[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DB0TEVTJQXJ3MHPPDAP3KE":3,"skill-same:01M7DB0TEVTJQXJ3MHPPDAP3KE":116},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":77,"commitSha":78,"skillDirectory":79,"forksCount":80,"repositoryHtmlUrl":81,"repositoryHomepageUrl":6,"ownerHtmlUrl":82,"ownerBlogUrl":83,"ownerDescription":84,"updatedAt":85,"install":86,"resources":99},"01M7DB0TEVTJQXJ3MHPPDAP3KE","investigating-phishing-email-incident",null,"Investigates phishing email incidents from initial user report through header analysis, URL\u002Fattachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires full incident investigation to determine scope and impact.","SaiVatsal\u002FSkills-I-Use","SaiVatsal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F242597752?v=4","01M7D5YM1T4VXW9203M0GFAHZ1","SaiVatsalPolimera","01M7D5YM2D61ST39XVR2V7B7ZJ",3,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Finvestigating-phishing-email-incident\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Finvestigating-phishing-email-incident\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: investigating-phishing-email-incident\ndescription: 'Investigates phishing email incidents from initial user report through\n  header analysis, URL\u002Fattachment detonation, impacted user identification, and containment\n  actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms.\n  Use when a reported phishing email requires full incident investigation to determine\n  scope and impact.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- phishing\n- incident-response\n- email-security\n- splunk\n- defender\n- sandbox\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\n- T1598\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - reconnaissance\n  - resource-development\n  - initial-access\n  - stealth\n  - positioning\n  techniques:\n  - id: T1598\n    name: Phishing for Information\n    tactic: reconnaissance\n    source: attack\n  - id: T1660\n    name: Phishing\n    tactic: initial-access\n    source: attack\n  - id: T1672\n    name: Email Spoofing\n    tactic: stealth\n    source: attack\n  - id: F1020.002\n    name: 'Create Fake Materials: Fake Website'\n    tactic: resource-development\n    source: f3\n  - id: T1539\n    name: Steal Web Session Cookie\n    tactic: positioning\n    source: attack\n  - id: F1006.002\n    name: 'Account Takeover: Exposed Login Credential'\n    tactic: initial-access\n    source: f3\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\n---\n# Investigating Phishing Email Incident\n\n## When to Use\n\nUse this skill when:\n- A user reports a suspicious email via the phishing report button or helpdesk ticket\n- Email security gateway flags a message that bypassed initial filters\n- Automated detection identifies credential harvesting URLs or malicious attachments\n- A phishing campaign targeting the organization requires scope assessment\n\n**Do not use** for spam or marketing emails without malicious intent — route those to email administration for filter tuning.\n\n## Prerequisites\n\n- Access to email gateway logs (Proofpoint, Mimecast, or Microsoft Defender for Office 365)\n- Splunk or SIEM with email log ingestion (O365 Message Trace, Exchange tracking logs)\n- Sandbox access (Any.Run, Joe Sandbox, or Hybrid Analysis) for URL\u002Fattachment detonation\n- Microsoft Graph API or Exchange Admin Center for email search and purge operations\n- URLScan.io and VirusTotal API keys\n\n## Workflow\n\n### Step 1: Extract and Analyze Email Headers\n\nObtain the full email headers (`.eml` file) from the reported message:\n\n```python\nimport email\nfrom email import policy\n\nwith open(\"phishing_sample.eml\", \"rb\") as f:\n    msg = email.message_from_binary_file(f, policy=policy.default)\n\n# Extract key headers\nprint(f\"From: {msg['From']}\")\nprint(f\"Return-Path: {msg['Return-Path']}\")\nprint(f\"Reply-To: {msg['Reply-To']}\")\nprint(f\"Subject: {msg['Subject']}\")\nprint(f\"Message-ID: {msg['Message-ID']}\")\nprint(f\"X-Originating-IP: {msg['X-Originating-IP']}\")\n\n# Parse Received headers (bottom-up for true origin)\nfor header in reversed(msg.get_all('Received', [])):\n    print(f\"Received: {header[:120]}\")\n\n# Check authentication results\nprint(f\"Authentication-Results: {msg['Authentication-Results']}\")\nprint(f\"DKIM-Signature: {msg.get('DKIM-Signature', 'NONE')[:80]}\")\n```\n\nKey checks:\n- **SPF**: Does `Return-Path` domain match sending IP? Look for `spf=pass` or `spf=fail`\n- **DKIM**: Is the signature valid? `dkim=pass` confirms the email was not modified in transit\n- **DMARC**: Does the `From` domain align with SPF\u002FDKIM domains? `dmarc=fail` indicates spoofing\n\n### Step 2: Analyze URLs and Attachments\n\n**URL Analysis:**\n\n```python\nimport requests\n\n# Submit URL to URLScan.io\nurl_to_scan = \"https:\u002F\u002Fevil-login.example.com\u002Foffice365\"\nresponse = requests.post(\n    \"https:\u002F\u002Furlscan.io\u002Fapi\u002Fv1\u002Fscan\u002F\",\n    headers={\"API-Key\": \"YOUR_KEY\", \"Content-Type\": \"application\u002Fjson\"},\n    json={\"url\": url_to_scan, \"visibility\": \"unlisted\"}\n)\nscan_id = response.json()[\"uuid\"]\nprint(f\"Scan URL: https:\u002F\u002Furlscan.io\u002Fresult\u002F{scan_id}\u002F\")\n\n# Check VirusTotal for URL reputation\nimport vt\nclient = vt.Client(\"YOUR_VT_API_KEY\")\nurl_id = vt.url_id(url_to_scan)\nurl_obj = client.get_object(f\"\u002Furls\u002F{url_id}\")\nprint(f\"VT Score: {url_obj.last_analysis_stats}\")\nclient.close()\n```\n\n**Attachment Analysis:**\n\n```python\nimport hashlib\n\n# Calculate file hashes\nwith open(\"attachment.docx\", \"rb\") as f:\n    content = f.read()\n    md5 = hashlib.md5(content).hexdigest()\n    sha256 = hashlib.sha256(content).hexdigest()\n\nprint(f\"MD5: {md5}\")\nprint(f\"SHA256: {sha256}\")\n\n# Submit to MalwareBazaar for lookup\nresponse = requests.post(\n    \"https:\u002F\u002Fmb-api.abuse.ch\u002Fapi\u002Fv1\u002F\",\n    data={\"query\": \"get_info\", \"hash\": sha256}\n)\nprint(response.json()[\"query_status\"])\n```\n\nSubmit to sandbox (Any.Run or Joe Sandbox) for dynamic analysis of macros, PowerShell execution, and C2 callbacks.\n\n### Step 3: Determine Campaign Scope\n\nSearch for all recipients of the same phishing email in Splunk:\n\n```spl\nindex=email sourcetype=\"o365:messageTrace\"\n(SenderAddress=\"attacker@evil-domain.com\" OR Subject=\"Urgent: Password Reset Required\"\n OR MessageId=\"\u003Cphishing-message-id@evil.com>\")\nearliest=-7d\n| stats count by RecipientAddress, DeliveryStatus, MessageTraceId\n| sort - count\n```\n\nAlternatively, use Microsoft Graph API:\n\n```python\nimport requests\n\nheaders = {\"Authorization\": f\"Bearer {access_token}\"}\nparams = {\n    \"$filter\": f\"subject eq 'Urgent: Password Reset Required' and \"\n               f\"receivedDateTime ge 2024-03-14T00:00:00Z\",\n    \"$select\": \"sender,toRecipients,subject,receivedDateTime\",\n    \"$top\": 100\n}\nresponse = requests.get(\n    \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002Fadmin@company.com\u002Fmessages\",\n    headers=headers, params=params\n)\nmessages = response.json()[\"value\"]\nprint(f\"Found {len(messages)} matching messages\")\n```\n\n### Step 4: Identify Impacted Users (Who Clicked)\n\nCheck proxy\u002Fweb logs for users who visited the phishing URL:\n\n```spl\nindex=proxy dest=\"evil-login.example.com\" earliest=-7d\n| stats count, values(action) AS actions, latest(_time) AS last_access\n  by src_ip, user\n| lookup asset_lookup_by_cidr ip AS src_ip OUTPUT owner, category\n| sort - count\n| table user, src_ip, owner, actions, count, last_access\n```\n\nCheck if credentials were submitted (POST requests to phishing domain):\n\n```spl\nindex=proxy dest=\"evil-login.example.com\" http_method=POST earliest=-7d\n| stats count by src_ip, user, url, status\n```\n\n### Step 5: Containment Actions\n\n**Purge emails from all mailboxes:**\n\n```powershell\n# Microsoft 365 Compliance Search and Purge\nNew-ComplianceSearch -Name \"Phishing_Purge_2024_0315\" `\n    -ExchangeLocation All `\n    -ContentMatchQuery '(From:attacker@evil-domain.com) AND (Subject:\"Urgent: Password Reset Required\")'\n\nStart-ComplianceSearch -Identity \"Phishing_Purge_2024_0315\"\n\n# After search completes, execute purge\nNew-ComplianceSearchAction -SearchName \"Phishing_Purge_2024_0315\" -Purge -PurgeType SoftDelete\n```\n\n**Block indicators:**\n- Add sender domain to email gateway block list\n- Add phishing URL domain to web proxy block list\n- Add attachment hash to endpoint detection block list\n- Create DNS sinkhole entry for phishing domain\n\n**Reset compromised credentials:**\n\n```powershell\n# Force password reset for impacted users\n$impactedUsers = @(\"user1@company.com\", \"user2@company.com\")\nforeach ($user in $impactedUsers) {\n    Set-MsolUserPassword -UserPrincipalName $user -ForceChangePassword $true\n    Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser -ObjectId $user).ObjectId\n}\n```\n\n### Step 6: Document and Report\n\nCreate incident report with full timeline, IOCs, impacted users, and remediation actions taken.\n\n```spl\n| makeresults\n| eval incident_id=\"PHI-2024-0315\",\n       reported_time=\"2024-03-15 09:12:00\",\n       sender=\"attacker@evil-domain[.]com\",\n       subject=\"Urgent: Password Reset Required\",\n       url=\"hxxps:\u002F\u002Fevil-login[.]example[.]com\u002Foffice365\",\n       recipients_count=47,\n       clicked_count=5,\n       credentials_submitted=2,\n       emails_purged=47,\n       passwords_reset=2,\n       domains_blocked=1,\n       disposition=\"True Positive - Credential Phishing Campaign\"\n| table incident_id, reported_time, sender, subject, url, recipients_count,\n        clicked_count, credentials_submitted, emails_purged, passwords_reset, disposition\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **SPF (Sender Policy Framework)** | DNS TXT record specifying which mail servers are authorized to send on behalf of a domain |\n| **DKIM** | DomainKeys Identified Mail — cryptographic signature proving email content was not altered in transit |\n| **DMARC** | Domain-based Message Authentication, Reporting and Conformance — policy combining SPF and DKIM alignment |\n| **Credential Harvesting** | Phishing technique using fake login pages to capture username\u002Fpassword combinations |\n| **Business Email Compromise (BEC)** | Social engineering attack using compromised or spoofed executive email for financial fraud |\n| **Message Trace** | O365\u002FExchange log showing email routing, delivery status, and filtering actions for forensic analysis |\n\n## Tools & Systems\n\n- **Microsoft Defender for Office 365**: Email security platform with Safe Links, Safe Attachments, and Threat Explorer for investigation\n- **URLScan.io**: Free URL analysis service capturing screenshots, DOM, cookies, and network requests\n- **Any.Run**: Interactive sandbox for detonating malicious files and URLs with real-time behavior analysis\n- **Proofpoint TAP**: Targeted Attack Protection dashboard showing clicked URLs and delivered threats per user\n- **PhishTool**: Dedicated phishing email analysis platform automating header parsing and IOC extraction\n\n## Common Scenarios\n\n- **Credential Phishing**: Fake O365 login page — check proxy for POST requests, force password resets for submitters\n- **Macro-Enabled Document**: Word doc with VBA macro — sandbox shows PowerShell download cradle, check endpoints for execution\n- **QR Code Phishing (Quishing)**: Email contains QR code linking to credential harvester — decode QR, submit URL to sandbox\n- **Thread Hijacking**: Attacker uses compromised mailbox to reply in existing threads — check for impossible travel or new inbox rules\n- **Voicemail Phishing**: Fake voicemail notification with HTML attachment — analyze attachment for redirect chains\n\n## Output Format\n\n```\nPHISHING INCIDENT REPORT — PHI-2024-0315\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nReported:     2024-03-15 09:12 UTC by jsmith (Finance)\nSender:       attacker@evil-domain[.]com (SPF: FAIL, DKIM: NONE, DMARC: FAIL)\nSubject:      Urgent: Password Reset Required\nPayload:      Credential harvesting URL\n\nIOCs:\n  URL:        hxxps:\u002F\u002Fevil-login[.]example[.]com\u002Foffice365\n  Domain:     evil-login[.]example[.]com (registered 2024-03-14, Namecheap)\n  IP:         185.234.xx.xx (VT: 12\u002F90 malicious)\n\nScope:\n  Recipients: 47 users across Finance and HR departments\n  Clicked:    5 users visited phishing URL\n  Submitted:  2 users entered credentials (confirmed via POST in proxy logs)\n\nContainment:\n  [DONE] 47 emails purged via Compliance Search\n  [DONE] Domain blocked on proxy and DNS sinkhole\n  [DONE] 2 user passwords reset, sessions revoked\n  [DONE] MFA enforced for both compromised accounts\n  [DONE] Inbox rules audited — no forwarding rules found\n\nStatus:       RESOLVED — No evidence of lateral movement post-compromise\n```\n","# Investigating Phishing Email Incident\n\n## When to Use\n\nUse this skill when:\n- A user reports a suspicious email via the phishing report button or helpdesk ticket\n- Email security gateway flags a message that bypassed initial filters\n- Automated detection identifies credential harvesting URLs or malicious attachments\n- A phishing campaign targeting the organization requires scope assessment\n\n**Do not use** for spam or marketing emails without malicious intent — route those to email administration for filter tuning.\n\n## Prerequisites\n\n- Access to email gateway logs (Proofpoint, Mimecast, or Microsoft Defender for Office 365)\n- Splunk or SIEM with email log ingestion (O365 Message Trace, Exchange tracking logs)\n- Sandbox access (Any.Run, Joe Sandbox, or Hybrid Analysis) for URL\u002Fattachment detonation\n- Microsoft Graph API or Exchange Admin Center for email search and purge operations\n- URLScan.io and VirusTotal API keys\n\n## Workflow\n\n### Step 1: Extract and Analyze Email Headers\n\nObtain the full email headers (`.eml` file) from the reported message:\n\n```python\nimport email\nfrom email import policy\n\nwith open(\"phishing_sample.eml\", \"rb\") as f:\n    msg = email.message_from_binary_file(f, policy=policy.default)\n\n# Extract key headers\nprint(f\"From: {msg['From']}\")\nprint(f\"Return-Path: {msg['Return-Path']}\")\nprint(f\"Reply-To: {msg['Reply-To']}\")\nprint(f\"Subject: {msg['Subject']}\")\nprint(f\"Message-ID: {msg['Message-ID']}\")\nprint(f\"X-Originating-IP: {msg['X-Originating-IP']}\")\n\n# Parse Received headers (bottom-up for true origin)\nfor header in reversed(msg.get_all('Received', [])):\n    print(f\"Received: {header[:120]}\")\n\n# Check authentication results\nprint(f\"Authentication-Results: {msg['Authentication-Results']}\")\nprint(f\"DKIM-Signature: {msg.get('DKIM-Signature', 'NONE')[:80]}\")\n```\n\nKey checks:\n- **SPF**: Does `Return-Path` domain match sending IP? Look for `spf=pass` or `spf=fail`\n- **DKIM**: Is the signature valid? `dkim=pass` confirms the email was not modified in transit\n- **DMARC**: Does the `From` domain align with SPF\u002FDKIM domains? `dmarc=fail` indicates spoofing\n\n### Step 2: Analyze URLs and Attachments\n\n**URL Analysis:**\n\n```python\nimport requests\n\n# Submit URL to URLScan.io\nurl_to_scan = \"https:\u002F\u002Fevil-login.example.com\u002Foffice365\"\nresponse = requests.post(\n    \"https:\u002F\u002Furlscan.io\u002Fapi\u002Fv1\u002Fscan\u002F\",\n    headers={\"API-Key\": \"YOUR_KEY\", \"Content-Type\": \"application\u002Fjson\"},\n    json={\"url\": url_to_scan, \"visibility\": \"unlisted\"}\n)\nscan_id = response.json()[\"uuid\"]\nprint(f\"Scan URL: https:\u002F\u002Furlscan.io\u002Fresult\u002F{scan_id}\u002F\")\n\n# Check VirusTotal for URL reputation\nimport vt\nclient = vt.Client(\"YOUR_VT_API_KEY\")\nurl_id = vt.url_id(url_to_scan)\nurl_obj = client.get_object(f\"\u002Furls\u002F{url_id}\")\nprint(f\"VT Score: {url_obj.last_analysis_stats}\")\nclient.close()\n```\n\n**Attachment Analysis:**\n\n```python\nimport hashlib\n\n# Calculate file hashes\nwith open(\"attachment.docx\", \"rb\") as f:\n    content = f.read()\n    md5 = hashlib.md5(content).hexdigest()\n    sha256 = hashlib.sha256(content).hexdigest()\n\nprint(f\"MD5: {md5}\")\nprint(f\"SHA256: {sha256}\")\n\n# Submit to MalwareBazaar for lookup\nresponse = requests.post(\n    \"https:\u002F\u002Fmb-api.abuse.ch\u002Fapi\u002Fv1\u002F\",\n    data={\"query\": \"get_info\", \"hash\": sha256}\n)\nprint(response.json()[\"query_status\"])\n```\n\nSubmit to sandbox (Any.Run or Joe Sandbox) for dynamic analysis of macros, PowerShell execution, and C2 callbacks.\n\n### Step 3: Determine Campaign Scope\n\nSearch for all recipients of the same phishing email in Splunk:\n\n```spl\nindex=email sourcetype=\"o365:messageTrace\"\n(SenderAddress=\"attacker@evil-domain.com\" OR Subject=\"Urgent: Password Reset Required\"\n OR MessageId=\"\u003Cphishing-message-id@evil.com>\")\nearliest=-7d\n| stats count by RecipientAddress, DeliveryStatus, MessageTraceId\n| sort - count\n```\n\nAlternatively, use Microsoft Graph API:\n\n```python\nimport requests\n\nheaders = {\"Authorization\": f\"Bearer {access_token}\"}\nparams = {\n    \"$filter\": f\"subject eq 'Urgent: Password Reset Required' and \"\n               f\"receivedDateTime ge 2024-03-14T00:00:00Z\",\n    \"$select\": \"sender,toRecipients,subject,receivedDateTime\",\n    \"$top\": 100\n}\nresponse = requests.get(\n    \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002Fadmin@company.com\u002Fmessages\",\n    headers=headers, params=params\n)\nmessages = response.json()[\"value\"]\nprint(f\"Found {len(messages)} matching messages\")\n```\n\n### Step 4: Identify Impacted Users (Who Clicked)\n\nCheck proxy\u002Fweb logs for users who visited the phishing URL:\n\n```spl\nindex=proxy dest=\"evil-login.example.com\" earliest=-7d\n| stats count, values(action) AS actions, latest(_time) AS last_access\n  by src_ip, user\n| lookup asset_lookup_by_cidr ip AS src_ip OUTPUT owner, category\n| sort - count\n| table user, src_ip, owner, actions, count, last_access\n```\n\nCheck if credentials were submitted (POST requests to phishing domain):\n\n```spl\nindex=proxy dest=\"evil-login.example.com\" http_method=POST earliest=-7d\n| stats count by src_ip, user, url, status\n```\n\n### Step 5: Containment Actions\n\n**Purge emails from all mailboxes:**\n\n```powershell\n# Microsoft 365 Compliance Search and Purge\nNew-ComplianceSearch -Name \"Phishing_Purge_2024_0315\" `\n    -ExchangeLocation All `\n    -ContentMatchQuery '(From:attacker@evil-domain.com) AND (Subject:\"Urgent: Password Reset Required\")'\n\nStart-ComplianceSearch -Identity \"Phishing_Purge_2024_0315\"\n\n# After search completes, execute purge\nNew-ComplianceSearchAction -SearchName \"Phishing_Purge_2024_0315\" -Purge -PurgeType SoftDelete\n```\n\n**Block indicators:**\n- Add sender domain to email gateway block list\n- Add phishing URL domain to web proxy block list\n- Add attachment hash to endpoint detection block list\n- Create DNS sinkhole entry for phishing domain\n\n**Reset compromised credentials:**\n\n```powershell\n# Force password reset for impacted users\n$impactedUsers = @(\"user1@company.com\", \"user2@company.com\")\nforeach ($user in $impactedUsers) {\n    Set-MsolUserPassword -UserPrincipalName $user -ForceChangePassword $true\n    Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser -ObjectId $user).ObjectId\n}\n```\n\n### Step 6: Document and Report\n\nCreate incident report with full timeline, IOCs, impacted users, and remediation actions taken.\n\n```spl\n| makeresults\n| eval incident_id=\"PHI-2024-0315\",\n       reported_time=\"2024-03-15 09:12:00\",\n       sender=\"attacker@evil-domain[.]com\",\n       subject=\"Urgent: Password Reset Required\",\n       url=\"hxxps:\u002F\u002Fevil-login[.]example[.]com\u002Foffice365\",\n       recipients_count=47,\n       clicked_count=5,\n       credentials_submitted=2,\n       emails_purged=47,\n       passwords_reset=2,\n       domains_blocked=1,\n       disposition=\"True Positive - Credential Phishing Campaign\"\n| table incident_id, reported_time, sender, subject, url, recipients_count,\n        clicked_count, credentials_submitted, emails_purged, passwords_reset, disposition\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **SPF (Sender Policy Framework)** | DNS TXT record specifying which mail servers are authorized to send on behalf of a domain |\n| **DKIM** | DomainKeys Identified Mail — cryptographic signature proving email content was not altered in transit |\n| **DMARC** | Domain-based Message Authentication, Reporting and Conformance — policy combining SPF and DKIM alignment |\n| **Credential Harvesting** | Phishing technique using fake login pages to capture username\u002Fpassword combinations |\n| **Business Email Compromise (BEC)** | Social engineering attack using compromised or spoofed executive email for financial fraud |\n| **Message Trace** | O365\u002FExchange log showing email routing, delivery status, and filtering actions for forensic analysis |\n\n## Tools & Systems\n\n- **Microsoft Defender for Office 365**: Email security platform with Safe Links, Safe Attachments, and Threat Explorer for investigation\n- **URLScan.io**: Free URL analysis service capturing screenshots, DOM, cookies, and network requests\n- **Any.Run**: Interactive sandbox for detonating malicious files and URLs with real-time behavior analysis\n- **Proofpoint TAP**: Targeted Attack Protection dashboard showing clicked URLs and delivered threats per user\n- **PhishTool**: Dedicated phishing email analysis platform automating header parsing and IOC extraction\n\n## Common Scenarios\n\n- **Credential Phishing**: Fake O365 login page — check proxy for POST requests, force password resets for submitters\n- **Macro-Enabled Document**: Word doc with VBA macro — sandbox shows PowerShell download cradle, check endpoints for execution\n- **QR Code Phishing (Quishing)**: Email contains QR code linking to credential harvester — decode QR, submit URL to sandbox\n- **Thread Hijacking**: Attacker uses compromised mailbox to reply in existing threads — check for impossible travel or new inbox rules\n- **Voicemail Phishing**: Fake voicemail notification with HTML attachment — analyze attachment for redirect chains\n\n## Output Format\n\n```\nPHISHING INCIDENT REPORT — PHI-2024-0315\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nReported:     2024-03-15 09:12 UTC by jsmith (Finance)\nSender:       attacker@evil-domain[.]com (SPF: FAIL, DKIM: NONE, DMARC: FAIL)\nSubject:      Urgent: Password Reset Required\nPayload:      Credential harvesting URL\n\nIOCs:\n  URL:        hxxps:\u002F\u002Fevil-login[.]example[.]com\u002Foffice365\n  Domain:     evil-login[.]example[.]com (registered 2024-03-14, Namecheap)\n  IP:         185.234.xx.xx (VT: 12\u002F90 malicious)\n\nScope:\n  Recipients: 47 users across Finance and HR departments\n  Clicked:    5 users visited phishing URL\n  Submitted:  2 users entered credentials (confirmed via POST in proxy logs)\n\nContainment:\n  [DONE] 47 emails purged via Compliance Search\n  [DONE] Domain blocked on proxy and DNS sinkhole\n  [DONE] 2 user passwords reset, sessions revoked\n  [DONE] MFA enforced for both compromised accounts\n  [DONE] Inbox rules audited — no forwarding rules found\n\nStatus:       RESOLVED — No evidence of lateral movement post-compromise\n```\n",{"name":5,"tags":25,"author":33,"domain":34,"license":15,"version":35,"mitre_f3":36,"nist_csf":65,"subdomain":70,"description":71,"mitre_attack":72},[26,27,28,29,30,31,32],"soc","phishing","incident-response","email-security","splunk","defender","sandbox","mahipal","cybersecurity","1.0",{"tactics":37,"version":43,"techniques":44},[38,39,40,41,42],"reconnaissance","resource-development","initial-access","stealth","positioning","1.1",[45,49,52,55,59,62],{"id":46,"name":47,"source":48,"tactic":38},"T1598","Phishing for Information","attack",{"id":50,"name":51,"source":48,"tactic":40},"T1660","Phishing",{"id":53,"name":54,"source":48,"tactic":41},"T1672","Email Spoofing",{"id":56,"name":57,"source":58,"tactic":39},"F1020.002","Create Fake Materials: Fake Website","f3",{"id":60,"name":61,"source":48,"tactic":42},"T1539","Steal Web Session Cookie",{"id":63,"name":64,"source":58,"tactic":40},"F1006.002","Account Takeover: Exposed Login Credential",[66,67,68,69],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Investigates phishing email incidents from initial user report through header analysis, URL\u002Fattachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires full incident investigation to determine scope and impact.\n",[73,74,75,76,46],"T1078","T1685.002","T1685.005","T1566","main","8a3b3de73262a4c4db64523949360f3c599c2fb1","Anthropic-Cybersecurity-Skills-main\u002Fskills\u002Finvestigating-phishing-email-incident",0,"https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use","https:\u002F\u002Fgithub.com\u002FSaiVatsal","https:\u002F\u002Fsaivatsal.github.io\u002FPortfolio\u002F","The Longer It Takes The Stronger It Becomes ","2026-09-21 22:45:58",{"source":8,"skillName":5,"commands":87,"prompt":97,"zipAvailable":98},[88,91,94],{"tool":89,"command":90},"npx","npx skills add SaiVatsal\u002FSkills-I-Use --skill investigating-phishing-email-incident",{"tool":92,"command":93},"bunx","bunx skills add SaiVatsal\u002FSkills-I-Use --skill investigating-phishing-email-incident",{"tool":95,"command":96},"pnpm","pnpm dlx skills add SaiVatsal\u002FSkills-I-Use --skill investigating-phishing-email-incident","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Finvestigating-phishing-email-incident\u002FSKILL.md",true,[100,104,110],{"path":101,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md","REFERENCE","参考文档",2514,"https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Finvestigating-phishing-email-incident\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",7723,"https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Finvestigating-phishing-email-incident\u002Fscripts\u002Fagent.py",[117,125,133,142,149,156],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":121,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":20},"01M7DJZP6E6KMBQV4CZSDPZEZ8","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fwebapp-testing\u002FSKILL.md",[],[],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":129,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":20},"01M7DJZFTS5TS06K2TV3MDTE67","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fweb-artifacts-builder\u002FSKILL.md",[],[],{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":137,"licenseFileUrl":138,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":20},"01M7DJRK4SRQ908F2TJM6EZ7EV","ui-styling","Create beautiful, accessible user interfaces with shadcn\u002Fui components (built on Radix UI + Tailwind), Tailwind CSS utility-first styling, and canvas-based visual designs. Use when building user interfaces, implementing design systems, creating responsive layouts, adding accessible components (dialogs, dropdowns, forms, tables), customizing themes and colors, implementing dark mode, generating visual designs and posters, or establishing consistent styling patterns across applications.","MIT","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fui-styling\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fui-styling\u002FSKILL.md",[],[],{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":137,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":148,"publishedAt":20},"01M7DJR902059VEQP23PVM2WA0","design","Comprehensive design skill: brand identity, design tokens, UI styling, logo generation (55 styles, Gemini AI), corporate identity program (50 deliverables, CIP mockups), HTML presentations (Chart.js), banner design (22 styles, social\u002Fads\u002Fweb\u002Fprint), icon design (15 styles, SVG, Gemini 3.1 Pro), social photos (HTML→screenshot, multi-platform). Actions: design logo, create CIP, generate mockups, build slides, design banner, generate icon, create social photos, social media images, brand identity, design system. Platforms: Facebook, Twitter, LinkedIn, YouTube, Instagram, Pinterest, TikTok, Threads, Google Ads.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fdesign\u002FSKILL.md",[],[],{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":137,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":20},"01M7DJR56QF5N6XYTCPCFHFMNP","design-system","Token architecture, component specifications, and slide generation. Three-layer tokens (primitive→semantic→component), CSS variables, spacing\u002Ftypography scales, component specs, strategic slide creation. Use for design tokens, systematic design, brand-compliant presentations.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fdesign-system\u002FSKILL.md",[],[],{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":137,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":20},"01M7DJQXB6M0SFF7NX8J5N01AH","banner-design","Design banners for social media, ads, website heroes, creative assets, and print. Multiple art direction options with AI-generated visuals. Actions: design, create, generate banner. Platforms: Facebook, Twitter\u002FX, LinkedIn, YouTube, Instagram, Google Display, website hero, print. Styles: minimalist, gradient, bold typography, photo-based, illustrated, geometric, retro, glassmorphism, 3D, neon, duotone, editorial, collage. Uses ui-ux-pro-max, frontend-design, ai-artist, ai-multimodal skills.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fbanner-design\u002FSKILL.md",[],[]]