Full Diagnostic Tree & Step-by-Step Overview
What specific suspicious indicator or component are you currently investigating in the email?
- Sender address, display name discrepancy, or email authentication header failure
- Suspicious hyperlinks, shortened URLs, or login portal prompts inside the body
- Attached files, double-extension archives (.zip/.iso), or macro-enabled documents
- Need to safely export full RFC 822 headers (.EML/.MSG) and report the incident to SOC/IT
Which sender header discrepancy or domain anomaly is present?
- Display name shows a known contact or executive, but the underlying email address uses a lookalike domain
- Header inspection reveals SPF, DKIM, or DMARC alignment failure, or Return-Path mismatch
Identify Display Name Spoofing & Domain Typosquatting
Solution:
Root Cause: Business Email Compromise (BEC) & Display Name Spoofing
Attacker configured a friendly display name (e.g., 'CEO Name') paired with an unrelated or typosquatted external domain (e.g., company-support-desk.com instead of company.com) to bypass basic spam filters that only evaluate header strings.
# Step-by-Step Fix:
Inspect Full Envelope Address:In Outlook, Gmail, or Apple Mail, hover over or click the sender's display name to expand the actual email address inside the angle brackets <user@domain.com>.Detect Typosquatting and IDN Homograph Attacks:Look for subtle character replacements (e.g., micros0ft.com, rn replacing m, or Cyrillic characters rendering as Latin letters).Check if the domain was recently registered via WHOIS lookup tools.Flag External Origin Warnings:Check if your email gateway appended an [EXTERNAL] banner in the subject line or body text, confirming the message originated outside your organization's mail server network.
Inspect RFC 5322 Headers & Verify SPF/DKIM/DMARC Alignment
Solution:
Root Cause: Email Header Spoofing & Broken Authentication Alignment
The sender forged the From: header field, but the underlying SMTP envelope sender (Return-Path or MAIL FROM) points to an unauthorized server that failed SPF or DKIM cryptographic signature verification.
# Step-by-Step Fix:
View Message Headers:Outlook Desktop: Open email -> File > Info > Properties -> Copy text from Internet headers.Gmail Web: Open email -> Click Three Dots menu -> Select Show original.Analyze Authentication Results:Search the header for Authentication-Results: or Received-SPF:.Confirm whether spf=fail or dkim=fail is recorded.Verify DMARC alignment: Check if header.from domain matches the domain in smtp.mailfrom (Return-Path). If aligned dmarc=pass; if misaligned dmarc=fail.
What type of suspicious link or web prompt is contained within the message?
- Hyperlink text displays a legitimate URL, but hovering reveals a different target destination
- Link leads to a fake login page, OAuth permission consent prompt, or captcha gateway
Analyze Suspicious Embedded Links & Unmask Target URLs
Solution:
Root Cause: Weaponized Hyperlinks & URL Redirection
Phishers embed text or buttons showing trusted sites (e.g., https://bank.com) while setting the underlying HTML href attribute to point to a malicious server, IP address, or URL shortening service (bit.ly, tinyurl).
# Step-by-Step Fix:
Hover Without Clicking:Hover your cursor over the hyperlink to inspect the status bar preview (bottom-left of browser or email client).Do NOT click the link directly.Unmask Redirects and Shortened URLs:Copy the link location (Right click -> Copy Link Address).Paste the URL into an isolated sandbox or analysis tool such as VirusTotal (virustotal.com) or URLScan.io to expand redirects safely.Inspect URL Structure:Verify if the domain relies on free hosting platforms (e.g., firebaseapp.com, workers.dev, weebly.com) or utilizes raw IP addresses (e.g., http://192.168.1.1/login).
Neutralize Credential Harvesting & Rogue OAuth Consent Apps
Solution:
Root Cause: Credential Harvesting Landing Page or Illicit Consent Grant Attack
The target link opens a cloned login portal designed to capture credentials and 2FA tokens in real time (Adversary-in-the-Middle) or requests OAuth permissions ('Permissions requested') to hijack cloud mailbox tokens without needing passwords.
# Step-by-Step Fix:
Do Not Input Credentials or Accept App Permissions:Close the browser tab immediately if prompted for Microsoft 365 / Google Workspace permissions from an unverified publisher app.Audit Active OAuth Application Consents:Microsoft 365: Navigate to myaccount.microsoft.com -> Organizations / Applications and revoke unexpected app permissions.Google: Navigate to myaccount.google.com/permissions and remove unverified third-party app access.Reset Compromised Credentials:If credentials were submitted, reset account passwords immediately from a secure device and revoke all active user sessions.
What type of file attachment is included with the message?
- Compressed archives (.zip, .7z, .rar) or disk images (.iso, .img, .vhd)
- Office documents (.doc, .xls, .xlsm, .docm) or PDFs requesting macro enabling/external links
Safely Inspect & Contain High-Risk Archive Attachments
Solution:
Root Cause: Malicious Payload Delivery via Container/Archive Files
Attackers package malicious executables, VBScripts, or LNK shortcut files inside ISO/ZIP archives to bypass Secure Email Gateway (SEG) scanners that cannot inspect nested or password-protected containers.
# Step-by-Step Fix:
Check for Double Extensions:Look out for filenames like Invoice_2026.pdf.exe or Statement.docx.vbs disguised using hidden file extension settings in Windows Explorer.Do Not Mount or Extract Archives locally:Do not double-click .iso or .img files, as Windows automatically mounts them as virtual drives, bypassing Web-Mark-of-the-Web (MoTW) security protections.Hash the File for Threat Intelligence:Save the attachment without opening it.Open PowerShell and compute the SHA256 hash: Get-FileHash -Path C:\path\to\attachment.zip -Algorithm SHA256Search the resulting hash on VirusTotal to check for existing malware signatures.
Neutralize Weaponized Office Documents & Malicious Macros
Solution:
Root Cause: VBA Macro Execution & External Template Injection
The document uses weaponized Visual Basic for Applications (VBA) macros or Remote Template Injection to execute PowerShell/CMD commands in the background to fetch second-stage malware droppers.
# Step-by-Step Fix:
Keep Protected View Enabled:Never click Enable Editing or Enable Content when prompted by yellow warning bars in Word or Excel.Inspect External References in PDFs:Be cautious of PDFs containing embedded buttons (e.g., 'Click here to view document') that attempt to launch local command interpreters or external browser sessions.Submit Payload to Security Sandbox:Forward the document file directly to your IT/SOC security quarantine environment for automated dynamic analysis (sandbox detonation).
Which environment or method are you using to report the phishing message?
- Export raw email with complete message headers (.EML or .MSG file) and submit to Security/SOC
Export Raw Email (.EML/.MSG) & Submit Incident to Security Team
Solution:
Root Cause: Unreported Security Incident & Missing Header Artifacts
Simply forwarding a suspicious email strip off the original routing headers (Received:, Return-Path:, Authentication-Results:), preventing security analysts from identifying the malicious IP and adding domain blocks.
# Step-by-Step Fix:
Export Original Message File As Attachment:Outlook Desktop: Select email -> Press Ctrl + Alt + F to forward as an .MSG attachment, or drag-and-drop the email into a new message draft.Gmail Web: Open email -> Click Three Dots menu -> Click Download message to save as an .EML file.Outlook Web (OWA): Create a new email draft -> Drag the suspicious message from the inbox folder list directly into the body area to attach it as an .EML file.Submit to SOC / Security Desk:Send the exported .EML/.MSG attachment to your official internal security reporting address (e.g., phishing@company.com or soc@company.com).Use Built-in Report Add-Ins:If available, click the Report Phishing button in Microsoft Outlook or Google Workspace banner to automatically purge the email from your inbox and trigger automated gateway quarantine.