From the SOC Trenches: Your Ultimate Guide to Analyzing Malicious Emails

How analysts deconstruct phishing attacks, BEC scams, and malware threats, one email at a time.

By Mostafa Wael Hamdy Elsaeed

Contact: Email | LinkedIn | Portfolio

Email is the original killer app of the internet. It’s also the number one attack vector used by cybercriminals. For those of us on the front lines in a Security Operations Center (SOC), email analysis isn’t just a task — it’s a constant battle. A single malicious email that slips through can lead to a devastating data breach, ransomware, or financial loss.

But how do we actually catch them? It’s not magic; it’s a process. It involves a mix of technical sleuthing, psychological insight, and the right set of tools. Whether you’re an aspiring SOC analyst or just curious about what happens behind the scenes, this guide will walk you through the entire process, step-by-step.

Why Email is a SOC Analyst’s Biggest Battlefield

In the SOC, our primary mission is to detect, analyze, and respond to cybersecurity threats. Email is ground zero. An analyst’s day often revolves around alerts triggered by suspicious emails reported by users or flagged by our security systems [1].

We’re looking for the needles in a haystack of digital correspondence. The challenges are immense: high volumes of alerts, sophisticated social engineering tactics, and the constant pressure to make the right call quickly. A false positive can disrupt business, but a missed threat can be catastrophic [2], [3].

Know Your Enemy: The Unholy Trinity of Email Threats

To hunt threats, you have to know what they look like. While there are countless variations, most malicious emails fall into one of three categories.

1. Phishing & Spear Phishing

This is the most common one. Phishing is a wide-net approach, sending generic emails to thousands of people hoping a few will bite [4]. Spear phishing is its more dangerous cousin — a targeted attack, often personalized with your name, job title, or other details to build trust and trick you into clicking a malicious link or opening an infected attachment [5], [6].

2. Business Email Compromise (BEC)

BEC is all about deception and big money. Attackers impersonate a high-level executive (like a CEO) or a trusted vendor and send an email requesting an urgent wire transfer or sensitive data [7]. There’s no malware, no malicious link — just a cleverly crafted, socially-engineered email designed to exploit human trust [8], [9]. This makes them incredibly difficult for automated systems to catch.

3. Malware Delivery

This is the classic email threat. The goal is to get you to run a malicious piece of software on your machine. The malware is usually hidden in an attachment, like a ZIP file disguised as an invoice, a macro-enabled Word document, or a PDF with an embedded exploit [10]. The payload could be anything from spyware to a full-blown ransomware encryptor.

The Deep Dive: How to Analyze a Suspicious Email

Okay, a suspicious email has landed in your analysis queue. Where do you start? Let’s break it down into four core components.

Step 1: Analyze the Email Headers

The headers are the email’s digital fingerprint, containing a log of its journey across the internet. Don’t just read the email — interrogate it.

To see the headers, look for an option like “Show Original” or “View Source” in your email client. You’ll see a block of text. Here are the key fields I always check first:

• From:: This is what the user sees, but it's easily forged. Never trust it blindly.
• Reply-To:: A classic trick. The From: address might look legitimate (e.g., ceo@yourcompany.com), but the Reply-To: address goes to the attacker (attacker@gmail.com). They're banking on you not noticing.
• Return-Path: / MAIL FROM:: This shows where the email actually originated. If this doesn't align with the From: address, it's a major red flag.
• Received:: This is the most important part. Read these lines from bottom to top to trace the email's path from the sender to you. Look for suspicious IP addresses, long delays, or servers in unexpected geographic locations. You can use tools like MXToolbox or VirusTotal to check the reputation of these IPs.
• Authentication-Results:: This header tells you if the email passed the three key authentication checks:
• SPF (Sender Policy Framework): Did the email come from a server authorized to send on behalf of that domain? An SPF fail is a huge red flag for spoofing [21], [22].
• DKIM (DomainKeys Identified Mail): Does the email have a digital signature that proves it hasn’t been tampered with in transit? A DKIM fail means something is wrong [23].
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): This policy tells receiving servers what to do if SPF or DKIM fails (e.g., quarantine or reject). A DMARC pass gives you high confidence the email is legitimate [24].

Pro Tip: If you see DMARC=fail or SPF=fail, you are almost certainly looking at a spoofed email. This is your first and best technical indicator of a phishing attempt.

Step 2: Dissect the Email Body

The body is where the attacker tries to manipulate the user. We’re looking for the classic signs of social engineering [4]:

• Urgency and Fear: “Your account will be suspended!” or “Urgent payment required!” Attackers want you to panic and act before you think.
• Unusual Requests: Is your CEO asking you to buy gift cards? Is the finance department suddenly asking for a wire transfer to a new bank account? Always verify these requests out-of-band (i.e., with a phone call or in person).
• Generic Greetings & Poor Grammar: Phishing emails often use generic greetings like “Dear Customer.” While some attackers have gotten better, poor spelling and grammar are still common giveaways.
• Promise of a Reward: “You’ve won a prize!” If it sounds too good to be true, it is.

Step 3: Scrutinize the URLs

Never, ever click a link in a suspicious email. Instead, analyze it safely.

1. Hover, Don’t Click: In most email clients, you can hover your mouse over a link to see the actual destination URL. Does the display text match the actual link? Attackers will often make the display text https://yourbank.com while the underlying link goes to https://yourbank.secure-login.scam.com.
2. Look for Deception:

• Typosquatting: Using slightly misspelled domains (e.g., microsft.com instead of microsoft.com) [28].
• Subdomain Tricks: Using a legitimate domain as a subdomain of the attacker’s domain (e.g., yourcompany.com.attacker.net). Your browser cares about the last part of the domain, attacker.net.
• Punycode: This is an encoding method that allows for non-ASCII characters in URLs, but attackers use it to create look-alike domains. For example, xn--pple-43d.com might look identical to apple.com in some browsers [27], [28].

3. Use a URL Sandbox: Copy the link (without clicking!) and paste it into a URL analysis tool like urlscan.io, VirusTotal, or Browserling. These tools will safely visit the site in a virtual environment and show you what it does, including any malicious redirects or downloads.

Step 4: Handle Attachments with Extreme Caution

Attachments are high-risk. Treat every unexpected attachment as a potential bomb.

1. Check the File Type: Be wary of executable files (.exe, .bat, .ps1) and archives (.zip, .rar, .7z), especially if they are password-protected (this is a common trick to evade antivirus scanners). Also be suspicious of Office documents (.docm, .xlsm) that ask you to "Enable Macros."
2. Calculate the File Hash: Before opening anything, get the file’s hash (MD5, SHA-256). You can do this with built-in tools in your OS or third-party utilities.
3. Check the Hash against Threat Intelligence: Upload the hash (not the file itself!) to VirusTotal or other threat intelligence platforms [31]. If the hash has been seen before and is associated with malware, you have your answer without ever having to open the file.
4. Detonate in a Sandbox: If the file is unknown, the final step is to open it in an isolated sandbox environment [34]. This is a secure virtual machine that is completely cut off from your network. Here, you can safely observe the file’s behavior. Does it make network connections? Does it create suspicious files or registry keys? Does it try to encrypt files? The sandbox will tell you its true intent.

Connecting the Dots: From Email to Incident

Finding one malicious email is just the beginning. The real work is figuring out the full scope of the attack. We call the clues we find Indicators of Compromise (IOCs) — the sender’s IP address, the malicious URL, the file hash of the attachment.

Our next step is to pivot from these IOCs and hunt for them across our entire environment [56], [57]:

• SIEM Search: We take the sender’s IP address and search our SIEM (Security Information and Event Management) logs. Did this IP communicate with any other systems on our network? This can help us find patient zero.
• Check Proxy & DNS Logs: We search for the malicious domain in our proxy and DNS logs. Did anyone else in the organization visit this site?
• Endpoint Detection: We use our EDR (Endpoint Detection and Response) tool to search for the file hash across all company endpoints. Has this malware been downloaded or executed anywhere else?

This process of correlation turns a single alert into a full picture of the incident, allowing us to see how widespread it is and who is affected.

The Response: Containment and Eradication

Once we’ve confirmed a threat, we move fast to contain it. This is a coordinated effort known as Incident Response (IR) [65].

1. Containment: The immediate goal is to stop the bleeding.

• Delete all instances of the malicious email from user inboxes.
• Block the sender’s IP address at the firewall and email gateway.
• Block the malicious domain/URL at the web proxy.
• Isolate any infected machines from the network.

2. Eradication: Once contained, we clean up the mess. This involves removing the malware, resetting compromised passwords, and patching any exploited vulnerabilities.

3. Lessons Learned: Every incident is a learning opportunity. We conduct a post-mortem to figure out what went wrong and how we can improve our defenses. Was a security control missing? Do users need more training? The goal is to be stronger tomorrow than we are today.

My Arsenal: The Tools of the Trade

We don’t do all of this manually. We rely on a suite of powerful tools:

• Email Security Gateways (ESGs): These are our first line of defense (Proofpoint, Mimecast, Cisco Secure Email). They scan incoming emails for spam, malware, and phishing indicators before they ever reach the user [37], [38].
• SIEM Platforms: The heart of the SOC (Splunk, Microsoft Sentinel, IBM QRadar). All our logs go here, allowing us to correlate data from across the enterprise [41], [42].
• SOAR Platforms: (Palo Alto XSOAR, Splunk SOAR). These tools help us automate the response. For example, a SOAR playbook can automatically take a suspicious URL, run it through urlscan.io, and if it’s malicious, block it at the proxy — all in a matter of seconds [53], [54].
• Open-Source Tools: The community provides amazing free tools like urlscan.io, VirusTotal, MXToolbox, and Wireshark that are indispensable for daily analysis.

Final Thoughts

Email analysis is a craft. It requires curiosity, attention to detail, and a healthy dose of skepticism. While AI and automation are helping us sift through the noise, there will always be a need for a sharp human analyst who can spot the subtle clues in a well-crafted phishing email.

Get Mostafa Elsaeed’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

By understanding the attacker’s tactics and mastering the process of deconstruction — from headers to attachments — you can become a formidable defender in the ongoing battle for the inbox.

Stay vigilant, keep learning, and never trust an unexpected email.

References

[1] Cloud Security Alliance, “Priorities Beyond Email: How SOC Analysts Spend Their Time,” Cloud Security Alliance Blog, 2023. [Online]. Available: https://cloudsecurityalliance.org/articles/priorities-beyond-email-how-soc-analysts-spend-their-time.

[2] A. Costello, “What Is a SOC Analyst? A Day in the Life,” Springboard Blog, May 24, 2023. [Online]. Available: https://www.springboard.com/blog/cybersecurity/what-is-soc-analyst/.

[3] Exabeam, “What is a Security Operations Center (SOC)?,” Exabeam Resources, 2024. [Online]. Available: https://www.exabeam.com/information-security/what-is-soc/.

[4] Cybersecurity & Infrastructure Security Agency (CISA), “Avoiding Social Engineering and Phishing Attacks,” cisa.gov, Oct. 20, 2022. [Online]. Available: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks.

[5] Federal Bureau of Investigation (FBI), “Business Email Compromise,” Internet Crime Complaint Center (IC3), 2023. [Online]. Available: https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/business-email-compromise.

[6] Fortinet, “What Is Phishing?,” Fortinet, 2024. [Online]. Available: https://www.fortinet.com/resources/cyberglossary/phishing.

[7] Palo Alto Networks, “What Is Business Email Compromise (BEC)?,” Palo Alto Networks Cyberpedia, 2024. [Online]. Available: https://www.paloaltonetworks.com/cyberpedia/what-is-business-email-compromise-bec-tactics-and-prevention.

[8] Palo Alto Networks, “Business Email Compromise,” Palo Alto Networks, 2024. [Online]. Available: https://www.paloaltonetworks.com/cyberpedia/what-is-business-email-compromise.

[9] CrowdStrike, “What is Business Email Compromise (BEC)?,” CrowdStrike, 2024. [Online]. Available: https://www.crowdstrike.com/cybersecurity-101/email-security/business-email-compromise-bec/.

[10] EasyDMARC, “What is Malware?,” EasyDMARC, 2024. [Online]. Available: https://easydmarc.com/blog/what-is-malware/.

[11] S. Piper, “Top 4 Phishing Signs Every SOC Analyst Must Know,” Dropzone AI Blog, 2023. [Online]. Available: https://www.dropzone.ai/blog/top-4-phishing-signs-every-soc-analyst-must-know.

[12] Fortinet, “Social Engineering,” Fortinet, 2024. [Online]. Available: https://www.fortinet.com/resources/cyberglossary/social-engineering.

[13] Cybersecurity & Infrastructure Security Agency (CISA), “Phishing,” cisa.gov, 2023. [Online]. Available: https://www.cisa.gov/phishing.

[14] Proofpoint, “What are Malicious Email Attachments?,” Proofpoint Threat Reference, 2024. [Online]. Available: https://www.proofpoint.com/us/threat-reference/malicious-email-attachments.

[15] Fortinet, “What is Incident Response?,” Fortinet, 2024. [Online]. Available: https://www.fortinet.com/resources/cyberglossary/incident-response.

[16] KeepnetLABS, “Step by Step Phishing Email Analysis,” KeepnetLABS Blog, Jan. 12, 2024. [Online]. Available: https://keepnetlabs.com/blog/step-by-step-phishing-email-analysis.

[17] C. D. Costa, “Email Analysis from a SOC Analyst Perspective,” Medium, Jul. 20, 2023. [Online]. Available: https://medium.com/@chamal.d.costa/email-analysis-from-a-soc-analyst-perspective-4006c111f93.

[18] Google, “Check if your Gmail message is authenticated,” Gmail Help, 2024. [Online]. Available: https://support.google.com/mail/answer/180707. [19] Cornell University IT, “How to Investigate a Phishing Email,” IT at Cornell, 2024. [Online]. Available: https://it.cornell.edu/phishing/how-investigate-phishing-email.

[20] WhatIsMyIPAddress.com, “Trace an Email,” whatismyipaddress.com, 2024. [Online]. Available: https://whatismyipaddress.com/trace-email.

[21] Microsoft, “How Microsoft 365 uses Sender Policy Framework (SPF) to prevent spoofing,” Microsoft Learn, Nov. 2, 2023. [Online]. Available: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-spf.

[22] Cloudflare, “What is DMARC? | DMARC, DKIM, SPF,” Cloudflare Learning, 2024. [Online]. Available: https://www.cloudflare.com/learning/email-security/dmarc-dkim-spf/.

[23] Higher Logic, “Set Up DomainKeys Identified Mail (DKIM),” Higher Logic Support, 2024. [Online]. Available: https://support.higherlogic.com/hc/en-us/articles/360043285772-Set-Up-DomainKeys-Identified-Mail-DKIM.

[24] Mimecast, “What is DMARC?,” Mimecast Brand Center, 2024. [Online]. Available: https://www.mimecast.com/content/what-is-dmarc/.

[25] MXToolbox, “Email Header Analyzer,” mxtoolbox.com, 2024. [Online]. Available: https://mxtoolbox.com/EmailHeaders.aspx.

[26] Fortinet, “URL Filtering,” Fortinet, 2024. [Online]. Available: https://www.fortinet.com/products/next-generation-firewall/url-filtering. [27] Intezer, “Punycode Attacks: When Your Eyes Deceive You,” Intezer Blog, Jun. 21, 2023. [Online]. Available: https://www.intezer.com/blog/phishing/punycode-attacks-when-your-eyes-deceive-you/.

[28] S. Morgan, “Beware Of Lookalike Domains In Punycode Phishing Attacks,” Cybersecurity Ventures, May 1, 2023. [Online]. Available: https://cybersecurityventures.com/beware-of-lookalike-domains-in-punycode-phishing-attacks/.

[29] Red Points, “What is Typosquatting and How to Prevent It,” Red Points Blog, Mar. 20, 2024. [Online]. Available: https://www.redpoints.com/blog/what-is-typosquatting/.

[30] S. Raj, “How to Investigate Suspicious URLs like a SOC Analyst,” WebAsha Blog, Aug. 1, 2023. [Online]. Available: https://www.webasha.com/blog/how-to-investigate-suspicious-urls-like-a-soc-analyst-top-tools-steps-explained.

[31] C. Pathirana, “VirusTotal 101: A Beginner’s Guide to File Analysis and Threat Detection,” Medium, Nov. 1, 2023. [Online]. Available: https://chamindux.medium.com/virustotal-101-a-beginners-guide-to-file-analysis-and-threat-detection-46f512f39578.

[32] CrowdStrike, “What is Endpoint Detection and Response (EDR)?,” CrowdStrike, 2024. [Online]. Available: https://www.crowdstrike.com/cybersecurity-101/endpoint-security/endpoint-detection-and-response-edr/.

[33] Varonis, “What Is an IoC (Indicator of Compromise)?,” Varonis, 2023. [Online]. Available: https://www.varonis.com/blog/indicator-of-compromise.

[34] InfoSec Perception, “What is Sandbox in Cyber Security?,” infopercept.com, 2023. [Online]. Available: https://www.infopercept.com/unveiling-the-power-of-sandbox-in-cyber-security/.

[35] Barracuda, “What is Sandboxing?,” Barracuda Glossary, 2024. [Online]. Available: https://www.barracuda.com/support/glossary/sandboxing.

[36] Libraesva, “Email Sandboxing,” libraesva.com, 2024. [Online]. Available: https://www.libraesva.com/email-sandboxing/.

[37] Proofpoint, “Email Security Gateway,” Proofpoint, 2024. [Online]. Available: https://www.proofpoint.com/us/threat-reference/email-security-gateway.

[38] Mimecast, “Secure Email Gateway,” Mimecast, 2024. [Online]. Available: https://www.mimecast.com/products/email-security/secure-email-gateway/.

[39] Comparitech, “Cisco Secure Email vs Mimecast SEG,” Comparitech, 2024. [Online]. Available: https://www.comparitech.com/net-admin/cisco-secure-email-vs-mimecast-seg/.

[40] Exabeam, “What Is SIEM?,” Exabeam Resources, 2024. [Online]. Available: https://www.exabeam.com/siem-guide/what-is-siem/. [41] Microsoft, “What is Microsoft Sentinel?,” Microsoft Learn, Sep. 21, 2023. [Online]. Available: https://learn.microsoft.com/en-us/azure/sentinel/overview.

[42] Splunk, “What Is A SIEM?,” Splunk, 2024. [Online]. Available: https://www.splunk.com/en_us/data-insider/what-is-siem.html.

[43] Exabeam, “How SIEM and SOAR work better together,” Exabeam Blog, Jan. 12, 2024. [Online]. Available: https://www.exabeam.com/blog/how-siem-and-soar-work-better-together/.

[44] Red Canary, “The top 6 free SIEM tools,” Red Canary Blog, Jan. 19, 2024. [Online]. Available: https://redcanary.com/cybersecurity-101/security-operations/top-free-siem-tools/.

[45] D3 Security, “SIEM vs. SOAR: What’s the Difference?,” D3 Security, 2024. [Online]. Available: https://d3security.com/blog/siem-vs-soar-whats-the-difference/.

[46] SentinelOne, “What is SIEM?,” SentinelOne, 2024. [Online]. Available: https://www.sentinelone.com/cybersecurity-101/what-is-siem/.

[47] IBM, “What is a SIEM?,” IBM, 2024. [Online]. Available: https://www.ibm.com/topics/siem.

[48] Exabeam, “SOAR,” Exabeam, 2024. [Online]. Available: https://www.exabeam.com/explainers/soar/.

[49] Microsoft, “What is Security Information and Event Management (SIEM)?,” Microsoft Security, 2024. [Online]. Available: https://www.microsoft.com/en-us/security/business/security-101/what-is-siem.

[50] Splunk, “What is a SIEM?,” Splunk, 2024. [Online]. Available: https://www.splunk.com/en_us/data-insider/what-is-siem.html.

[51] Elastic, “What is SIEM?,” Elastic, 2024. [Online]. Available: https://www.elastic.co/what-is/siem.

[52] Wazuh, “Open Source SIEM,” Wazuh, 2024. [Online]. Available: https://wazuh.com/use-cases/siem-security-information-event-management/.

[53] Palo Alto Networks, “What is SOAR?,” Palo Alto Networks, 2024. [Online]. Available: https://www.paloaltonetworks.com/cyberpedia/what-is-soar.

[54] Swimlane, “What is SOAR?,” Swimlane, 2024. [Online]. Available: https://swimlane.com/platform/what-is-soar/.

[55] Splunk, “What Is SOAR?,” Splunk, 2024. [Online]. Available: https://www.splunk.com/en_us/data-insider/what-is-soar.html.

[56] Authentic8, “From IOCs to Actionable Intelligence,” Authentic8 Blog, Oct. 13, 2023. [Online]. Available: https://www.authentic8.com/blog/guide-iocs-actionable-intelligence.

[57] Palo Alto Networks, “What is an Indicator of Compromise (IOC)?,” Palo Alto Networks Cyberpedia, 2024. [Online]. Available: https://www.paloaltonetworks.com/cyberpedia/what-is-an-indicator-of-compromise-ioc.

[58] Fortinet, “Indicators of Compromise (IoC),” Fortinet, 2024. [Online]. Available: https://www.fortinet.com/resources/cyberglossary/indicators-of-compromise.

[59] CrowdStrike, “What is Threat Intelligence?,” CrowdStrike, 2024. [Online]. Available: https://www.crowdstrike.com/cybersecurity-101/threat-intelligence/.

[60] Anomali, “What is Threat Intelligence,” Anomali, 2024. [Online]. Available: https://www.anomali.com/resources/what-is-threat-intelligence.

[61] Recorded Future, “What is Threat Intelligence?,” Recorded Future, 2024. [Online]. Available: https://www.recordedfuture.com/what-is-threat-intelligence.

[62] ThreatConnect, “Threat Intelligence,” ThreatConnect, 2024. [Online]. Available: https://threatconnect.com/what-is-threat-intelligence/.

[63] Mandiant, “Threat Intelligence,” Mandiant, 2024. [Online]. Available: https://www.mandiant.com/threat-intelligence.

[64] CybelAngel, “IOCs in Cybersecurity,” CybelAngel, 2023. [Online]. Available: https://cybelangel.com/glossary/iocs-in-cybersecurity/.

[65] Sygnia, “What is Incident Response?,” Sygnia Blog, Aug. 15, 2023. [Online]. Available: https://www.sygnia.co/blog/what-is-incident-response-process-plan-and-complete-guide/.

[66] IncidentResponse.com, “Phishing Incident Response Workflow,” incidentresponse.com, 2024. [Online]. Available: https://www.incidentresponse.com/mini-sites/workflows/download/Phishing.pdf.

[67] Scottish Government, “Cyber Attack — Incident Response Guide,” gov.scot, 2024. [Online]. Available: https://www.gov.scot/publications/cyber-attack-incident-response-guide/.

[68] North Central Texas Council of Governments, “Incident Response Plan,” nctcog.org, 2023. [Online]. Available: https://www.nctcog.org/nct9-1-1/about-9-1-1/policies-procedures/it-security/incident-response-plan.

[69] Swimlane, “Phishing Incident Response,” Swimlane, 2024. [Online]. Available: https://swimlane.com/use-cases/phishing-incident-response/.

[70] Libraesva, “Incident Response Plan,” libraesva.com, 2024. [Online]. Available: https://www.libraesva.com/incident-response-plan/.

[71] National Cyber Security Centre (NCSC), “Phishing attacks: defending your organisation,” ncsc.gov.uk, 2024. [Online]. Available: https://www.ncsc.gov.uk/collection/email-security-and-anti-spoofing/phishing-attacks-defending-your-organisation.

Tags: Phishing, Cybersecurity, Social Engineering, Spear Phishing, Whaling, Vishing, Smishing, Email Security, Awareness, Threat Intelligence, CISA, APWG, Proofpoint, Verizon DBIR, Europol