[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFGQPVWS6RRFC54MKB925Q":3,"skill-same:01M6AFGQPVWS6RRFC54MKB925Q":141},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":96,"commitSha":97,"skillDirectory":98,"forksCount":99,"repositoryHtmlUrl":100,"repositoryHomepageUrl":101,"ownerHtmlUrl":102,"ownerBlogUrl":103,"ownerDescription":104,"updatedAt":105,"install":106,"resources":119},"01M6AFGQPVWS6RRFC54MKB925Q","investigating-phishing-email-incident",null,"Investigates phishing email incidents from initial user report through header analysis, URL\u002Fattachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires full incident investigation to determine scope and impact.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-phishing-email-incident\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"investigating phishing email incident","email","phishing","soc","analysis","t1566","initial-access","Tools","t1078","containment","email-security","splunk","sandbox","actions","website","create","development","defender","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: investigating-phishing-email-incident\ndescription: 'Investigates phishing email incidents from initial user report through\n  header analysis, URL\u002Fattachment detonation, impacted user identification, and containment\n  actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms.\n  Use when a reported phishing email requires full incident investigation to determine\n  scope and impact.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- phishing\n- incident-response\n- email-security\n- splunk\n- defender\n- sandbox\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\n- T1598\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - reconnaissance\n  - resource-development\n  - initial-access\n  - stealth\n  - positioning\n  techniques:\n  - id: T1598\n    name: Phishing for Information\n    tactic: reconnaissance\n    source: attack\n  - id: T1660\n    name: Phishing\n    tactic: initial-access\n    source: attack\n  - id: T1672\n    name: Email Spoofing\n    tactic: stealth\n    source: attack\n  - id: F1020.002\n    name: 'Create Fake Materials: Fake Website'\n    tactic: resource-development\n    source: f3\n  - id: T1539\n    name: Steal Web Session Cookie\n    tactic: positioning\n    source: attack\n  - id: F1006.002\n    name: 'Account Takeover: Exposed Login Credential'\n    tactic: initial-access\n    source: f3\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\n---\n# Investigating Phishing Email Incident\n\n## When to Use\n\nUse this skill when:\n- A user reports a suspicious email via the phishing report button or helpdesk ticket\n- Email security gateway flags a message that bypassed initial filters\n- Automated detection identifies credential harvesting URLs or malicious attachments\n- A phishing campaign targeting the organization requires scope assessment\n\n**Do not use** for spam or marketing emails without malicious intent — route those to email administration for filter tuning.\n\n## Prerequisites\n\n- Access to email gateway logs (Proofpoint, Mimecast, or Microsoft Defender for Office 365)\n- Splunk or SIEM with email log ingestion (O365 Message Trace, Exchange tracking logs)\n- Sandbox access (Any.Run, Joe Sandbox, or Hybrid Analysis) for URL\u002Fattachment detonation\n- Microsoft Graph API or Exchange Admin Center for email search and purge operations\n- URLScan.io and VirusTotal API keys\n\n## Workflow\n\n### Step 1: Extract and Analyze Email Headers\n\nObtain the full email headers (`.eml` file) from the reported message:\n\n```python\nimport email\nfrom email import policy\n\nwith open(\"phishing_sample.eml\", \"rb\") as f:\n    msg = email.message_from_binary_file(f, policy=policy.default)\n\n# Extract key headers\nprint(f\"From: {msg['From']}\")\nprint(f\"Return-Path: {msg['Return-Path']}\")\nprint(f\"Reply-To: {msg['Reply-To']}\")\nprint(f\"Subject: {msg['Subject']}\")\nprint(f\"Message-ID: {msg['Message-ID']}\")\nprint(f\"X-Originating-IP: {msg['X-Originating-IP']}\")\n\n# Parse Received headers (bottom-up for true origin)\nfor header in reversed(msg.get_all('Received', [])):\n    print(f\"Received: {header[:120]}\")\n\n# Check authentication results\nprint(f\"Authentication-Results: {msg['Authentication-Results']}\")\nprint(f\"DKIM-Signature: {msg.get('DKIM-Signature', 'NONE')[:80]}\")\n```\n\nKey checks:\n- **SPF**: Does `Return-Path` domain match sending IP? Look for `spf=pass` or `spf=fail`\n- **DKIM**: Is the signature valid? `dkim=pass` confirms the email was not modified in transit\n- **DMARC**: Does the `From` domain align with SPF\u002FDKIM domains? `dmarc=fail` indicates spoofing\n\n### Step 2: Analyze URLs and Attachments\n\n**URL Analysis:**\n\n```python\nimport requests\n\n# Submit URL to URLScan.io\nurl_to_scan = \"https:\u002F\u002Fevil-login.example.com\u002Foffice365\"\nresponse = requests.post(\n    \"https:\u002F\u002Furlscan.io\u002Fapi\u002Fv1\u002Fscan\u002F\",\n    headers={\"API-Key\": \"YOUR_KEY\", \"Content-Type\": \"application\u002Fjson\"},\n    json={\"url\": url_to_scan, \"visibility\": \"unlisted\"}\n)\nscan_id = response.json()[\"uuid\"]\nprint(f\"Scan URL: https:\u002F\u002Furlscan.io\u002Fresult\u002F{scan_id}\u002F\")\n\n# Check VirusTotal for URL reputation\nimport vt\nclient = vt.Client(\"YOUR_VT_API_KEY\")\nurl_id = vt.url_id(url_to_scan)\nurl_obj = client.get_object(f\"\u002Furls\u002F{url_id}\")\nprint(f\"VT Score: {url_obj.last_analysis_stats}\")\nclient.close()\n```\n\n**Attachment Analysis:**\n\n```python\nimport hashlib\n\n# Calculate file hashes\nwith open(\"attachment.docx\", \"rb\") as f:\n    content = f.read()\n    md5 = hashlib.md5(content).hexdigest()\n    sha256 = hashlib.sha256(content).hexdigest()\n\nprint(f\"MD5: {md5}\")\nprint(f\"SHA256: {sha256}\")\n\n# Submit to MalwareBazaar for lookup\nresponse = requests.post(\n    \"https:\u002F\u002Fmb-api.abuse.ch\u002Fapi\u002Fv1\u002F\",\n    data={\"query\": \"get_info\", \"hash\": sha256}\n)\nprint(response.json()[\"query_status\"])\n```\n\nSubmit to sandbox (Any.Run or Joe Sandbox) for dynamic analysis of macros, PowerShell execution, and C2 callbacks.\n\n### Step 3: Determine Campaign Scope\n\nSearch for all recipients of the same phishing email in Splunk:\n\n```spl\nindex=email sourcetype=\"o365:messageTrace\"\n(SenderAddress=\"attacker@evil-domain.com\" OR Subject=\"Urgent: Password Reset Required\"\n OR MessageId=\"\u003Cphishing-message-id@evil.com>\")\nearliest=-7d\n| stats count by RecipientAddress, DeliveryStatus, MessageTraceId\n| sort - count\n```\n\nAlternatively, use Microsoft Graph API:\n\n```python\nimport requests\n\nheaders = {\"Authorization\": f\"Bearer {access_token}\"}\nparams = {\n    \"$filter\": f\"subject eq 'Urgent: Password Reset Required' and \"\n               f\"receivedDateTime ge 2024-03-14T00:00:00Z\",\n    \"$select\": \"sender,toRecipients,subject,receivedDateTime\",\n    \"$top\": 100\n}\nresponse = requests.get(\n    \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002Fadmin@company.com\u002Fmessages\",\n    headers=headers, params=params\n)\nmessages = response.json()[\"value\"]\nprint(f\"Found {len(messages)} matching messages\")\n```\n\n### Step 4: Identify Impacted Users (Who Clicked)\n\nCheck proxy\u002Fweb logs for users who visited the phishing URL:\n\n```spl\nindex=proxy dest=\"evil-login.example.com\" earliest=-7d\n| stats count, values(action) AS actions, latest(_time) AS last_access\n  by src_ip, user\n| lookup asset_lookup_by_cidr ip AS src_ip OUTPUT owner, category\n| sort - count\n| table user, src_ip, owner, actions, count, last_access\n```\n\nCheck if credentials were submitted (POST requests to phishing domain):\n\n```spl\nindex=proxy dest=\"evil-login.example.com\" http_method=POST earliest=-7d\n| stats count by src_ip, user, url, status\n```\n\n### Step 5: Containment Actions\n\n**Purge emails from all mailboxes:**\n\n```powershell\n# Microsoft 365 Compliance Search and Purge\nNew-ComplianceSearch -Name \"Phishing_Purge_2024_0315\" `\n    -ExchangeLocation All `\n    -ContentMatchQuery '(From:attacker@evil-domain.com) AND (Subject:\"Urgent: Password Reset Required\")'\n\nStart-ComplianceSearch -Identity \"Phishing_Purge_2024_0315\"\n\n# After search completes, execute purge\nNew-ComplianceSearchAction -SearchName \"Phishing_Purge_2024_0315\" -Purge -PurgeType SoftDelete\n```\n\n**Block indicators:**\n- Add sender domain to email gateway block list\n- Add phishing URL domain to web proxy block list\n- Add attachment hash to endpoint detection block list\n- Create DNS sinkhole entry for phishing domain\n\n**Reset compromised credentials:**\n\n```powershell\n# Force password reset for impacted users\n$impactedUsers = @(\"user1@company.com\", \"user2@company.com\")\nforeach ($user in $impactedUsers) {\n    Set-MsolUserPassword -UserPrincipalName $user -ForceChangePassword $true\n    Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser -ObjectId $user).ObjectId\n}\n```\n\n### Step 6: Document and Report\n\nCreate incident report with full timeline, IOCs, impacted users, and remediation actions taken.\n\n```spl\n| makeresults\n| eval incident_id=\"PHI-2024-0315\",\n       reported_time=\"2024-03-15 09:12:00\",\n       sender=\"attacker@evil-domain[.]com\",\n       subject=\"Urgent: Password Reset Required\",\n       url=\"hxxps:\u002F\u002Fevil-login[.]example[.]com\u002Foffice365\",\n       recipients_count=47,\n       clicked_count=5,\n       credentials_submitted=2,\n       emails_purged=47,\n       passwords_reset=2,\n       domains_blocked=1,\n       disposition=\"True Positive - Credential Phishing Campaign\"\n| table incident_id, reported_time, sender, subject, url, recipients_count,\n        clicked_count, credentials_submitted, emails_purged, passwords_reset, disposition\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **SPF (Sender Policy Framework)** | DNS TXT record specifying which mail servers are authorized to send on behalf of a domain |\n| **DKIM** | DomainKeys Identified Mail — cryptographic signature proving email content was not altered in transit |\n| **DMARC** | Domain-based Message Authentication, Reporting and Conformance — policy combining SPF and DKIM alignment |\n| **Credential Harvesting** | Phishing technique using fake login pages to capture username\u002Fpassword combinations |\n| **Business Email Compromise (BEC)** | Social engineering attack using compromised or spoofed executive email for financial fraud |\n| **Message Trace** | O365\u002FExchange log showing email routing, delivery status, and filtering actions for forensic analysis |\n\n## Tools & Systems\n\n- **Microsoft Defender for Office 365**: Email security platform with Safe Links, Safe Attachments, and Threat Explorer for investigation\n- **URLScan.io**: Free URL analysis service capturing screenshots, DOM, cookies, and network requests\n- **Any.Run**: Interactive sandbox for detonating malicious files and URLs with real-time behavior analysis\n- **Proofpoint TAP**: Targeted Attack Protection dashboard showing clicked URLs and delivered threats per user\n- **PhishTool**: Dedicated phishing email analysis platform automating header parsing and IOC extraction\n\n## Common Scenarios\n\n- **Credential Phishing**: Fake O365 login page — check proxy for POST requests, force password resets for submitters\n- **Macro-Enabled Document**: Word doc with VBA macro — sandbox shows PowerShell download cradle, check endpoints for execution\n- **QR Code Phishing (Quishing)**: Email contains QR code linking to credential harvester — decode QR, submit URL to sandbox\n- **Thread Hijacking**: Attacker uses compromised mailbox to reply in existing threads — check for impossible travel or new inbox rules\n- **Voicemail Phishing**: Fake voicemail notification with HTML attachment — analyze attachment for redirect chains\n\n## Output Format\n\n```\nPHISHING INCIDENT REPORT — PHI-2024-0315\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nReported:     2024-03-15 09:12 UTC by jsmith (Finance)\nSender:       attacker@evil-domain[.]com (SPF: FAIL, DKIM: NONE, DMARC: FAIL)\nSubject:      Urgent: Password Reset Required\nPayload:      Credential harvesting URL\n\nIOCs:\n  URL:        hxxps:\u002F\u002Fevil-login[.]example[.]com\u002Foffice365\n  Domain:     evil-login[.]example[.]com (registered 2024-03-14, Namecheap)\n  IP:         185.234.xx.xx (VT: 12\u002F90 malicious)\n\nScope:\n  Recipients: 47 users across Finance and HR departments\n  Clicked:    5 users visited phishing URL\n  Submitted:  2 users entered credentials (confirmed via POST in proxy logs)\n\nContainment:\n  [DONE] 47 emails purged via Compliance Search\n  [DONE] Domain blocked on proxy and DNS sinkhole\n  [DONE] 2 user passwords reset, sessions revoked\n  [DONE] MFA enforced for both compromised accounts\n  [DONE] Inbox rules audited — no forwarding rules found\n\nStatus:       RESOLVED — No evidence of lateral movement post-compromise\n```\n","# Investigating Phishing Email Incident\n\n## When to Use\n\nUse this skill when:\n- A user reports a suspicious email via the phishing report button or helpdesk ticket\n- Email security gateway flags a message that bypassed initial filters\n- Automated detection identifies credential harvesting URLs or malicious attachments\n- A phishing campaign targeting the organization requires scope assessment\n\n**Do not use** for spam or marketing emails without malicious intent — route those to email administration for filter tuning.\n\n## Prerequisites\n\n- Access to email gateway logs (Proofpoint, Mimecast, or Microsoft Defender for Office 365)\n- Splunk or SIEM with email log ingestion (O365 Message Trace, Exchange tracking logs)\n- Sandbox access (Any.Run, Joe Sandbox, or Hybrid Analysis) for URL\u002Fattachment detonation\n- Microsoft Graph API or Exchange Admin Center for email search and purge operations\n- URLScan.io and VirusTotal API keys\n\n## Workflow\n\n### Step 1: Extract and Analyze Email Headers\n\nObtain the full email headers (`.eml` file) from the reported message:\n\n```python\nimport email\nfrom email import policy\n\nwith open(\"phishing_sample.eml\", \"rb\") as f:\n    msg = email.message_from_binary_file(f, policy=policy.default)\n\n# Extract key headers\nprint(f\"From: {msg['From']}\")\nprint(f\"Return-Path: {msg['Return-Path']}\")\nprint(f\"Reply-To: {msg['Reply-To']}\")\nprint(f\"Subject: {msg['Subject']}\")\nprint(f\"Message-ID: {msg['Message-ID']}\")\nprint(f\"X-Originating-IP: {msg['X-Originating-IP']}\")\n\n# Parse Received headers (bottom-up for true origin)\nfor header in reversed(msg.get_all('Received', [])):\n    print(f\"Received: {header[:120]}\")\n\n# Check authentication results\nprint(f\"Authentication-Results: {msg['Authentication-Results']}\")\nprint(f\"DKIM-Signature: {msg.get('DKIM-Signature', 'NONE')[:80]}\")\n```\n\nKey checks:\n- **SPF**: Does `Return-Path` domain match sending IP? Look for `spf=pass` or `spf=fail`\n- **DKIM**: Is the signature valid? `dkim=pass` confirms the email was not modified in transit\n- **DMARC**: Does the `From` domain align with SPF\u002FDKIM domains? `dmarc=fail` indicates spoofing\n\n### Step 2: Analyze URLs and Attachments\n\n**URL Analysis:**\n\n```python\nimport requests\n\n# Submit URL to URLScan.io\nurl_to_scan = \"https:\u002F\u002Fevil-login.example.com\u002Foffice365\"\nresponse = requests.post(\n    \"https:\u002F\u002Furlscan.io\u002Fapi\u002Fv1\u002Fscan\u002F\",\n    headers={\"API-Key\": \"YOUR_KEY\", \"Content-Type\": \"application\u002Fjson\"},\n    json={\"url\": url_to_scan, \"visibility\": \"unlisted\"}\n)\nscan_id = response.json()[\"uuid\"]\nprint(f\"Scan URL: https:\u002F\u002Furlscan.io\u002Fresult\u002F{scan_id}\u002F\")\n\n# Check VirusTotal for URL reputation\nimport vt\nclient = vt.Client(\"YOUR_VT_API_KEY\")\nurl_id = vt.url_id(url_to_scan)\nurl_obj = client.get_object(f\"\u002Furls\u002F{url_id}\")\nprint(f\"VT Score: {url_obj.last_analysis_stats}\")\nclient.close()\n```\n\n**Attachment Analysis:**\n\n```python\nimport hashlib\n\n# Calculate file hashes\nwith open(\"attachment.docx\", \"rb\") as f:\n    content = f.read()\n    md5 = hashlib.md5(content).hexdigest()\n    sha256 = hashlib.sha256(content).hexdigest()\n\nprint(f\"MD5: {md5}\")\nprint(f\"SHA256: {sha256}\")\n\n# Submit to MalwareBazaar for lookup\nresponse = requests.post(\n    \"https:\u002F\u002Fmb-api.abuse.ch\u002Fapi\u002Fv1\u002F\",\n    data={\"query\": \"get_info\", \"hash\": sha256}\n)\nprint(response.json()[\"query_status\"])\n```\n\nSubmit to sandbox (Any.Run or Joe Sandbox) for dynamic analysis of macros, PowerShell execution, and C2 callbacks.\n\n### Step 3: Determine Campaign Scope\n\nSearch for all recipients of the same phishing email in Splunk:\n\n```spl\nindex=email sourcetype=\"o365:messageTrace\"\n(SenderAddress=\"attacker@evil-domain.com\" OR Subject=\"Urgent: Password Reset Required\"\n OR MessageId=\"\u003Cphishing-message-id@evil.com>\")\nearliest=-7d\n| stats count by RecipientAddress, DeliveryStatus, MessageTraceId\n| sort - count\n```\n\nAlternatively, use Microsoft Graph API:\n\n```python\nimport requests\n\nheaders = {\"Authorization\": f\"Bearer {access_token}\"}\nparams = {\n    \"$filter\": f\"subject eq 'Urgent: Password Reset Required' and \"\n               f\"receivedDateTime ge 2024-03-14T00:00:00Z\",\n    \"$select\": \"sender,toRecipients,subject,receivedDateTime\",\n    \"$top\": 100\n}\nresponse = requests.get(\n    \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002Fadmin@company.com\u002Fmessages\",\n    headers=headers, params=params\n)\nmessages = response.json()[\"value\"]\nprint(f\"Found {len(messages)} matching messages\")\n```\n\n### Step 4: Identify Impacted Users (Who Clicked)\n\nCheck proxy\u002Fweb logs for users who visited the phishing URL:\n\n```spl\nindex=proxy dest=\"evil-login.example.com\" earliest=-7d\n| stats count, values(action) AS actions, latest(_time) AS last_access\n  by src_ip, user\n| lookup asset_lookup_by_cidr ip AS src_ip OUTPUT owner, category\n| sort - count\n| table user, src_ip, owner, actions, count, last_access\n```\n\nCheck if credentials were submitted (POST requests to phishing domain):\n\n```spl\nindex=proxy dest=\"evil-login.example.com\" http_method=POST earliest=-7d\n| stats count by src_ip, user, url, status\n```\n\n### Step 5: Containment Actions\n\n**Purge emails from all mailboxes:**\n\n```powershell\n# Microsoft 365 Compliance Search and Purge\nNew-ComplianceSearch -Name \"Phishing_Purge_2024_0315\" `\n    -ExchangeLocation All `\n    -ContentMatchQuery '(From:attacker@evil-domain.com) AND (Subject:\"Urgent: Password Reset Required\")'\n\nStart-ComplianceSearch -Identity \"Phishing_Purge_2024_0315\"\n\n# After search completes, execute purge\nNew-ComplianceSearchAction -SearchName \"Phishing_Purge_2024_0315\" -Purge -PurgeType SoftDelete\n```\n\n**Block indicators:**\n- Add sender domain to email gateway block list\n- Add phishing URL domain to web proxy block list\n- Add attachment hash to endpoint detection block list\n- Create DNS sinkhole entry for phishing domain\n\n**Reset compromised credentials:**\n\n```powershell\n# Force password reset for impacted users\n$impactedUsers = @(\"user1@company.com\", \"user2@company.com\")\nforeach ($user in $impactedUsers) {\n    Set-MsolUserPassword -UserPrincipalName $user -ForceChangePassword $true\n    Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser -ObjectId $user).ObjectId\n}\n```\n\n### Step 6: Document and Report\n\nCreate incident report with full timeline, IOCs, impacted users, and remediation actions taken.\n\n```spl\n| makeresults\n| eval incident_id=\"PHI-2024-0315\",\n       reported_time=\"2024-03-15 09:12:00\",\n       sender=\"attacker@evil-domain[.]com\",\n       subject=\"Urgent: Password Reset Required\",\n       url=\"hxxps:\u002F\u002Fevil-login[.]example[.]com\u002Foffice365\",\n       recipients_count=47,\n       clicked_count=5,\n       credentials_submitted=2,\n       emails_purged=47,\n       passwords_reset=2,\n       domains_blocked=1,\n       disposition=\"True Positive - Credential Phishing Campaign\"\n| table incident_id, reported_time, sender, subject, url, recipients_count,\n        clicked_count, credentials_submitted, emails_purged, passwords_reset, disposition\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **SPF (Sender Policy Framework)** | DNS TXT record specifying which mail servers are authorized to send on behalf of a domain |\n| **DKIM** | DomainKeys Identified Mail — cryptographic signature proving email content was not altered in transit |\n| **DMARC** | Domain-based Message Authentication, Reporting and Conformance — policy combining SPF and DKIM alignment |\n| **Credential Harvesting** | Phishing technique using fake login pages to capture username\u002Fpassword combinations |\n| **Business Email Compromise (BEC)** | Social engineering attack using compromised or spoofed executive email for financial fraud |\n| **Message Trace** | O365\u002FExchange log showing email routing, delivery status, and filtering actions for forensic analysis |\n\n## Tools & Systems\n\n- **Microsoft Defender for Office 365**: Email security platform with Safe Links, Safe Attachments, and Threat Explorer for investigation\n- **URLScan.io**: Free URL analysis service capturing screenshots, DOM, cookies, and network requests\n- **Any.Run**: Interactive sandbox for detonating malicious files and URLs with real-time behavior analysis\n- **Proofpoint TAP**: Targeted Attack Protection dashboard showing clicked URLs and delivered threats per user\n- **PhishTool**: Dedicated phishing email analysis platform automating header parsing and IOC extraction\n\n## Common Scenarios\n\n- **Credential Phishing**: Fake O365 login page — check proxy for POST requests, force password resets for submitters\n- **Macro-Enabled Document**: Word doc with VBA macro — sandbox shows PowerShell download cradle, check endpoints for execution\n- **QR Code Phishing (Quishing)**: Email contains QR code linking to credential harvester — decode QR, submit URL to sandbox\n- **Thread Hijacking**: Attacker uses compromised mailbox to reply in existing threads — check for impossible travel or new inbox rules\n- **Voicemail Phishing**: Fake voicemail notification with HTML attachment — analyze attachment for redirect chains\n\n## Output Format\n\n```\nPHISHING INCIDENT REPORT — PHI-2024-0315\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nReported:     2024-03-15 09:12 UTC by jsmith (Finance)\nSender:       attacker@evil-domain[.]com (SPF: FAIL, DKIM: NONE, DMARC: FAIL)\nSubject:      Urgent: Password Reset Required\nPayload:      Credential harvesting URL\n\nIOCs:\n  URL:        hxxps:\u002F\u002Fevil-login[.]example[.]com\u002Foffice365\n  Domain:     evil-login[.]example[.]com (registered 2024-03-14, Namecheap)\n  IP:         185.234.xx.xx (VT: 12\u002F90 malicious)\n\nScope:\n  Recipients: 47 users across Finance and HR departments\n  Clicked:    5 users visited phishing URL\n  Submitted:  2 users entered credentials (confirmed via POST in proxy logs)\n\nContainment:\n  [DONE] 47 emails purged via Compliance Search\n  [DONE] Domain blocked on proxy and DNS sinkhole\n  [DONE] 2 user passwords reset, sessions revoked\n  [DONE] MFA enforced for both compromised accounts\n  [DONE] Inbox rules audited — no forwarding rules found\n\nStatus:       RESOLVED — No evidence of lateral movement post-compromise\n```\n",{"name":5,"tags":52,"author":54,"domain":45,"license":15,"version":55,"mitre_f3":56,"nist_csf":84,"subdomain":89,"description":90,"mitre_attack":91},[30,29,53,37,38,44,39],"incident-response","mahipal","1.0",{"tactics":57,"version":62,"techniques":63},[58,59,33,60,61],"reconnaissance","resource-development","stealth","positioning","1.1",[64,68,71,74,78,81],{"id":65,"name":66,"source":67,"tactic":58},"T1598","Phishing for Information","attack",{"id":69,"name":70,"source":67,"tactic":33},"T1660","Phishing",{"id":72,"name":73,"source":67,"tactic":60},"T1672","Email Spoofing",{"id":75,"name":76,"source":77,"tactic":59},"F1020.002","Create Fake Materials: Fake Website","f3",{"id":79,"name":80,"source":67,"tactic":61},"T1539","Steal Web Session Cookie",{"id":82,"name":83,"source":77,"tactic":33},"F1006.002","Account Takeover: Exposed Login Credential",[85,86,87,88],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Investigates phishing email incidents from initial user report through header analysis, URL\u002Fattachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires full incident investigation to determine scope and impact.\n",[92,93,94,95,65],"T1078","T1685.002","T1685.005","T1566","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Finvestigating-phishing-email-incident",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":107,"prompt":117,"zipAvailable":118},[108,111,114],{"tool":109,"command":110},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill investigating-phishing-email-incident",{"tool":112,"command":113},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill investigating-phishing-email-incident",{"tool":115,"command":116},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill investigating-phishing-email-incident","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-phishing-email-incident\u002FSKILL.md",true,[120,126,131,135],{"path":121,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":124,"sourceHtmlUrl":125},"examples\u002Ferror-patterns.md","REFERENCE","参考文档",12700,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Fplugins\u002Fteam\u002Fskills\u002Fcross-cutting\u002Ferror-recovery\u002Fexamples\u002Ferror-patterns.md",{"path":127,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":129,"sourceHtmlUrl":130},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-phishing-email-incident\u002FLICENSE",{"path":132,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":133,"sourceHtmlUrl":134},"references\u002Fapi-reference.md",2514,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-phishing-email-incident\u002Freferences\u002Fapi-reference.md",{"path":136,"resourceType":137,"resourceTypeDesc":138,"sizeBytes":139,"sourceHtmlUrl":140},"scripts\u002Fagent.py","SCRIPT","脚本",7723,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-phishing-email-incident\u002Fscripts\u002Fagent.py",[142,168,191,217,243,270],{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[148],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[150,151,152,153,46,45,154,155,156,157,158,159,160,161,162,163,164,165,166,167],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":175,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[174],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[176,164,177,178,46,179,45,156,180,181,182,34,183,184,185,186,187,188,189,190],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":201,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[197,200],{"categoryNo":198,"categoryName":199,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[185,202,203,204,205,45,206,207,180,208,209,53,210,211,212,35,213,214,215,216],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":224,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[223],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[225,226,227,45,228,229,230,231,232,233,234,235,236,237,238,239,34,240,241,242],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[249],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[251,252,253,45,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":271,"name":272,"nameZh":6,"description":273,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":274,"categories":275,"keywords":277,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[276],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[46,278,45,279,280,281,30,282,283,284,285,35,286,213,31,287,288,289,290,291],"triaging security incident","siem","file","ioc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]