received:headers:- Originating IP
- Sending infrastructure
- Unusual relays or geolocation anomalies
- Analyse
- Extract Indicators
- Pull out:
- All URLs (including obfuscated URLs) Attachment names + hashes
- Reply-To domain (often different)
- Perform Initial Reputation Checks
- URLS → VirusTotal/URLScan
- Domains → passive DNS / reputation
- File hashes → malware databases
- Assess Email Content:
- Look for:
- urgency/pressure tactics
- credential prompts
- financial requests
- suspicious attachments
- link text vs actual destination mismatch
- Look for:
3. Post-Action
- Ensure all analysed headers, extracted IOCs, and initial verdict are documented in the incident ticket
Contributor
Vishal Thakur GitHub: https://github.com/malienist
Jayden Vo GitHub: https://github.com/jayden-vo
Contributed to the Arcana Incident Response Documentation Framework.