Purpose
This SOP gives SOC analysts one repeatable way to work a reported or detected phishing email — from the first look to the write-up. Follow it and every phishing case gets the same coverage, the same evidence, and a documented verdict, no matter who catches it.
Scope
Covers any suspicious email reported by a user or flagged by tooling across the environments we monitor — Microsoft 365 / Exchange Online mailboxes in particular. It runs from initial triage through analysis, containment, and closure.
Out of scope: full incident response for a confirmed breach (hand off to the IR process once compromise is confirmed), and general spam that carries no malicious intent (dispositioned and closed at triage).
Roles & responsibilities
| Role | Responsibility |
|---|---|
| Tier 1 Analyst | Triage, initial analysis, IOC collection, and documentation. Owns the case unless it escalates. |
| Tier 2 / IR | Deep analysis, containment, and any host or account remediation when compromise is suspected. |
| SOC Lead | Approves tenant-wide purges and blocks, handles stakeholder and management communication, signs off on closure for high/critical cases. |
| Affected user | Provides context (did they click, enter credentials, open the attachment) and follows remediation steps. |
Severity & prioritization
Set a preliminary severity at triage and confirm it at closure. Use the highest level that matches.
| Level | Looks like | Target response |
|---|---|---|
| Critical | Credentials entered, malware executed, or a widespread / targeted campaign against the org. | Immediate |
| High | User clicked the link or opened the attachment, but no credentials or execution confirmed; or a clearly targeted lure. | ≤ 1 hour |
| Medium | Malicious email delivered but no interaction yet; still present in mailboxes. | ≤ 4 hours |
| Low | Blocked at the gateway, or benign / commodity spam with no malicious intent. | Same day |
Procedure
Work the phases in order. Earlier phases can raise the severity and change how fast you move through the rest. Record findings as you go — don't save documentation for the end.
Initial triage
Quickly assess and prioritize.
- Acknowledge the alert or report within SLA and open a ticket.
- Capture the basics in UTC: reporter, affected mailbox(es), received time, subject, and sender.
- Run a message trace to see whether the email was delivered, opened, clicked, or replied to, and how many recipients got it.
- Set a preliminary severity from the guide above.
Tools: M365 message trace · Alert Triage checklist
Exit criteria: ticket opened, scope (recipient count) known, preliminary severity set.
Header & sender examination
Identify the true origin and check authenticity.
- Pull the raw headers and run them through a header analyzer to map the delivery path.
- Review the Received hops for the originating IP, and check SPF / DKIM / DMARC results.
- Compare
From,Return-Path, andReply-Tofor mismatches; look for display-name spoofing. - Check the sending domain for look-alikes (homoglyphs, typosquats) and pull reputation on the sending IP and domain.
Tools: Message Header Analyzer / MHA · AbuseIPDB · Homoglyph Detector · dnstwister
Exit criteria: true origin identified, auth results recorded, spoofing assessed.
Content examination
Analyze the message and spot social engineering.
- Read the body for the classic lures: urgency, authority, fear, or reward.
- Note brand impersonation, generic greetings, grammar and formatting anomalies, and any request for credentials, payment, MFA approval, or gift cards.
- Hover (don't click) every link and compare the display text to the real target.
- Classify the theme — credential harvest, invoice / BEC, malware delivery, etc.
Exit criteria: social-engineering indicators documented, lure theme identified.
Web & URL examination
Collect web artifacts and inspect URLs and domains.
- Extract every URL from the body, then expand any shorteners without clicking them.
- Scan / detonate the links in a sandbox — capture the screenshot, redirect chain, requests, and final landing page.
- Check domain age, registration, and reputation.
- Record all web IOCs: domains, IPs, full URLs.
Tools: URL Extractor · Unshorten.It · urlscan.io · ANY.RUN · VirusTotal
Exit criteria: landing page and redirects captured, URL/domain IOCs recorded.
Attachment examination
Securely extract and analyze attachments.
- Never open an attachment on a production host. Work in an isolated / sandbox environment only.
- Hash the file (SHA256) and check reputation before anything else.
- Detonate in a sandbox; note the file type, macros, embedded objects, and any network / C2 behavior.
- Record file IOCs: hashes, dropped files, contacted domains and IPs.
Tools: VirusTotal · ANY.RUN
Exit criteria: attachment dispositioned, file IOCs recorded.
Contextual examination
Consider the broader context and assess scope.
- Search the mail environment for the same sender, subject, or URL across all mailboxes — the reported copy is rarely the only one.
- Check whether any user clicked or entered credentials (URL click reports, sign-in logs).
- Correlate with recent campaigns or open incidents, and check threat intel for a known campaign or actor.
- Assess the real blast radius and adjust severity if it grew.
Tools: M365 message trace / content search · Entra sign-in logs · PowerShell M365 checks
Exit criteria: full scope known, any impacted users identified, severity confirmed.
Defense measures
Take action, then harden — and keep people informed.
Reactive (if there was interaction or compromise)
- Reset the password and revoke active sessions for any user who entered credentials; review their mailbox for new inbox rules / forwarding.
- Purge the email tenant-wide (soft or hard delete) once the SOC Lead approves.
- Block the sender, domain, URL, and IP at the mail gateway and the proxy / firewall.
- Isolate the host if an attachment executed, and hand off to IR.
Proactive
- Add all IOCs to blocklists and detections; tune or create rules from what you learned.
- Report the sender / sample to the mail vendor.
Communicate
- Notify affected users with clear next steps; brief the SOC Lead and stakeholders on anything high or critical.
Tools: PowerShell M365 / Entra (inbox rules, forwarding, revoke sessions) · Windows Event IDs
Exit criteria: threat contained, IOCs blocked, affected users notified.
Documentation & reporting
Keep records, set the verdict, and close it out.
- Record the verdict (malicious / spam / benign), the findings, every action taken, and all IOCs — use the write-up template so nothing is missed.
- Attach the artifacts: raw headers, screenshots, sandbox reports, message-trace results.
- Confirm final severity; get peer review or SOC Lead sign-off where required.
- Close the alert and ticket, and feed anything reusable (a new detection, a lesson learned) back to the team.
Tools: Alert Triage & write-up template
Exit criteria: ticket documented with verdict and IOCs, artifacts attached, case closed.
Escalation
Escalate to Tier 2 / IR and notify the SOC Lead immediately when any of these are true:
- A user entered credentials, or an attachment executed on an endpoint.
- The campaign is targeted (spear-phishing, BEC against finance / executives) or widespread across the org.
- Malware, C2, or lateral movement is confirmed — this becomes an incident and moves to the IR process.
- A tenant-wide purge, account disable, or host isolation is needed (SOC Lead approves).
References & tools
- Alert Triage checklist — the fill-in triage & write-up template.
- PowerShell SOC sheet — the Microsoft 365 / Entra ID checks (inbox rules, forwarding, OAuth grants, sign-ins, session revocation).
- Windows Event IDs — for any endpoint follow-up.
- Analyst tools — header analyzer, urlscan, VirusTotal, AbuseIPDB, homoglyph detector, dnstwister, ANY.RUN.
Aligns with the phishing analysis methodology: triage → header/sender → content → web/URL → attachment → context → defense → documentation.
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | 2026-09-16 | Mike Parks | Initial release. |