Day 31 & 32 of SOC Training

Introduction

Phishing remains the single most common way attackers gain initial access into an organization — it’s simply easier to trick a person than to break through a well-configured firewall. Because of this, phishing analysis is considered a fundamental, must-have skill for every Blue Teamer, and it’s often one of the very first real investigations a new SOC L1 analyst is handed.

1. Why Email Headers Matter

An email header is hidden metadata attached to every email that records its entire journey — every server it passed through, the true sending address, and technical authentication results.

Think of it like the postal stamps and routing labels on the back of a physical envelope, invisible until you flip it over, but revealing exactly where it really came from and what path it took to reach you. The message body is what the attacker wants you to see; the header is where the truth usually hides.

Reading the “Received” Chain:

An email typically passes through several mail servers before reaching your inbox, and each one adds its own ‘Received’ line to the header, stacked in order. The most important trick to remember: read the Received headers from the BOTTOM UP, because the bottom entry represents the very first hop — closest to the true origin — while the top entry is the last server before it reached you.

2. Techniques Used by Attackers

Domain Spoofing

Attackers craft emails designed to look like they come from a trusted, well-known brand — Netflix, PayPal, DHL, or even a colleague inside your own company. The display name might say ‘Netflix Support,’ while the actual underlying email address is something completely unrelated, like support@netfIix-billing[.]xyz. Always check the real address behind the display name, never just the name itself.

Social Engineering (Urgency)

Phishing emails are deliberately written to trigger panic or urgency, short-circuiting careful thinking. Classic phrases include ‘Your account has been suspended,’ ‘Immediate action required,’ or ‘Unusual sign-in detected.’ The goal is to make the recipient click first and think later.

Credential Harvesting

A fake login page is built to visually mirror a real service exactly — same logo, same layout — but the form submits whatever username and password you type directly to the attacker instead of the real service. These pages are often hosted on a look-alike domain or a compromised legitimate website.

URL Shortening

Services like bit.ly can hide a link’s true destination behind a short, generic-looking URL. A recipient sees ‘bit.ly/3xY9zP’ with no way to visually judge whether it’s safe — the real destination is hidden until you actually click it (which analysts should never do directly; use a link-expansion tool instead).

Malicious Attachments

Files like PDFs, Word documents, or Excel spreadsheets can be weaponized — often using embedded macros or scripts that execute the moment the file is opened or a prompt like ‘Enable Content’ is clicked. These payloads can install malware, establish a foothold, or download further malicious code.

3. Practical Analysis Methodology

A thorough phishing investigation always covers both the Header and the Body of the suspicious email, and layers in reputation checks before drawing a conclusion.

PHISHING ANALYSIS WORKFLOW

Step 1: Domain Verification

Check whether the sending domain actually exists and legitimately belongs to the organization it claims to represent. A classic, extremely common red flag is a mismatch between the friendly display name (e.g., ‘DHL Support’) and the real underlying email address domain (e.g., @dhl-tracking-alert[.]info instead of @dhl.com).

Step 2: Body Analysis

Inspect the visible content and, critically, the underlying HTML — hyperlinked text often displays one thing (‘Click here to verify’) while actually pointing to a completely different, malicious URL underneath. Always hover (never click) to reveal the true destination, or better, inspect the raw HTML source of the email.

Step 3: Attachment Extraction and Hashing

Any attachment should be extracted (never opened directly) and converted into a hash — a unique digital fingerprint of the file. That hash is then checked against threat intelligence databases like VirusTotal or Any.Run to see if it matches a known piece of malware, without ever having to run the file yourself.

Step 4: Reputation Checks

Tools like IPinfo.io let you look up the sender’s originating IP address to see its geographic location, hosting provider, and whether it’s already associated with known malicious activity — an efficient way to filter out obvious threats early, before investing time in deeper analysis.

Step 5: Recognizing Red Flags

• Poor grammar and spelling errors.

• Generic greetings (‘Dear Customer’ instead of your actual name).

• Conflicting geography — for example, a German domain sending an invoice to an Indian address.

• Mismatched sender display name vs. actual email address.

• Urgency or threats designed to rush a decision.

• Unexpected attachments, especially with macro-enabled file types.

4. Defanging: Handling Threats Safely

When documenting a malicious URL or IP address in a report, ticket, or chat message, analysts never write it in its normal, clickable form — doing so risks someone accidentally clicking it, or a security tool automatically trying to visit it. Instead, analysts ‘defang’ it: deliberately breaking its format so it’s still readable, but no longer functional as a clickable link.

The pattern is simple: replace ‘http’ with ‘hxxp’ and wrap periods in square brackets. This is standard, expected practice across the entire security industry, and you’ll see it in almost every real threat report.

5. Email Authentication Standards: SPF, DKIM, DMARC, S/MIME

These are the industry-standard technical protections that make domain spoofing much harder in the first place.

Understanding how they work — and how to read their pass/fail results in a header — is considered foundational knowledge for any SOC L1 analyst.

SPF (Sender Policy Framework): SPF is a DNS-based TXT record published by a domain owner that lists exactly which mail servers/IP addresses are authorized to send email on behalf of that domain. When an email arrives, the receiving server checks the sending IP against this list — if it’s not on the approved list, the email fails SPF, which strongly suggests spoofing.

• Analogy: A guest list at the door — if your name (IP) isn’t on it, you shouldn’t be let in claiming to represent the host (domain)

DKIM (DomainKeys Identified Mail): DKIM uses public-key cryptography to digitally sign outgoing emails. The domain publishes a public key in DNS; the sending server signs the email with a matching private key. The receiving server uses the public key to verify two things at once: that the email truly came from that domain, and that its content wasn’t altered in transit.

• Analogy: A wax seal on an envelope — if the seal is broken or doesn’t match the sender’s known seal, something’s wrong

DMARC (Domain-based Message Authentication, Reporting, and Conformance): DMARC ties SPF and DKIM together with an alignment policy. It checks that the domain verified by SPF and/or DKIM actually matches the domain shown in the visible ‘From’ address — closing a loophole where SPF and DKIM might individually pass for a different domain than the one the user actually sees. DMARC also tells receiving servers what to do with emails that fail (quarantine, reject, or do nothing), and provides reporting back to the domain owner about spoofing attempts.

• Analogy: A supervisor confirming the guest list (SPF) and the wax seal (DKIM) actually belong to the same host being claimed at the door

S/MIME (Secure/Multipurpose Internet Mail Extensions): S/MIME is a separate protocol used for digitally signing and encrypting individual emails, providing authentication, non-repudiation (the sender can’t credibly deny sending it), and data integrity (proof the content wasn’t altered). Unlike SPF/DKIM/DMARC, which protect a domain as a whole, S/MIME is applied per-message and per-user, often via digital certificates issued to individuals.

• Analogy: A personal, notarized ID badge attached to a sealed envelope — it proves the specific individual signed it, and only the recipient’s personal key can unseal the message.

Why This Matters for a SOC L1 Analyst:

Every modern email header includes an ‘Authentication-Results’ line showing pass/fail/neutral for SPF, DKIM, and DMARC. Learning to spot ‘spf=fail’ or ‘dmarc=fail’ at a glance is one of the fastest, most reliable ways to flag a likely spoofed email during triage — often before you’ve even read the message body.

6. Hands-On Tools and Techniques

Sandbox Environments: Any.Run

A sandbox is an isolated, controlled environment where a suspicious attachment can be safely detonated (executed) without any risk to real systems. Any.Run is a popular interactive sandbox that lets analysts watch, in real time, exactly what a file does — what network connections it makes, what files it creates or modifies, and what registry changes it attempts — all safely contained.

Threat Intelligence: VirusTotal

VirusTotal checks a file hash, URL, or IP against dozens of antivirus engines and threat intelligence sources simultaneously, quickly showing whether it’s already been flagged as malicious by the wider security community.

Reputation Lookups: IPinfo.io

IPinfo.io provides fast geolocation, hosting provider, and reputation data for any IP address — useful for the Reputation Checks step of the methodology (Section 3) to quickly sanity-check a sender’s origin.

Traffic Analysis: Wireshark

Wireshark is a network traffic analysis tool used to inspect PCAP (packet capture) files. For phishing/email investigations specifically, analysts can examine SMTP response codes within the captured traffic to confirm whether a suspicious email was actually blocked by a spam filter or other mail security control, or whether it successfully reached its target.

Phishing Simulations: GoPhish

GoPhish is an open-source platform organizations use to run controlled, internal phishing simulations — sending safe, fake phishing emails to employees to measure and improve security awareness. As a SOC analyst, we may be involved in reviewing simulation results or helping design more realistic (but harmless) test campaigns.

7. Recommended Learning Path

Effective phishing analysis is not just about catching one malicious email — it’s about understanding the broader threat landscape well enough to help implement stronger countermeasures against future attacks. A few parallel skill areas strengthen this significantly.

Hands-On Practice: TryHackMe TryHackMe offers safe, guided labs (such as ‘Phishing Analysis Fundamentals’) that let you practice header analysis, defanging, and investigation methodology on realistic sample emails without any risk.

Parallel Skill 1: Networking A strong grasp of networking fundamentals helps you understand how email traffic actually moves across the internet and how it can be intercepted — directly reinforcing header and traffic analysis skills.

Parallel Skill 2: Web Security (OWASP Top 10) Reviewing the OWASP Top 10 — the industry’s most widely recognized list of critical web application vulnerabilities — builds understanding of both server-side and client-side web attacks.

Conclusion

Phishing analysis blends technical investigation with pattern recognition — reading headers to trace true origin, inspecting body content and attachments for hidden payloads, checking reputation data to move fast, and understanding the authentication standards (SPF, DKIM, DMARC) that exist specifically to stop domain spoofing. Combined with hands-on tools like VirusTotal, Any.Run, Wireshark, and GoPhish, and reinforced by parallel skills in networking and web security, these are the exact capabilities that make a SOC L1 analyst genuinely effective — not just able to flag one bad email, but able to understand and help defend against the entire phishing threat landscape.

Key Takeaways for Job Readiness:

• Read ‘Received’ headers bottom-up to trace the true origin

• Display name vs. real address mismatch is a classic spoofing red flag

• Always hash attachments and check them in VirusTotal/Any.Run — never open them directly

• Defang every malicious URL/IP before documenting or sharing it (hxxp, [.] brackets)

• SPF = authorized senders; DKIM = signed and untampered; DMARC = ties both together with alignment

• S/MIME = per-message signing/encryption, separate from domain-level SPF/DKIM/DMARC

• Sandbox (Any.Run) lets you safely detonate attachments and observe behavior

• Wireshark + SMTP codes confirm whether a phishing email was actually blocked

• GoPhish powers internal phishing simulations for employee awareness training

• Strengthen networking and OWASP Top 10 knowledge alongside phishing analysis

LEARNING SOURCE :

Defronix Academy — SOC Analyst Training (YouTube) SOC Training — Class 31

SOC Training — Class 32

CyberSecurity #SOCAnalyst #InfoSec #BlueTeam #LearningJourney #ContinuousLearning