What problem does it solve?
When a user reports a suspicious email, SOC analysts need a repeatable process to determine whether it is malicious, how many users received it, who clicked or submitted credentials, and how to contain the threat across mailboxes, proxies, and endpoints.
Core Features & Use Cases
- Header and Authentication Analysis: Parse .eml files to extract Received chains, SPF, DKIM, and DMARC results, and detect display-name spoofing or Reply-To mismatches.
- URL and Attachment Detonation: Submit phishing URLs to URLScan.io and VirusTotal, hash attachments, and detonate files in sandboxes like Any.Run or Joe Sandbox to catch delayed or cloaked payloads.
- Scope and Impact Assessment: Use Splunk message trace queries and Microsoft Graph API to find all campaign recipients, then check proxy logs for clicks and credential-submission POSTs.
- Containment and Reporting: Purge emails via Compliance Search, block domains and hashes, force password resets with session revocation, and produce a structured incident report.
- Use Case: A finance employee reports an "Urgent: Password Reset Required" email. The skill walks through header validation, URL detonation revealing a credential harvester, a Splunk search finding 47 recipients, proxy analysis confirming 2 credential submissions, and full containment with purge and password resets.
Quick Start
Investigate the reported phishing email in the attached .eml file, determine the campaign scope and impacted users, and recommend containment actions.
