[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71B9GCSM2THMR085JX131H1":3,"skill-same:01M71B9GCSM2THMR085JX131H1":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":6,"ownerDescription":63,"updatedAt":64,"install":65,"resources":77},"01M71B9GCSM2THMR085JX131H1","cyber-investigating-phishing-email-incident",null,"Investigates phishing email incidents from initial user report through header analysis, URL\u002Fattachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires full incident investigation to determine scope and impact.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-investigating-phishing-email-incident\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"incident","phishing","cyber investigating phishing email incident","investigating phishing email incident","email","URL","when","false","cybersecurity","containment","use","impact","true","sandbox","defender","incidents","identification","actions","scope","domain","2026-11-10 10:12:30",false,"---\nname: cyber-investigating-phishing-email-incident\ndescription: \"Investigates phishing email incidents from initial user report through header analysis, URL\u002Fattachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires full incident investigation to determine scope and impact.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: investigating-phishing-email-incident | description: 'Investigates phishing email incidents from initial user report through |   header analysis, URL\u002Fattachment detonation, impacted user identification, and containment |   actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. |   Use when a reported phishing email requires full incident investigation to determine |   scope and impact. |  |   ' | domain: cybersecurity | subdomain: soc-operations | tags: | \"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Investigating Phishing Email Incident\n\n## When to Use\n\nUse this skill when:\n- A user reports a suspicious email via the phishing report button or helpdesk ticket\n- Email security gateway flags a message that bypassed initial filters\n- Automated detection identifies credential harvesting URLs or malicious attachments\n- A phishing campaign targeting the organization requires scope assessment\n\n**Do not use** for spam or marketing emails without malicious intent — route those to email administration for filter tuning.\n\n## Prerequisites\n\n- Access to email gateway logs (Proofpoint, Mimecast, or Microsoft Defender for Office 365)\n- Splunk or SIEM with email log ingestion (O365 Message Trace, Exchange tracking logs)\n- Sandbox access (Any.Run, Joe Sandbox, or Hybrid Analysis) for URL\u002Fattachment detonation\n- Microsoft Graph API or Exchange Admin Center for email search and purge operations\n- URLScan.io and VirusTotal API keys\n\n## Workflow\n\n### Step 1: Extract and Analyze Email Headers\n\nObtain the full email headers (`.eml` file) from the reported message:\n\n```python\nimport email\nfrom email import policy\n\nwith open(\"phishing_sample.eml\", \"rb\") as f:\n    msg = email.message_from_binary_file(f, policy=policy.default)\n\n# Extract key headers\nprint(f\"From: {msg['From']}\")\nprint(f\"Return-Path: {msg['Return-Path']}\")\nprint(f\"Reply-To: {msg['Reply-To']}\")\nprint(f\"Subject: {msg['Subject']}\")\nprint(f\"Message-ID: {msg['Message-ID']}\")\nprint(f\"X-Originating-IP: {msg['X-Originating-IP']}\")\n\n# Parse Received headers (bottom-up for true origin)\nfor header in reversed(msg.get_all('Received', [])):\n    print(f\"Received: {header[:120]}\")\n\n# Check authentication results\nprint(f\"Authentication-Results: {msg['Authentication-Results']}\")\nprint(f\"DKIM-Signature: {msg.get('DKIM-Signature', 'NONE')[:80]}\")\n```\n\nKey checks:\n- **SPF**: Does `Return-Path` domain match sending IP? Look for `spf=pass` or `spf=fail`\n- **DKIM**: Is the signature valid? `dkim=pass` confirms the email was not modified in transit\n- **DMARC**: Does the `From` domain align with SPF\u002FDKIM domains? `dmarc=fail` indicates spoofing\n\n### Step 2: Analyze URLs and Attachments\n\n**URL Analysis:**\n\n```python\nimport requests\n\n# Submit URL to URLScan.io\nurl_to_scan = \"https:\u002F\u002Fevil-login.example.com\u002Foffice365\"\nresponse = requests.post(\n    \"https:\u002F\u002Furlscan.io\u002Fapi\u002Fv1\u002Fscan\u002F\",\n    headers={\"API-Key\": \"YOUR_KEY\", \"Content-Type\": \"application\u002Fjson\"},\n    json={\"url\": url_to_scan, \"visibility\": \"unlisted\"}\n)\nscan_id = response.json()[\"uuid\"]\nprint(f\"Scan URL: https:\u002F\u002Furlscan.io\u002Fresult\u002F{scan_id}\u002F\")\n\n# Check VirusTotal for URL reputation\nimport vt\nclient = vt.Client(\"YOUR_VT_API_KEY\")\nurl_id = vt.url_id(url_to_scan)\nurl_obj = client.get_object(f\"\u002Furls\u002F{url_id}\")\nprint(f\"VT Score: {url_obj.last_analysis_stats}\")\nclient.close()\n```\n\n**Attachment Analysis:**\n\n```python\nimport hashlib\n\n# Calculate file hashes\nwith open(\"attachment.docx\", \"rb\") as f:\n    content = f.read()\n    md5 = hashlib.md5(content).hexdigest()\n    sha256 = hashlib.sha256(content).hexdigest()\n\nprint(f\"MD5: {md5}\")\nprint(f\"SHA256: {sha256}\")\n\n# Submit to MalwareBazaar for lookup\nresponse = requests.post(\n    \"https:\u002F\u002Fmb-api.abuse.ch\u002Fapi\u002Fv1\u002F\",\n    data={\"query\": \"get_info\", \"hash\": sha256}\n)\nprint(response.json()[\"query_status\"])\n```\n\nSubmit to sandbox (Any.Run or Joe Sandbox) for dynamic analysis of macros, PowerShell execution, and C2 callbacks.\n\n### Step 3: Determine Campaign Scope\n\nSearch for all recipients of the same phishing email in Splunk:\n\n```spl\nindex=email sourcetype=\"o365:messageTrace\"\n(SenderAddress=\"attacker@evil-domain.com\" OR Subject=\"Urgent: Password Reset Required\"\n OR MessageId=\"\u003Cphishing-message-id@evil.com>\")\nearliest=-7d\n| stats count by RecipientAddress, DeliveryStatus, MessageTraceId\n| sort - count\n```\n\nAlternatively, use Microsoft Graph API:\n\n```python\nimport requests\n\nheaders = {\"Authorization\": f\"Bearer {access_token}\"}\nparams = {\n    \"$filter\": f\"subject eq 'Urgent: Password Reset Required' and \"\n               f\"receivedDateTime ge 2024-03-14T00:00:00Z\",\n    \"$select\": \"sender,toRecipients,subject,receivedDateTime\",\n    \"$top\": 100\n}\nresponse = requests.get(\n    \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002Fadmin@company.com\u002Fmessages\",\n    headers=headers, params=params\n)\nmessages = response.json()[\"value\"]\nprint(f\"Found {len(messages)} matching messages\")\n```\n\n### Step 4: Identify Impacted Users (Who Clicked)\n\nCheck proxy\u002Fweb logs for users who visited the phishing URL:\n\n```spl\nindex=proxy dest=\"evil-login.example.com\" earliest=-7d\n| stats count, values(action) AS actions, latest(_time) AS last_access\n  by src_ip, user\n| lookup asset_lookup_by_cidr ip AS src_ip OUTPUT owner, category\n| sort - count\n| table user, src_ip, owner, actions, count, last_access\n```\n\nCheck if credentials were submitted (POST requests to phishing domain):\n\n```spl\nindex=proxy dest=\"evil-login.example.com\" http_method=POST earliest=-7d\n| stats count by src_ip, user, url, status\n```\n\n### Step 5: Containment Actions\n\n**Purge emails from all mailboxes:**\n\n```powershell\n# Microsoft 365 Compliance Search and Purge\nNew-ComplianceSearch -Name \"Phishing_Purge_2024_0315\" `\n    -ExchangeLocation All `\n    -ContentMatchQuery '(From:attacker@evil-domain.com) AND (Subject:\"Urgent: Password Reset Required\")'\n\nStart-ComplianceSearch -Identity \"Phishing_Purge_2024_0315\"\n\n# After search completes, execute purge\nNew-ComplianceSearchAction -SearchName \"Phishing_Purge_2024_0315\" -Purge -PurgeType SoftDelete\n```\n\n**Block indicators:**\n- Add sender domain to email gateway block list\n- Add phishing URL domain to web proxy block list\n- Add attachment hash to endpoint detection block list\n- Create DNS sinkhole entry for phishing domain\n\n**Reset compromised credentials:**\n\n```powershell\n# Force password reset for impacted users\n$impactedUsers = @(\"user1@company.com\", \"user2@company.com\")\nforeach ($user in $impactedUsers) {\n    Set-MsolUserPassword -UserPrincipalName $user -ForceChangePassword $true\n    Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser -ObjectId $user).ObjectId\n}\n```\n\n### Step 6: Document and Report\n\nCreate incident report with full timeline, IOCs, impacted users, and remediation actions taken.\n\n```spl\n| makeresults\n| eval incident_id=\"PHI-2024-0315\",\n       reported_time=\"2024-03-15 09:12:00\",\n       sender=\"attacker@evil-domain[.]com\",\n       subject=\"Urgent: Password Reset Required\",\n       url=\"hxxps:\u002F\u002Fevil-login[.]example[.]com\u002Foffice365\",\n       recipients_count=47,\n       clicked_count=5,\n       credentials_submitted=2,\n       emails_purged=47,\n       passwords_reset=2,\n       domains_blocked=1,\n       disposition=\"True Positive - Credential Phishing Campaign\"\n| table incident_id, reported_time, sender, subject, url, recipients_count,\n        clicked_count, credentials_submitted, emails_purged, passwords_reset, disposition\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **SPF (Sender Policy Framework)** | DNS TXT record specifying which mail servers are authorized to send on behalf of a domain |\n| **DKIM** | DomainKeys Identified Mail — cryptographic signature proving email content was not altered in transit |\n| **DMARC** | Domain-based Message Authentication, Reporting and Conformance — policy combining SPF and DKIM alignment |\n| **Credential Harvesting** | Phishing technique using fake login pages to capture username\u002Fpassword combinations |\n| **Business Email Compromise (BEC)** | Social engineering attack using compromised or spoofed executive email for financial fraud |\n| **Message Trace** | O365\u002FExchange log showing email routing, delivery status, and filtering actions for forensic analysis |\n\n## Tools & Systems\n\n- **Microsoft Defender for Office 365**: Email security platform with Safe Links, Safe Attachments, and Threat Explorer for investigation\n- **URLScan.io**: Free URL analysis service capturing screenshots, DOM, cookies, and network requests\n- **Any.Run**: Interactive sandbox for detonating malicious files and URLs with real-time behavior analysis\n- **Proofpoint TAP**: Targeted Attack Protection dashboard showing clicked URLs and delivered threats per user\n- **PhishTool**: Dedicated phishing email analysis platform automating header parsing and IOC extraction\n\n## Common Scenarios\n\n- **Credential Phishing**: Fake O365 login page — check proxy for POST requests, force password resets for submitters\n- **Macro-Enabled Document**: Word doc with VBA macro — sandbox shows PowerShell download cradle, check endpoints for execution\n- **QR Code Phishing (Quishing)**: Email contains QR code linking to credential harvester — decode QR, submit URL to sandbox\n- **Thread Hijacking**: Attacker uses compromised mailbox to reply in existing threads — check for impossible travel or new inbox rules\n- **Voicemail Phishing**: Fake voicemail notification with HTML attachment — analyze attachment for redirect chains\n\n## Output Format\n\n```\nPHISHING INCIDENT REPORT — PHI-2024-0315\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nReported:     2024-03-15 09:12 UTC by jsmith (Finance)\nSender:       attacker@evil-domain[.]com (SPF: FAIL, DKIM: NONE, DMARC: FAIL)\nSubject:      Urgent: Password Reset Required\nPayload:      Credential harvesting URL\n\nIOCs:\n  URL:        hxxps:\u002F\u002Fevil-login[.]example[.]com\u002Foffice365\n  Domain:     evil-login[.]example[.]com (registered 2024-03-14, Namecheap)\n  IP:         185.234.xx.xx (VT: 12\u002F90 malicious)\n\nScope:\n  Recipients: 47 users across Finance and HR departments\n  Clicked:    5 users visited phishing URL\n  Submitted:  2 users entered credentials (confirmed via POST in proxy logs)\n\nContainment:\n  [DONE] 47 emails purged via Compliance Search\n  [DONE] Domain blocked on proxy and DNS sinkhole\n  [DONE] 2 user passwords reset, sessions revoked\n  [DONE] MFA enforced for both compromised accounts\n  [DONE] Inbox rules audited — no forwarding rules found\n\nStatus:       RESOLVED — No evidence of lateral movement post-compromise\n```\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Investigating Phishing Email Incident\n\n## When to Use\n\nUse this skill when:\n- A user reports a suspicious email via the phishing report button or helpdesk ticket\n- Email security gateway flags a message that bypassed initial filters\n- Automated detection identifies credential harvesting URLs or malicious attachments\n- A phishing campaign targeting the organization requires scope assessment\n\n**Do not use** for spam or marketing emails without malicious intent — route those to email administration for filter tuning.\n\n## Prerequisites\n\n- Access to email gateway logs (Proofpoint, Mimecast, or Microsoft Defender for Office 365)\n- Splunk or SIEM with email log ingestion (O365 Message Trace, Exchange tracking logs)\n- Sandbox access (Any.Run, Joe Sandbox, or Hybrid Analysis) for URL\u002Fattachment detonation\n- Microsoft Graph API or Exchange Admin Center for email search and purge operations\n- URLScan.io and VirusTotal API keys\n\n## Workflow\n\n### Step 1: Extract and Analyze Email Headers\n\nObtain the full email headers (`.eml` file) from the reported message:\n\n```python\nimport email\nfrom email import policy\n\nwith open(\"phishing_sample.eml\", \"rb\") as f:\n    msg = email.message_from_binary_file(f, policy=policy.default)\n\n# Extract key headers\nprint(f\"From: {msg['From']}\")\nprint(f\"Return-Path: {msg['Return-Path']}\")\nprint(f\"Reply-To: {msg['Reply-To']}\")\nprint(f\"Subject: {msg['Subject']}\")\nprint(f\"Message-ID: {msg['Message-ID']}\")\nprint(f\"X-Originating-IP: {msg['X-Originating-IP']}\")\n\n# Parse Received headers (bottom-up for true origin)\nfor header in reversed(msg.get_all('Received', [])):\n    print(f\"Received: {header[:120]}\")\n\n# Check authentication results\nprint(f\"Authentication-Results: {msg['Authentication-Results']}\")\nprint(f\"DKIM-Signature: {msg.get('DKIM-Signature', 'NONE')[:80]}\")\n```\n\nKey checks:\n- **SPF**: Does `Return-Path` domain match sending IP? Look for `spf=pass` or `spf=fail`\n- **DKIM**: Is the signature valid? `dkim=pass` confirms the email was not modified in transit\n- **DMARC**: Does the `From` domain align with SPF\u002FDKIM domains? `dmarc=fail` indicates spoofing\n\n### Step 2: Analyze URLs and Attachments\n\n**URL Analysis:**\n\n```python\nimport requests\n\n# Submit URL to URLScan.io\nurl_to_scan = \"https:\u002F\u002Fevil-login.example.com\u002Foffice365\"\nresponse = requests.post(\n    \"https:\u002F\u002Furlscan.io\u002Fapi\u002Fv1\u002Fscan\u002F\",\n    headers={\"API-Key\": \"YOUR_KEY\", \"Content-Type\": \"application\u002Fjson\"},\n    json={\"url\": url_to_scan, \"visibility\": \"unlisted\"}\n)\nscan_id = response.json()[\"uuid\"]\nprint(f\"Scan URL: https:\u002F\u002Furlscan.io\u002Fresult\u002F{scan_id}\u002F\")\n\n# Check VirusTotal for URL reputation\nimport vt\nclient = vt.Client(\"YOUR_VT_API_KEY\")\nurl_id = vt.url_id(url_to_scan)\nurl_obj = client.get_object(f\"\u002Furls\u002F{url_id}\")\nprint(f\"VT Score: {url_obj.last_analysis_stats}\")\nclient.close()\n```\n\n**Attachment Analysis:**\n\n```python\nimport hashlib\n\n# Calculate file hashes\nwith open(\"attachment.docx\", \"rb\") as f:\n    content = f.read()\n    md5 = hashlib.md5(content).hexdigest()\n    sha256 = hashlib.sha256(content).hexdigest()\n\nprint(f\"MD5: {md5}\")\nprint(f\"SHA256: {sha256}\")\n\n# Submit to MalwareBazaar for lookup\nresponse = requests.post(\n    \"https:\u002F\u002Fmb-api.abuse.ch\u002Fapi\u002Fv1\u002F\",\n    data={\"query\": \"get_info\", \"hash\": sha256}\n)\nprint(response.json()[\"query_status\"])\n```\n\nSubmit to sandbox (Any.Run or Joe Sandbox) for dynamic analysis of macros, PowerShell execution, and C2 callbacks.\n\n### Step 3: Determine Campaign Scope\n\nSearch for all recipients of the same phishing email in Splunk:\n\n```spl\nindex=email sourcetype=\"o365:messageTrace\"\n(SenderAddress=\"attacker@evil-domain.com\" OR Subject=\"Urgent: Password Reset Required\"\n OR MessageId=\"\u003Cphishing-message-id@evil.com>\")\nearliest=-7d\n| stats count by RecipientAddress, DeliveryStatus, MessageTraceId\n| sort - count\n```\n\nAlternatively, use Microsoft Graph API:\n\n```python\nimport requests\n\nheaders = {\"Authorization\": f\"Bearer {access_token}\"}\nparams = {\n    \"$filter\": f\"subject eq 'Urgent: Password Reset Required' and \"\n               f\"receivedDateTime ge 2024-03-14T00:00:00Z\",\n    \"$select\": \"sender,toRecipients,subject,receivedDateTime\",\n    \"$top\": 100\n}\nresponse = requests.get(\n    \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002Fadmin@company.com\u002Fmessages\",\n    headers=headers, params=params\n)\nmessages = response.json()[\"value\"]\nprint(f\"Found {len(messages)} matching messages\")\n```\n\n### Step 4: Identify Impacted Users (Who Clicked)\n\nCheck proxy\u002Fweb logs for users who visited the phishing URL:\n\n```spl\nindex=proxy dest=\"evil-login.example.com\" earliest=-7d\n| stats count, values(action) AS actions, latest(_time) AS last_access\n  by src_ip, user\n| lookup asset_lookup_by_cidr ip AS src_ip OUTPUT owner, category\n| sort - count\n| table user, src_ip, owner, actions, count, last_access\n```\n\nCheck if credentials were submitted (POST requests to phishing domain):\n\n```spl\nindex=proxy dest=\"evil-login.example.com\" http_method=POST earliest=-7d\n| stats count by src_ip, user, url, status\n```\n\n### Step 5: Containment Actions\n\n**Purge emails from all mailboxes:**\n\n```powershell\n# Microsoft 365 Compliance Search and Purge\nNew-ComplianceSearch -Name \"Phishing_Purge_2024_0315\" `\n    -ExchangeLocation All `\n    -ContentMatchQuery '(From:attacker@evil-domain.com) AND (Subject:\"Urgent: Password Reset Required\")'\n\nStart-ComplianceSearch -Identity \"Phishing_Purge_2024_0315\"\n\n# After search completes, execute purge\nNew-ComplianceSearchAction -SearchName \"Phishing_Purge_2024_0315\" -Purge -PurgeType SoftDelete\n```\n\n**Block indicators:**\n- Add sender domain to email gateway block list\n- Add phishing URL domain to web proxy block list\n- Add attachment hash to endpoint detection block list\n- Create DNS sinkhole entry for phishing domain\n\n**Reset compromised credentials:**\n\n```powershell\n# Force password reset for impacted users\n$impactedUsers = @(\"user1@company.com\", \"user2@company.com\")\nforeach ($user in $impactedUsers) {\n    Set-MsolUserPassword -UserPrincipalName $user -ForceChangePassword $true\n    Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser -ObjectId $user).ObjectId\n}\n```\n\n### Step 6: Document and Report\n\nCreate incident report with full timeline, IOCs, impacted users, and remediation actions taken.\n\n```spl\n| makeresults\n| eval incident_id=\"PHI-2024-0315\",\n       reported_time=\"2024-03-15 09:12:00\",\n       sender=\"attacker@evil-domain[.]com\",\n       subject=\"Urgent: Password Reset Required\",\n       url=\"hxxps:\u002F\u002Fevil-login[.]example[.]com\u002Foffice365\",\n       recipients_count=47,\n       clicked_count=5,\n       credentials_submitted=2,\n       emails_purged=47,\n       passwords_reset=2,\n       domains_blocked=1,\n       disposition=\"True Positive - Credential Phishing Campaign\"\n| table incident_id, reported_time, sender, subject, url, recipients_count,\n        clicked_count, credentials_submitted, emails_purged, passwords_reset, disposition\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **SPF (Sender Policy Framework)** | DNS TXT record specifying which mail servers are authorized to send on behalf of a domain |\n| **DKIM** | DomainKeys Identified Mail — cryptographic signature proving email content was not altered in transit |\n| **DMARC** | Domain-based Message Authentication, Reporting and Conformance — policy combining SPF and DKIM alignment |\n| **Credential Harvesting** | Phishing technique using fake login pages to capture username\u002Fpassword combinations |\n| **Business Email Compromise (BEC)** | Social engineering attack using compromised or spoofed executive email for financial fraud |\n| **Message Trace** | O365\u002FExchange log showing email routing, delivery status, and filtering actions for forensic analysis |\n\n## Tools & Systems\n\n- **Microsoft Defender for Office 365**: Email security platform with Safe Links, Safe Attachments, and Threat Explorer for investigation\n- **URLScan.io**: Free URL analysis service capturing screenshots, DOM, cookies, and network requests\n- **Any.Run**: Interactive sandbox for detonating malicious files and URLs with real-time behavior analysis\n- **Proofpoint TAP**: Targeted Attack Protection dashboard showing clicked URLs and delivered threats per user\n- **PhishTool**: Dedicated phishing email analysis platform automating header parsing and IOC extraction\n\n## Common Scenarios\n\n- **Credential Phishing**: Fake O365 login page — check proxy for POST requests, force password resets for submitters\n- **Macro-Enabled Document**: Word doc with VBA macro — sandbox shows PowerShell download cradle, check endpoints for execution\n- **QR Code Phishing (Quishing)**: Email contains QR code linking to credential harvester — decode QR, submit URL to sandbox\n- **Thread Hijacking**: Attacker uses compromised mailbox to reply in existing threads — check for impossible travel or new inbox rules\n- **Voicemail Phishing**: Fake voicemail notification with HTML attachment — analyze attachment for redirect chains\n\n## Output Format\n\n```\nPHISHING INCIDENT REPORT — PHI-2024-0315\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nReported:     2024-03-15 09:12 UTC by jsmith (Finance)\nSender:       attacker@evil-domain[.]com (SPF: FAIL, DKIM: NONE, DMARC: FAIL)\nSubject:      Urgent: Password Reset Required\nPayload:      Credential harvesting URL\n\nIOCs:\n  URL:        hxxps:\u002F\u002Fevil-login[.]example[.]com\u002Foffice365\n  Domain:     evil-login[.]example[.]com (registered 2024-03-14, Namecheap)\n  IP:         185.234.xx.xx (VT: 12\u002F90 malicious)\n\nScope:\n  Recipients: 47 users across Finance and HR departments\n  Clicked:    5 users visited phishing URL\n  Submitted:  2 users entered credentials (confirmed via POST in proxy logs)\n\nContainment:\n  [DONE] 47 emails purged via Compliance Search\n  [DONE] Domain blocked on proxy and DNS sinkhole\n  [DONE] 2 user passwords reset, sessions revoked\n  [DONE] MFA enforced for both compromised accounts\n  [DONE] Inbox rules audited — no forwarding rules found\n\nStatus:       RESOLVED — No evidence of lateral movement post-compromise\n```\n",{"hide":54,"name":5,"source":55,"license":15,"description":7,"authorized_lab":50,"origin_frontmatter":56},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: investigating-phishing-email-incident | description: 'Investigates phishing email incidents from initial user report through |   header analysis, URL\u002Fattachment detonation, impacted user identification, and containment |   actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. |   Use when a reported phishing email requires full incident investigation to determine |   scope and impact. |  |   ' | domain: cybersecurity | subdomain: soc-operations | tags: | ","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-investigating-phishing-email-incident",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-11 16:42:59",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":54},[67,70,73],{"tool":68,"command":69},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-investigating-phishing-email-incident",{"tool":71,"command":72},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-investigating-phishing-email-incident",{"tool":74,"command":75},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-investigating-phishing-email-incident","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-investigating-phishing-email-incident\u002FSKILL.md",[],[79,100,124,149,176,195],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":49},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[87,88,89,90,91,92,93,41,94,39,95,35,96,97,98,99],"zoom out","zoom","with","harness","how","section","re","understand","perspective","you","code","it","context",{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":49},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[107,108,90,109,110,111,112,113,114,115,116,39,117,35,118,119,120,121,122,123],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":131,"publishedAt":49},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[130],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[132,133,134,135,136,137,138,139,140,35,141,142,143,144,145,146,33,111,147,148],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","cold outreach","frame",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":161,"publishedAt":49},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[155,158],{"categoryNo":156,"categoryName":157,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":159,"categoryName":160,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师",[162,97,163,132,90,164,165,166,111,167,168,169,170,171,172,173,174,175,39,35],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":49},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[183,184,185,186,187,188,189,190,191,35,192,118,193,194],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":213,"publishedAt":49},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[201,204,207,210],{"categoryNo":202,"categoryName":203,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":205,"categoryName":206,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":208,"categoryName":209,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":211,"categoryName":212,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者",[214,215,216,35,118,217,90,218,112,39,219],"writing","writing skills","new","work","editing","Existing"]