Investigate a phishing email like a SOC analyst
SOC analysts take apart suspicious emails all day without clicking a single link. Learn their method on a sample phish built from raw headers: trace the email back to the PC that sent it, read the SPF, DKIM and DMARC verdicts, catch a link that lies about where it goes, hash an attachment that hides a card-stealing form, detonate URLs safely in a public sandbox, and finish with a written report. Then turn it on the real phish in your own spam folder.
- A safe URL and attachment workflow with urlscan.io and VirusTotal, and what works without an account
- A report template that turns your notes into a proper write-up
- Python 3.9 or newer (
python --version). On Windows,winget install Python.Python.3.12if you don't have it - A plain text editor (Notepad, TextEdit, VS Code)
- For the final exercise: a real phishing email from your own spam or junk folder
The analyst's rules, and getting the raw email
Work on a safe copy of the email, never on the live message in your inbox.
Rule one: never click, never open, never replyEverything an analyst learns comes from reading the email as text. Links get looked at, not visited. Attachments get hashed, not opened. You'll only ever send a URL to a sandbox that visits it for you.
Rule two: work on the raw fileWhat your mail app shows you is a friendly rendering that hides the evidence. The raw message (an
.emlfile) contains every header and every hidden link. Save it from your mail app:- Gmail (web): open the email, click the three dots (More) next to Reply, choose Download message
- Outlook on the web or the new Outlook: three dots, View, View message source. Select all, copy, paste into Notepad, and save as
suspicious.eml - Apple Mail: select the email, File, Save As, format Raw Message Source
- Thunderbird: select the email, File, Save As, File, saves as
.eml
Rule three: write it down as you goA finding you didn't record didn't happen. The kit's script writes a report skeleton for you.
The kitsample-phish.eml is the practice email for this mission, and phish-triage.py is the analysis script. Put both in a new folder called
phish-lab.TipGmail's own view is useful too. More, Show original shows the SPF, DKIM and DMARC verdicts in a summary box at the top, plus the full raw message below it.
phish-lab folder containing sample-phish.eml and phish-triage.py, and you know how to save an email as .eml from your own mail app.