Phishing Triage: Headers, Links and Safe Evidence Handling

Technique & Investigation of the Day · Educational, defensive guidance for authorized environments.

Why it matters

A convincing email can be fraudulent even when it passes authentication, while a legitimate forwarded message can fail an authentication check. Investigate the message, delivery path and recipient interaction together. The goal is a defensible disposition without exposing an analyst or sharing private message content.

Phishing evidence triage: investigation path. Preserve safely; Interpret authentication; Original message preserved through an approved export, including headers and attachments handled safely.; Validate the requested action; Escalate; assess containment impact; Document and improve — Original conceptual investigation workflow. No real customer data is shown.

Required telemetry and evidence

Original message preserved through an approved export, including headers and attachments handled safely.
Gateway verdicts, message identifiers and available delivery or quarantine records.
Authorized link-click and endpoint evidence, with timestamps and coverage limits.
Trusted business context and confirmation through known contact channels.

Before drawing conclusions, record collection scope, retention and any missing fields. Keep sensitive evidence in approved internal systems.

Step-by-step investigation

1. Preserve safely

Use the organization’s approved evidence workflow. Do not open attachments or follow message links on an ordinary workstation. Keep the original message and note who collected it and when.

2. Inspect the message identity

Compare visible sender, reply address and authenticated domain context. Review headers added by trusted receiving infrastructure; attacker-supplied header text is not equally authoritative.

3. Interpret authentication

Treat SPF, DKIM and DMARC results as evidence about the evaluated identities and alignment, not a verdict on business intent. Compromised legitimate accounts can send authenticated malicious messages.

4. Establish delivery and interaction

Use message IDs and trace evidence to identify recipients and outcomes. Distinguish delivery, a recorded click and confirmed credential entry; a click record alone does not prove the latter.

5. Validate the requested action

Confirm unusual payment, credential or document requests through a known channel. Compare the message with the real workflow. Urgency or branding can influence suspicion but should not replace evidence.

6. Document and improve

Record disposition, recipient scope, response and remaining uncertainty. Turn confirmed patterns into reviewed mail-control improvements and user guidance without exposing the message’s private content.

Phishing evidence triage: evidence checklist. Original message preserved through an approved export, including headers and attachments handled safely.; Gateway verdicts, message identifiers and available delivery or quarantine records.; Authorized link-click and endpoint evidence, with timestamps and coverage limits.; Trusted business context and confirmation through known contact channels. — Original conceptual evidence checklist. No real customer data is shown.

Read-only investigation pseudocode

INPUT authorized message metadata and trace export
MATCH stable message identifiers across evidence sources
REVIEW trusted authentication results and requested action
SEPARATE delivery, click and confirmed follow-on activity
DOCUMENT disposition and affected scope

Test and adapt: this is illustrative pseudocode, not executable vendor syntax or a tested production detector. Validate field semantics, time boundaries and results in an authorized environment. It does not change systems.

Legitimate activity versus suspicious activity

Mailing lists, forwarding and third-party senders can complicate authentication and sender presentation. A passing result is not proof of a legitimate request. An isolated failed result is not enough to confirm phishing.

Tuning and false positives

Tune with validated message clusters, trusted sender configuration and observed business workflows. Avoid a blanket domain allowlist or a rule based solely on a logo, display name or urgency word.

Escalation, containment and documentation

Escalate suspected recipient compromise to the incident team. Message removal, account actions and notifications must follow approved procedures. Keep confidential attachments and addresses out of public analysis services unless explicitly authorized.

Close with an evidence-based disposition: explained activity, supported escalation or unresolved visibility gap. Include identifiers, times, source coverage, competing explanations and the response owner.

MITRE ATT&CK context

Phishing (T1566) is relevant when evidence supports an adversarial message. Choose a sub-technique only when the delivery mechanism is established.

Key takeaways

Preserve safely: define the question before broadening the search.
Validate the requested action: corroborate the explanation with independent evidence.
Keep the observed facts, assumptions and response decisions separate.

References

Microsoft: message authentication and spam headers

Original educational workflow and conceptual diagrams for Hack Invasion. Public documentation informs source-specific details; investigation decisions require local validation.