From Flagged to Finished: A Methodical Guide to Email Analysis
when it comes to the day->to->day load that falls over the Shoulders of Security Analysts , Sketchy Emails flagged are off course on the menu. This can be though a tricky subject to tackle as it requires a respectable amount of meticulous Analysis. Unoriented meticulous Analysis can go hours long and render fruitless at the end. we need to approach this subject methodically !
Note: I chose to use tables here heavily because of the sequential nature of information , for which tables offer a logical order and a simple display !
Phase 1: Header Analysis (The “Who” and “How”)
The primary purpose of analyzing the header is to determine the email’s true origin and to identify if it failed any standard email authentication checks.
1. Key Artifacts to Extract
I Sending IP address
Why it Matters: this is the actual server that sent the email.
Where to Check it: cisco talos, virustotal, other IP reputation services.
II Sender Policy Framework (SPF) Status
Why it Matters: did the sender’s IP address match the allowed list for the sending domain?
Where to Check it: essential for spoof detection.
III DomainKeys Identified Mail (DKIM) Status
Why it Matters: Was the message digitally signed by the sending domain?
Where to Check it: verifies message integrity (was it tampered with?).
IV DMARC Result
Why it Matters: what action should be taken if SPF/DKIM fail (reject, quarantine,…)
Where to Check it: the ultimate authentication verdict.
V Message ID
Why it Matters: a unique identifier for the email.
Where to Check it: used to search internal logs (firewalls, email gateways).
You may ask “How to Check SPF, DKIM, and DMARC Status?” ,valid question:
SPF
Header Line to Search For: look for lines starting with “Received-SPF:”
What it Verifies: verifies that the sending IP address is authorized by the domain owner.
DKIM
Header Line to Search For: look for lines starting with “Authentication-Results:” or “DKIM-Signature:”
What it Verifies: verifies that the message content was not tampered with in transit.
DMARC
Header Line to Search For: look for lines starting with “Authentication-Results:” or “DMARC-Filter:”
What it Verifies: the final verdict, dictating the policy action (quarantine, reject).
2. Integration with Cisco Talos
Once you extract the Sending IP Address, your very first stop for external checking should be a threat intelligence platform like Cisco Talos.
1. Navigate to the Talos Intelligence site.
2. Search the IP/Domain Reputation Center.
3. Input the IP address extracted from the header.
Talos will provide a verdict:
- ”Good” or ”Neutral”: may still be malicious, but the IP isn’t a known spammer/malware distributor (yet).
- ”Poor” or ”Blacklisted”: The IP is highly likely malicious, confirming the email is a known threat.
Phase 2: Content Analysis (The “What”)
This phase requires extreme caution. Never interact with the links or download/open the attachments on your regular analysis machine. You must treat every element as hostile.
1. Analyzing Links (URLs) 🔗
A malicious link is often disguised. Your first job is to extract the true destination URL, which might be hidden behind a display name or a URL shortener.
Get Yazan Aljedawi’s stories in your inbox
Join Medium for free to get updates from this writer.
The Workflow for Links:
- Extract: copy the actual full URL from the email source code (right-click the link and select “Copy Link Address” or view the message source).
2. Defang: change the protocol and dots so the link is harmless and cannot be accidentally clicked.
— Example: `http://malicious[.]com/phish`_
3. Check Reputation: submit the defanged URL to threat intelligence tools. Widly known CTI Platforms for such Use include:
Cisco Talos
Purpose: general reputation check for the domain/URL.
Key Feature: provides categorization, volume of spam, and known malware feed.
VirusTotal
Purpose: scans the URL against dozens of security vendor engines.
Key Feature: shows if the URL is flagged by major vendors like Google Safe Browsing, Symantec, etc.
URL Sandbox (Any.Run, Hybrid Analysis,…)
Purpose: executes the link in a safe, controlled environment.
Key Feature: crucial for seeing the final redirect (the actual phishing page or download site).
2. Analyzing Attachments (Files) 📁
Attachments come in many disguises (ZIP files, PDFs, Word documents with macros). The safest way to analyze them is through their hash value.
The Workflow for Attachments:
1. Isolate: download the attachment into a secure, isolated sandbox or virtual machine (VM).
2. Hash: calculate the SHA256 or MD5 hash of the file. This is the file’s unique digital fingerprint.
3. Check Reputation: submit the hash to threat intelligence tools mentioned above.
Phase 3: Remediation and Reporting (The “Act”)
Once you have high confidence that the email is malicious (e.g., failed SPF/DKIM, link points to a known phishing domain, or attachment hash is flagged by VirusTotal), your final steps are systematic:
1. Containment and Removal
Your primary, immediate technical action is to prevent other users from being affected.
- Email Purge: Use your organization’s security tools (e.g., Microsoft Defender for Office 365, proofpoint) to search for and delete all copies of that specific email across all user inboxes. You use the unique Message ID (extracted in Phase 2) for this widespread removal.
2. Documentation and Ticketing
The quality of the analysis report determines how quickly the next team can respond.
Tickets reguarding Phishing Emails are devided into key sections:
Incident Title
Content example : Phishing Alert: (“Credential Theft targeting specific Department/User”,…)
Priority/Severity
Content example : High (if widespread or highly targeted) or Medium (if isolated)
Observed Behavior
Content example : User reported suspicious email. Analysis confirmed failed SPF and a known malicious URL.
Technical Artifacts
Content example : Full email header, defanged URL(s), and file hash(es)
Threat Intelligence Verdicts
Content example : VirusTotal flagged hash as “Trojan-Banker” and Talos IP reputation: Poor/Blacklisted
Action Taken (Triage)
Content example : Email purged from all inboxes using Message ID
Recommended Next Step
Content example : Recommend Tier 2 block the domain/IP on the perimeter firewall
3. Escalation and Collaboration
Escalation is not just passing the burden, it’s recognizing that the incident requires resources beyond your immediate scope.
- Escalate to Tier 2/Team Lead: the ticket provides all the necessary evidence for a Tier 2 analyst or threat hunter to take the next steps like:
1. Perimeter Blocking: blocking the malicious IP address and domain on the company’s firewall.
2. User Education: If the user clicked, ensuring they change their password immediately and are aware of the phishing technique used.
I hope that was useful, Thanks for reading!
Y.
