Hacking Trainer AcademyAmeerpet · Hyderabad
+91 86868 92922 Book free classes

SOC and blue team

How to Analyze a Phishing Email: A SOC Analyst's Checklist

· 2 min read · By Thimmagurudu Bathini, Lead Trainer and Curriculum Designer

Reported phishing emails are one of the most common tasks for a junior SOC analyst. The goal is to decide quickly and accurately whether an email is malicious, find out who else received it, and contain it. Here is a repeatable method.

1. Handle It Safely

Never open links or attachments on your normal machine. Get the original message with full headers (the .eml or .msg file), and analyze it in an isolated environment. Copy links as text, never click them.

2. Read the Headers

  • From, Reply-To and Return-Path: do they match? A reply address at a different domain is a classic sign
  • Received lines: read from the bottom up to trace the servers the message passed through
  • Authentication-Results: the receiving server's verdict on SPF, DKIM and DMARC

3. Check SPF, DKIM and DMARC

  • SPF: was the sending server allowed to send for that domain?
  • DKIM: is the message signed by the domain, and was it unchanged in transit?
  • DMARC: do SPF or DKIM pass for the same domain shown in the From address, and what does the domain owner ask receivers to do on failure?

A pass does not mean safe: attackers send from their own look-alike domains that pass all three. A fail on a domain that normally passes is a strong warning.

Look at the real destination, not the displayed text. Watch for look-alike domains (letters swapped or added), URL shorteners and links to file-sharing or form services. Check domains and URLs against reputation services and your threat intelligence, and if needed open them only in a sandbox built for this.

5. Examine Attachments

Calculate the file hash and check it against reputation services first. Be wary of archives, Office files that ask to enable content, disk images, shortcut (.lnk) files and HTML attachments that open fake login pages. Detonate suspicious files only in an approved sandbox. Malware analysis basics are covered in malware analysis for beginners.

6. Read the Content

Urgency, fear or reward ("your account will be closed", "invoice overdue", "you have won"), requests for credentials, payment changes or gift cards, and generic greetings are common signs. Business email compromise often has no link or attachment at all, only a convincing request.

7. Scope and Respond

  • Search the mail logs for the same sender, subject, links or attachment hash to find every recipient
  • Remove the message from all mailboxes, following your process
  • Block the sender domain, URLs and hashes as appropriate
  • Check whether anyone clicked or entered credentials, and if so reset passwords and review sign-ins
  • Record the indicators and write a short case note

Practice It

Phishing triage is part of the alert-handling work in our SOC analyst, Splunk, Wazuh and DFIR course. Read what a SOC analyst does for the rest of the role.

Interested in SOC work? Book free trial classes. Contact us or call +91 86868 92922.

Courses Mentioned in This Guide

Beginner to intermediate · Course · 6 weeks, 90 hours

SOC Analyst and DFIR

The core concepts of EC-Council's CCT, CSA, ECIH and CHFI, taught hands-on with Splunk, Wazuh and forensics tools, in six weeks.

₹20,000 + GST · 6 weeks

  • CCT, CSA, ECIH, CHFI core concepts
  • Splunk and Sentinel
  • Phishing triage and hunting
  • Incident handling
  • Forensics and malware analysis
View the course →
Advanced · EC-Council certification

Certified SOC Analyst (CSA v2)

Run the SOC. Hunt threats and manage security incidents.

₹34,000 + GST

  • SOC operations
  • Threat hunting
  • SIEM management
  • Orchestration
View the certification →
Intermediate to advanced · Track · 12 weeks, 180 hours

Offensive Security Track

Two six-week courses, back to back: break the application, then break the network and Active Directory.

  • Weeks 1 to 6: Application security
  • Weeks 7 to 12: Network and AD (advanced)
  • Optional: SOC and DFIR
  • Free trial classes
View the program →

More Guides

SOC and blue team · 3 min read

Splunk vs Wazuh: Which Should a SOC Beginner Learn First?

Splunk or Wazuh? What each tool does in a SOC, how they differ, which appears in job listings, and how a beginner can practice both in a home lab.

Read the guide →
SOC and blue team · 2 min read

Windows Event IDs Every SOC Analyst Should Know

The Windows Security and Sysmon event IDs SOC analysts use daily: logons, failed logins, account changes, process creation, services and log clearing.

Read the guide →
SOC and blue team · 2 min read

Splunk Search Commands for Beginners: SPL with Security Examples

Learn Splunk SPL basics with security examples: search, stats, table, sort, where, eval, rex and timechart, plus searches for failed logins and new services.

Read the guide →
SOC and blue team · 3 min read

Wazuh for Beginners: Set Up a Lab and Read Your First Alerts

Get started with Wazuh: its components, an all-in-one lab install, adding a Windows agent with Sysmon, the main features and how to read and tune alerts.

Read the guide →

Start Your Cyber Security Career

Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.

Book Free Trial Classes

By submitting, you agree that Hacking Trainer Academy may contact you about courses by phone, WhatsApp or email. See our privacy notice and refund policy.

WhatsApp