CySA+ Runbook 03 — Phishing Email Investigation and Response

Runbook Information

Item	Details
Runbook	03
Runbook Name	Phishing Email Investigation and Response
Track	CompTIA CySA+
Difficulty	Intermediate
Primary Role	SOC Analyst / Cybersecurity Analyst
Purpose	Investigate reported or detected phishing messages and determine organizational impact
Primary Systems	Email Security, SIEM, Endpoint Security, Identity Provider, DNS, Proxy, Threat Intelligence
Primary Data Sources	Email Headers, Message Metadata, Email Gateway Logs, URL Telemetry, Attachment Hashes, Endpoint Logs, Authentication Logs
Output	Benign / Spam / Phishing / Credential Phishing / Malware Delivery / BEC / Escalation
Related Labs	Lab 11, Lab 12, Lab 13, Lab 16, Lab 17, Lab 20

Operational Principle: Never judge a suspicious email solely by appearance. Validate the sender, infrastructure, authentication results, URLs, attachments, delivery scope, user interaction, and related security telemetry.

1. Purpose

This runbook provides a repeatable process for investigating suspicious email.

The analyst must determine:

What was received?
      ↓
Who actually sent it?
      ↓
Was the sender spoofed?
      ↓
Did email authentication pass?
      ↓
What links or attachments exist?
      ↓
Are the indicators malicious?
      ↓
Who received the message?
      ↓
Did anyone interact with it?
      ↓
Did credentials or systems become compromised?
      ↓
What must be contained?

2. When to Use This Runbook

Use this runbook when:

a user reports suspicious email
an email-security platform creates a phishing alert
a suspicious URL is detected in email
a malicious attachment is detected
display-name impersonation is reported
executive impersonation is suspected
credential phishing is suspected
business email compromise is suspected
an email is associated with suspicious authentication
an email may have delivered malware
an IOC hunt identifies a suspicious message campaign

3. Expected Outcomes

Every phishing investigation should reach a clear disposition.

Suspicious Email
      ↓
Investigation
      ↓
├── Benign
│
├── Spam
│
├── Suspicious
│
├── Phishing
│
├── Credential Phishing
│
├── Malware Delivery
│
├── Business Email Compromise
│
└── Inconclusive — Continue Investigation

4. Phishing Investigation Workflow

Use:

Email Alert / User Report
        ↓
Preserve Message
        ↓
Review Message Content
        ↓
Analyze Sender
        ↓
Analyze Headers
        ↓
Review SPF / DKIM / DMARC
        ↓
Analyze URLs
        ↓
Analyze Attachments
        ↓
Extract IOCs
        ↓
Threat Intelligence
        ↓
Determine Delivery Scope
        ↓
Determine User Interaction
        ↓
Correlate Endpoint Activity
        ↓
Correlate Authentication
        ↓
Determine Impact
        ↓
Contain
        ↓
Escalate
        ↓
Document

5. Step 1 — Record the Initial Alert

Capture:

Case ID:

Alert ID:

Alert Name:

Detection Source:

Detection Time:

Sender:

Recipient:

Subject:

Message-ID:

Attachment:

URL:

Original Severity:

If the report came from a user, record:

Reporter:

Reported Time:

Interaction Reported:
Yes / No / Unknown

6. Step 2 — Preserve the Original Message

Where possible, preserve the full message as:

.eml

or:

.msg

Do not rely only on a forwarded copy or screenshot.

Preserve:

Headers
Body
URLs
Attachments
Message-ID
Delivery Metadata

7. Step 3 — Calculate an Evidence Hash

If the message has been exported as a file, calculate SHA-256.

sha256sum suspicious-email.eml

Record:

Email SHA-256:

Collection Time:

Evidence Location:

8. Step 4 — Perform Initial Visual Triage

Review without clicking links or opening attachments.

Check:

Display Name

From Address

Recipient

Subject

Urgency

Branding

Language

Grammar

Requested Action

Links

Attachments

Reply Instructions

Look for social-engineering themes such as:

Account suspension

Password expiry

Invoice

Payment

MFA request

Shared document

Payroll

Voicemail

Security alert

Executive request

Urgent transfer

9. Step 5 — Identify the Claimed Sender

Record:

Display Name:

Visible From Address:

Claimed Organization:

Claimed Role:

Ask:

Does the display name match the sender address?

Does the domain belong to the claimed organization?

Is the sender expected to contact the recipient?

Is the role believable?

10. Step 6 — Investigate Display-Name Impersonation

Example:

Display Name:
Chief Executive Officer

Actual Address:
external-account@example.invalid

The display name may be trusted-looking while the address is unrelated.

Classify:

Display Name Match:
Expected / Suspicious / Impersonated

11. Step 7 — Review the From Header

Locate:

From:

Record:

Mailbox:

Domain:

Investigate the domain carefully.

Look for:

Misspelling

Extra words

Hyphens

Unexpected TLD

Lookalike characters

Unrelated domain

12. Step 8 — Review Return-Path

Locate:

Return-Path:

Compare:

From
vs
Return-Path

A mismatch is not automatically malicious.

Legitimate mail platforms often use separate envelope-sender domains.

Record whether the relationship is expected.

13. Step 9 — Review Reply-To

Locate:

Reply-To:

A suspicious pattern may be:

From:
ceo@trusted.example

Reply-To:
external-mailbox@example.invalid

This can be especially important in BEC investigations.

14. Step 10 — Build the Sender Identity Table

Create:

Field	Value	Assessment
Display Name	`<value>`	Expected / Suspicious
From	`<value>`	Expected / Suspicious
Return-Path	`<value>`	Expected / Suspicious
Reply-To	`<value>`	Expected / Suspicious

15. Step 11 — Analyze Received Headers

Review:

Received:

headers.

Work from the earliest trustworthy infrastructure toward the recipient.

Document:

Sending Host:

Sending IP:

Mail Relay:

Gateway:

Timestamps:

Do not blindly trust sender-supplied header values.

16. Step 12 — Reconstruct the Delivery Path

Build:

Sending Infrastructure
        ↓
Intermediate Relay
        ↓
Email Security Gateway
        ↓
Recipient Mail Environment

Record any suspicious IPs or hostnames for later enrichment.

17. Step 13 — Review Authentication-Results

Locate:

Authentication-Results:

Record:

SPF:

DKIM:

DMARC:

Possible values may include:

pass

fail

softfail

neutral

none

temperror

permerror

18. Step 14 — Interpret SPF

SPF helps determine whether the sending infrastructure was authorized for the evaluated domain.

Ask:

Did SPF pass?

Which domain was evaluated?

Which IP was evaluated?

Remember:

SPF Pass
≠
Message Is Safe

An attacker can configure SPF correctly for a malicious domain.

19. Step 15 — Interpret DKIM

Review:

DKIM-Signature:

and authentication results.

Record:

Signing Domain:

Selector:

Result:

DKIM helps validate signed message content and domain identity.

20. Step 16 — Interpret DMARC

DMARC evaluates domain alignment involving the visible From domain.

Record:

DMARC Result:

Policy:

Aligned Domain:

A DMARC failure may significantly increase concern when the message claims to come from a protected organization.

21. Step 17 — Analyze SPF, DKIM and DMARC Together

Create:

Control	Result	Assessment
SPF	Pass / Fail	`<notes>`
DKIM	Pass / Fail	`<notes>`
DMARC	Pass / Fail	`<notes>`

Do not make a phishing verdict from one control alone.

22. Step 18 — Review the Message Body

Look for:

Urgency

Authority

Fear

Financial Request

Credential Request

MFA Request

Unusual Instructions

Security Warning

Link-Based Action

Attachment-Based Action

Document the requested action.

23. Step 19 — Identify All URLs

Do not click links.

Extract them from:

Plain Text

HTML

Buttons

Images

Attachments where safely parsed

Record:

Displayed Text:

Actual URL:

Domain:

Path:

Parameters:

24. Step 20 — Compare Displayed and Actual URLs

Example:

Displayed:
https://trusted.example/login

Actual:
hxxps://unrelated[.]example/login

This mismatch is a strong phishing indicator.

25. Step 21 — Analyze Domain Structure

For each URL, identify:

Scheme

Subdomain

Registered Domain

Top-Level Domain

Path

Query

Be careful with URLs such as:

trusted.example.attacker.invalid

The controlling domain is:

attacker.invalid

not:

trusted.example

26. Step 22 — Identify Lookalike Domains

Look for:

Character Substitution

Typosquatting

Added Security Words

Added Login Words

Unexpected TLD

Brand Name Inside Unrelated Domain

Record:

Lookalike:
Yes / No / Unknown

27. Step 23 — Analyze URL Encoding

Look for:

%2F

%3A

%40

Encoded Query Parameters

URL Shorteners

Redirect Parameters

Decode text safely using approved analysis tools.

Do not navigate to the decoded destination.

28. Step 24 — Investigate Redirects

Determine whether the URL contains or leads through:

redirect=

url=

next=

continue=

target=

Record:

Initial URL:

Intermediate URL:

Final Destination:

Use safe intelligence or sandbox data where authorized.

29. Step 25 — Enrich URL and Domain Indicators

For suspicious URLs/domains, investigate:

Reputation

First Seen

Last Seen

Hosting

Registration Age

Associated Malware

Phishing Reports

Related Domains

Related IPs

Assign confidence.

30. Step 26 — Review Domain Registration Context

Where appropriate, record:

Registrar:

Creation Date:

Expiration Date:

Name Servers:

Registration Status:

Do not treat privacy-protected registration as malicious by itself.

31. Step 27 — Review DNS Context

Investigate:

A

AAAA

MX

NS

TXT

CNAME

where relevant.

Look for relationships between phishing infrastructure and other known indicators.

32. Step 28 — Identify Attachments

Record:

Filename:

Displayed Extension:

Actual File Type:

Size:

MIME Type:

Do not open suspicious attachments directly.

33. Step 29 — Verify the Actual File Type

Use appropriate static-analysis methods.

For example:

file suspicious-attachment

Compare:

Filename
vs
Actual File Type

A mismatch may be important.

34. Step 30 — Calculate Attachment Hashes

Calculate:

SHA-256

and optionally:

MD5

SHA-1

Example:

sha256sum suspicious-attachment

Record the hash.

35. Step 31 — Perform Static Attachment Triage

Depending on file type, review safely:

Metadata

Strings

Embedded URLs

Macros

Document Structure

Archive Contents

Executable Metadata

Do not execute the file.

36. Step 32 — Enrich the Attachment Hash

Search approved malware-reputation sources.

Record:

Known / Unknown:

Classification:

Detection Count:

Malware Family:

First Seen:

Related Infrastructure:

Confidence:

37. Step 33 — Build the IOC Inventory

Create:

Type	Indicator	Source	Confidence
Sender	`<email>`	Header	Medium
IP	`<IP>`	Received	Medium
Domain	`<domain>`	URL	High
URL	`<URL>`	Message	High
Hash	`<SHA-256>`	Attachment	High

Defang malicious indicators in documentation.

38. Step 34 — Determine Delivery Scope

Search the email environment for:

Message-ID

Sender

Subject

URL

Domain

Attachment Hash

Attachment Filename

Determine:

How many recipients?

Which mailboxes?

Was the message delivered?

Was it quarantined?

Was it blocked?

39. Step 35 — Build the Recipient List

Create:

Recipient	Delivered	Quarantined	User Interaction	Status
user01	Yes	No	Unknown	Investigate
user02	Yes	No	No	Monitor
user03	No	Yes	N/A	Protected

40. Step 36 — Search for Campaign Variants

Attackers may vary:

Subject

Sender

Attachment Name

URL Path

Display Name

while reusing infrastructure.

Search related:

Domains

IPs

Hashes

Message Patterns

to determine campaign scope.

41. Step 37 — Determine User Interaction

Ask:

Did the user open the email?

Click the URL?

Download the attachment?

Open the attachment?

Enable macros?

Enter credentials?

Approve MFA?

Reply?

Send payment?

Do not rely solely on user memory.

Correlate technical evidence.

42. Step 38 — Investigate DNS Evidence

Search the recipient endpoint for:

Phishing Domain

in DNS telemetry.

A sequence:

Email Delivered
      ↓
DNS Query

may indicate interaction.

But DNS resolution alone does not prove credentials were submitted.

43. Step 39 — Investigate Web/Proxy Evidence

Search:

URL

Domain

Destination IP

Recipient Endpoint

in:

Proxy

Web Gateway

Zeek

Browser Telemetry

Firewall

Record:

Timestamp

Source Host

User

Destination

Status

Bytes

44. Step 40 — Investigate Endpoint Evidence

If an attachment was involved, review:

File Creation

Process Execution

Parent Process

Child Processes

PowerShell

Security Alerts

Network Connections

Example:

Email Client
     ↓
Office Application
     ↓
PowerShell

may require immediate escalation.

45. Step 41 — Investigate Attachment Execution

Determine:

Was the attachment saved?

Was it opened?

Was execution observed?

Was it blocked?

Was a child process created?

Classify:

Not Executed

Execution Attempted

Blocked

Executed

Unknown

46. Step 42 — Correlate Authentication Activity

If credential phishing is suspected, search the recipient’s identity.

Look for:

Failed Authentication

Successful Authentication

New Source IP

New Device

New Location

MFA Prompts

New MFA Registration

Privileged Activity

Pay special attention to events shortly after email interaction.

47. Step 43 — Build the Credential-Phishing Timeline

Example:

10:01 — Phishing email delivered

10:05 — Endpoint resolves phishing domain

10:06 — Web connection established

10:12 — User account login from new source

10:13 — MFA approved

10:18 — Internal application accessed

This sequence substantially increases the likelihood of account compromise.

48. Step 44 — Investigate MFA Events

If the user reports entering credentials, review:

MFA Denials

MFA Approvals

Repeated Prompts

New Device Registration

New Authentication Method

Credential phishing may lead to subsequent MFA manipulation.

49. Step 45 — Investigate Mailbox Activity

For suspected mailbox compromise, review where available:

Mailbox Logins

Inbox Rules

Forwarding Rules

Deleted Messages

Sent Messages

OAuth/Application Grants

Delegates

Unexpected forwarding rules may indicate persistence or data collection.

50. Step 46 — Investigate Business Email Compromise

BEC may involve:

Executive Impersonation

Vendor Impersonation

Payment Instructions

Invoice Fraud

Bank Account Change

Payroll Change

Gift Card Request

The message may contain no malicious attachment or URL.

Focus on:

Sender Identity

Reply-To

Conversation Context

Recipient Actions

Financial Impact

Mailbox Compromise

51. Step 47 — Investigate Conversation Hijacking

Attackers may insert themselves into legitimate email threads.

Look for:

Reply-To Changes

Unexpected Sender Domain

Conversation History

Mailbox Access

Unusual Sending Infrastructure

Do not assume a familiar conversation means the message is legitimate.

52. Step 48 — Determine Whether the Sender Account Is Compromised

If the message came from a legitimate partner domain, consider:

Compromised External Account

Compromised Internal Mailbox

Spoofing

Lookalike Domain

Email-authentication success does not rule out a compromised legitimate account.

53. Step 49 — Determine Email Classification

Use:

Benign

Legitimate message.

Spam

Unwanted but not malicious.

Suspicious

Insufficient evidence for phishing classification.

Phishing

Deceptive message attempting to manipulate the user.

Credential Phishing

Designed to capture authentication information.

Malware Delivery

Delivered malicious or suspicious executable content.

Business Email Compromise

Identity or mailbox deception intended to enable fraud or unauthorized business action.

54. Step 50 — Determine Compromise Status

Use:

No User Interaction

Interaction — No Compromise Identified

Possible Credential Exposure

Confirmed Account Compromise

Possible Malware Execution

Confirmed Endpoint Compromise

Unknown

55. Step 51 — Determine Scope

Classify:

Recipients Targeted

Recipients Delivered

Recipients Clicked

Recipients Submitted Credentials

Endpoints Executed Attachment

Accounts Compromised

Systems Compromised

56. Step 52 — Assess Confidentiality Impact

Ask:

Were credentials exposed?

Was mailbox content accessed?

Was sensitive information sent?

Was data downloaded?

Was a compromised mailbox used to collect information?

57. Step 53 — Assess Integrity Impact

Ask:

Were inbox rules created?

Were payment instructions modified?

Were messages sent from the account?

Were files changed?

Was malware installed?

58. Step 54 — Assess Availability Impact

Ask:

Was an account disabled?

Was email service disrupted?

Was an endpoint isolated?

Was business communication affected?

59. Step 55 — Assign Severity

Low

Phishing blocked before delivery

No interaction

No compromise

Medium

Message delivered

Suspicious interaction

No confirmed compromise

High

Credential compromise

Malware execution

Mailbox compromise

Multiple recipients impacted

Critical

Privileged account compromise

Widespread campaign

Major financial fraud

Sensitive-data exposure

Enterprise-wide malware impact

60. Step 56 — Contain Malicious Messages

Where authorized:

Quarantine Message

Remove Message from Mailboxes

Block Sender

Block Domain

Block URL

Block Attachment Hash

Validate shared infrastructure risk before blocking broad indicators.

61. Step 57 — Contain Compromised Identities

For credential compromise:

Disable or Secure Account

Reset Password

Revoke Sessions

Invalidate Tokens

Reset MFA

Remove Unauthorized MFA Methods

Review Mailbox Rules

Review OAuth Grants

62. Step 58 — Contain Affected Endpoints

If malware execution is suspected:

Isolate Endpoint

Preserve Evidence

Quarantine File

Block Hash

Search Environment for Hash

Investigate Persistence

Search Related Network Indicators

63. Step 59 — Search the Enterprise for IOCs

Hunt:

Sender

Domain

URL

IP

SHA-256

Filename

Subject

Message-ID

across all available telemetry.

64. Step 60 — Escalation Criteria

Escalate when:

Credentials were entered

Account compromise confirmed

MFA compromise suspected

Attachment executed

Malware detected

Privileged user affected

Multiple users interacted

Sensitive information exposed

Financial fraud suspected

Mailbox rules or forwarding changed

Campaign scope expanding

65. Phishing Escalation Template

Use:

Case ID:

Classification:

Severity:

Sender:

Subject:

Recipients:

Delivered Count:

User Interaction:

URL:

Attachment:

SHA-256:

SPF:

DKIM:

DMARC:

Threat Intelligence:

Credential Exposure:
Yes / No / Unknown

Endpoint Execution:
Yes / No / Unknown

Account Compromise:
Confirmed / Suspected / Not Observed

Affected Users:

Affected Endpoints:

Containment Performed:

Outstanding Questions:

Recommended Action:

Escalated To:

66. Example Credential-Phishing Escalation

Case:
PHISH-2026-019

Classification:
Credential Phishing

Severity:
High

Recipients:
12

Delivered:
8

User Interaction:
2 users accessed the phishing URL.

Credential Exposure:
One user reported entering credentials.

Identity Evidence:
Suspicious authentication from a previously unseen
external source occurred shortly afterward.

MFA:
An unexpected MFA approval was recorded.

Assessment:
Evidence supports compromise of user01.

Containment:
Message removed from remaining mailboxes.
Phishing domain blocked.
user01 sessions revoked and credentials reset.

Escalation:
Identity and Incident Response teams notified.

67. Example Malware-Delivery Escalation

Classification:
Malware Delivery

Attachment:
Invoice.pdf.exe

SHA-256:
<hash>

Email:
Delivered to four recipients.

Interaction:
One user opened the attachment.

Endpoint:
Process execution confirmed.

EDR:
Malware detection triggered after execution.

Network:
Endpoint contacted suspicious external infrastructure.

Severity:
High

Response:
Isolate endpoint, preserve evidence, block hash,
remove messages, hunt IOCs, and escalate to IR.

68. Example Benign Email Closure

Classification:
Benign

Investigation:
Sender domain belongs to an approved business partner.

SPF:
Pass

DKIM:
Pass

DMARC:
Pass

URL:
Matches known partner infrastructure.

Attachment:
Expected business PDF.

Threat Intelligence:
No suspicious indicators identified.

User Context:
Recipient confirmed expected communication.

Disposition:
Close as benign.

69. Analyst Action Log

Record:

Time	Action	Result
11:02	Opened alert	Suspicious sender identified
11:06	Reviewed headers	DMARC failed
11:10	Extracted URL	Lookalike domain found
11:15	Searched mailboxes	14 recipients identified
11:21	Checked proxy logs	2 users clicked
11:28	Checked authentication	1 suspicious login found
11:35	Escalated	IR and Identity notified

70. Common Analyst Mistakes

Avoid:

Clicking suspicious links

Opening attachments directly

Trusting display names

Looking only at SPF

Assuming SPF/DKIM/DMARC pass means benign

Ignoring Reply-To

Ignoring delivery scope

Ignoring users who clicked

Ignoring authentication after phishing

Ignoring endpoint execution

Uploading confidential files to public services

Blocking shared infrastructure without validation

Closing after removing the email

Failing to revoke compromised sessions

Treating all recipients as compromised

Failing to hunt for campaign variants

71. Rapid Phishing Triage Checklist

□ Original email preserved

□ Sender reviewed

□ Display name reviewed

□ From reviewed

□ Return-Path reviewed

□ Reply-To reviewed

□ Received chain reviewed

□ SPF checked

□ DKIM checked

□ DMARC checked

□ URLs extracted

□ URLs analyzed safely

□ Lookalike domains checked

□ Attachments identified

□ File types verified

□ SHA-256 calculated

□ Threat intelligence checked

□ IOC inventory created

□ Delivery scope determined

□ Recipient list created

□ User interaction checked

□ DNS/proxy evidence reviewed

□ Endpoint activity reviewed

□ Authentication activity reviewed

□ MFA activity reviewed

□ Compromise status assigned

□ Severity assigned

□ Messages contained where authorized

□ Identity containment considered

□ Endpoint containment considered

□ Enterprise IOC hunt completed

□ Escalation decision made

□ Case documented

72. Investigation Documentation Template

# Phishing Email Investigation

## Case Information

Case ID:

Analyst:

Date:

## Email Summary

Sender:

Recipient:

Subject:

Message-ID:

Delivery Time:

## Sender Analysis

Display Name:

From:

Return-Path:

Reply-To:

Assessment:

## Received Headers

Document the delivery path.

## Email Authentication

### SPF

Result:

### DKIM

Result:

### DMARC

Result:

## Message Content

Document:
- social engineering theme
- requested action
- urgency
- impersonation

## URL Analysis

### URL 1

Displayed Text:

Actual URL:

Domain:

Redirects:

Reputation:

### URL 2

Document if applicable.

## Attachment Analysis

Filename:

Actual File Type:

Size:

SHA-256:

Reputation:

Static Findings:

## IOC Inventory

Document:
- sender
- IP
- domain
- URL
- hash
- filename

## Threat Intelligence

Document findings and confidence.

## Delivery Scope

Targeted:

Delivered:

Quarantined:

## Recipient Interaction

Document:
- clicked
- downloaded
- opened
- credentials entered
- MFA approved

## Endpoint Correlation

Document process/file/network evidence.

## Authentication Correlation

Document:
- new source
- successful login
- MFA events
- account changes

## Mailbox Investigation

Document:
- forwarding
- rules
- sent messages
- OAuth grants

## Classification

Benign / Spam / Suspicious / Phishing / Credential Phishing / Malware Delivery / BEC

## Compromise Status

No Interaction / Possible Exposure / Confirmed Identity Compromise / Confirmed Endpoint Compromise / Unknown

## Scope

Document affected:
- users
- accounts
- endpoints
- mailboxes

## Impact

### Confidentiality

### Integrity

### Availability

## Severity

Low / Medium / High / Critical

## Containment

Document actions performed or recommended.

## Escalation

Escalated:
Yes / No

Escalated To:

## Outstanding Questions

Document investigation gaps.

## Final Analyst Assessment

Summarize findings.

## Disposition

Close / Monitor / Continue Investigation / Escalate

73. Runbook Validation Checklist

Evidence

Original email preserved
Message metadata documented
Evidence hash calculated where applicable
Attachments preserved safely

Sender

Display name reviewed
From analyzed
Return-Path analyzed
Reply-To analyzed
Sending infrastructure reviewed
Received chain reconstructed

Authentication

SPF reviewed
DKIM reviewed
DMARC reviewed
Results evaluated together

URL

All URLs extracted
Displayed and actual destinations compared
Domain structure analyzed
Lookalike domains checked
Encoding reviewed
Redirects reviewed
Reputation checked

Attachments

Attachment identified
Actual file type verified
Hash calculated
Static triage performed
Reputation checked
Execution status investigated

Scope

Delivery scope determined
Campaign variants searched
Recipient list created
User interaction investigated

Correlation

DNS activity reviewed
Proxy/web telemetry reviewed
Endpoint telemetry reviewed
Authentication telemetry reviewed
MFA telemetry reviewed
Mailbox activity reviewed where relevant

Impact

Credential exposure assessed
Endpoint compromise assessed
Mailbox compromise assessed
Financial/BEC impact assessed
Confidentiality assessed
Integrity assessed
Availability assessed

Response

Classification assigned
Severity assigned
Malicious messages contained
Malicious indicators considered for blocking
Identity containment considered
Endpoint containment considered
Enterprise IOC hunt performed
Escalation criteria evaluated

Documentation

IOC inventory created
Timeline created
Analyst actions documented
Outstanding questions documented
Final disposition documented

74. Runbook Summary

A phishing investigation should not stop at:

"This email looks suspicious."

The analyst must build evidence across:

Email
  ↓
Sender Identity
  ↓
Authentication
  ↓
URLs / Attachments
  ↓
Threat Intelligence
  ↓
Delivery Scope
  ↓
User Interaction
  ↓
Endpoint Activity
  ↓
Authentication Activity
  ↓
Impact
  ↓
Containment

The key operational lesson is:

The most important question in phishing response is not only whether the email is malicious, but whether anyone interacted with it and whether that interaction led to identity or endpoint compromise.

What’s Next?

CySA+ Runbook 04 — Malware and Endpoint Compromise Investigation

The next runbook focuses on suspicious files, process execution, endpoint alerts, and potential malware compromise.

You will build a repeatable procedure for investigating:

malware alerts
suspicious file hashes
suspicious process execution
parent-child process relationships
PowerShell activity
file creation
persistence
registry changes
scheduled tasks
services
endpoint network activity
DNS
suspicious external infrastructure
IOC enrichment
enterprise hash hunting
affected-host scope
containment
escalation

The workflow progresses from:

Malware Alert
      ↓
File / Process Validation
      ↓
Execution Analysis
      ↓
Persistence
      ↓
Network Activity
      ↓
IOC Enrichment
      ↓
Scope
      ↓
Compromise Assessment
      ↓
Containment
      ↓
Escalation

➡️ Next: CySA+ Runbook 04 — Malware and Endpoint Compromise Investigation