Phishing email triage: a checklist for SOC analysts
A step-by-step checklist for a reported phishing email: scope it, read the headers, check links and attachments safely, decide, then clean up mailboxes and accounts. Free tools only.
A user forwards a suspicious email and asks "is this safe?". Multiply that by a few dozen a day and phishing reports become one of the biggest queues in any SOC. The trouble is rarely the hard cases. It's that each analyst checks things in a different order, misses a step on a busy day, and nobody can tell from the ticket what was actually looked at.
This phishing email triage checklist fixes that. It runs from the moment a report arrives to the moment you close it, and every step can be done with free tools.
The checklist at a glance
| Step | Question | Done when |
|---|---|---|
| 1. Get the original | Do I have the real message, not a forward? | You have the .eml or .msg, or the full headers. |
| 2. Scope | Who else got it? | You know the recipient count and who clicked or replied. |
| 3. Headers | Who really sent it? | Sending server, SPF, DKIM and DMARC results noted. |
| 4. Links | Where do the links go? | Every URL checked without clicking. |
| 5. Attachments | Is any file malicious? | Hashes looked up; file type noted. |
| 6. Verdict | Malicious, spam, legitimate or a simulation? | One verdict with reasons in the ticket. |
| 7. Respond | What needs cleaning up? | Messages purged, sender and URLs blocked, exposed accounts secured. |
| 8. Close | Does the reporter know? | Reply sent and ticket note written. |
Step 1: Get the original message
A forwarded email loses the headers that matter and rewrites links. Ask for the message as an attachment, use your mail platform's "Report phishing" button, or pull it yourself from the mailbox. In Microsoft 365 that means the report-message add-in, the submissions page in Defender, or a content search.
Never open attachments or click links on your own machine while you do this. Everything below works on the raw message.
Step 2: Scope it before you analyse it
One user reporting an email doesn't mean one user received it. Search for the same sender, subject or a distinctive URL across all mailboxes first, because the answer changes the priority:
- One recipient, no click: normal priority.
- Many recipients: a campaign. Speed matters more than detail, so purge early (step 7) and finish the analysis after.
- Someone clicked, replied or opened the attachment: jump to the account steps in step 7 as soon as the verdict is "malicious".
In Microsoft 365, Threat Explorer (Defender for Office 365 Plan 2) or a content search gives you the recipient list. Your proxy or DNS logs show who visited the links.
Step 3: Read the headers
The display name and the From address are the easiest things for an attacker to fake. The headers show what actually happened. Check, in this order:
- Authentication-Results: the SPF, DKIM and DMARC verdicts your own mail server recorded. A
dmarc=failfor a domain that publishesp=rejectshould never have reached the inbox. - From vs Return-Path vs Reply-To: three different domains is a warning sign. A Reply-To pointing to a free webmail address on a "CEO" email is classic business email compromise.
- The first external Received hop: the server that handed the message to your provider. Look up its IP owner. A "Microsoft" invoice sent from a VPS host is not from Microsoft.
- Lookalike domains:
rnicrosoft.com,micros0ft-support.com, a familiar brand on an odd top-level domain.
Our guide on how to read email headers goes through each field in detail.
Passing SPF and DKIM doesn't mean safe. Attackers register their own domains and set them up correctly. Authentication tells you who sent the message, not whether that sender is honest.
Step 4: Check the links without clicking
Extract every URL from the body, including the ones hidden behind buttons. Then, for each one:
- Read the real destination. Link text can say anything. Safe Links and other rewriters wrap the real URL, so unwrap it first.
- Check the domain's age with an RDAP or WHOIS lookup. A domain registered in the last 30 days hosting a "password expiry" page is almost always malicious.
- Check reputation in URLhaus, VirusTotal and urlscan.io. Use urlscan.io's search first; submit a new scan only if the URL holds nothing personal, since scans can be public.
- Watch for trusted hosting. Phishing pages on SharePoint, Google Forms, Dropbox or Cloudflare Pages pass reputation checks. Judge what the page asks for, not who hosts it.
Write links into the ticket defanged (hxxps[://]example[.]com) so nobody clicks them by accident. More on that in how to defang URLs, IPs and domains.
Step 5: Check attachments safely
- Hash first, upload never (at first). Look up the SHA-256 in VirusTotal or MalwareBazaar. Uploading a file can leak a client's document to everyone with access to that service.
- Note the file type. HTML attachments (often fake login pages), ISO, IMG, LNK, OneNote, password-protected ZIPs and Office files that ask you to "enable content" are the usual delivery types.
- Open unknown files only in a sandbox, never on an analyst workstation.
Step 6: Decide, and write down why
Pick one verdict and give your reasons in a line each. Four verdicts cover almost everything:
| Verdict | Typical evidence | Action |
|---|---|---|
| Malicious | Credential page, malware, BEC request, spoofed internal sender | Full response (step 7) |
| Spam / marketing | Real sender, unwanted but harmless | Block sender if asked; no incident |
| Legitimate | Known sender, authentication passes, expected content | Tell the user it's safe, and why |
| Simulation | Your phishing test platform's domain or headers | Thank the reporter; no action |
Step 7: Respond
For a malicious email:
- Purge every copy from every mailbox. In Microsoft 365, use Threat Explorer's remediation or a compliance search with a purge action.
- Block the sender address or domain and each malicious URL in your mail filter (in Microsoft 365, the Tenant Allow/Block List).
- For anyone who entered a password: reset it, revoke their sessions, check MFA methods for anything newly added, and look for new inbox rules that forward or delete mail.
- For anyone who opened a malicious file: isolate the device and hand it to whoever runs endpoint investigations.
- Block the domains and IPs on your proxy or DNS filter if the email had infrastructure beyond the mail itself.
Step 8: Close the loop
Reply to the reporter. A quick "thanks, it was phishing and we removed it from 40 mailboxes" teaches people that reporting is worth it, which is the cheapest security control you have. Then write a ticket note that lists the indicators, the verdict, the reasons and every action taken, so the next analyst doesn't have to repeat your work.
FAQ
How long should phishing triage take?
A clear-cut single-recipient report usually takes 5 to 15 minutes with the steps above. A campaign takes longer, but purging first keeps the risk low while you finish.
Should I click the link in a sandbox to see what happens?
Check reputation and existing scans first. If you need to see the page, use an isolated browser or a sandbox service, and remember that some kits show a harmless page to anything that doesn't look like the targeted victim.
What if SPF, DKIM and DMARC all pass?
Then the email really came from that domain. Decide whether the domain itself is trustworthy: its age, whether it's a lookalike, and whether a real account at that company was compromised.
Do I need to report phishing anywhere outside my company?
It helps. Report the URL to the hosting provider and to services such as Google Safe Browsing or Microsoft's report page, and send the email to your mail provider so its filters learn from it.
Paste the raw headers into the Email Header Analyzer: it shows the hop path, SPF, DKIM and DMARC results and the mismatches that matter.
IOC Triage, our free browser extension, gives a verdict for any URL, domain, IP or hash from 15 threat-intel sources and copies a ready ticket note. It also scans Gmail and Outlook on the web for phishing as you read.