Phishing Triage

Manual email analysis is a slow, error-prone bottleneck for SOC teams. This skill automates the forensic triage of suspicious emails by parsing raw headers and attachments to identify spoofing, authentication failures, and malicious intent. It converts raw .eml or .msg data into structured evidence for immediate incident response.

What it does

• Authentication auditing parses SPF, DKIM, DMARC, and ARC results to detect delivery failures.
• Header inspection traces Received hops and flags mismatches between From, Reply-To, and Return-Path headers.
• Spoofing detection identifies display-name deception and lookalike domain attacks using edit-distance checks.
• URL analysis extracts links to flag mismatched anchor text, IP literals, shorteners, and punycode.
• Attachment forensics hashes files and scans for risky extensions, double extensions, and Office macro indicators.
• Scored reporting generates a SOC-ready verdict (0-50+) based on weighted heuristic findings.

How it works

1. Source ingestion takes raw message headers or exported email files provided by the user.
2. Automated triage runs the included Python scripts to extract indicators and calculate the threat score.
3. Protected domain check compares the sender against a whitelist to identify targeted brand impersonation.
4. Actionable response maps findings to specific containment steps like purges, blocks, or credential resets.

Frameworks & tools

This skill utilizes a Python-based analysis engine (eml_triage.py) and specialized reference guides for incident response. It is designed to work with standard email export formats like .eml and .msg.

Why this beats prompting it yourself

Prompting an LLM to "find phishing" often misses subtle header discrepancies or fails to calculate consistent risk scores. This skill uses deterministic Python scripts to verify authentication protocols and file signatures, ensuring your SOC reports are based on technical evidence rather than linguistic guesswork.

Use cases

• User report queues to quickly clear batches of suspicious emails reported by employees.
• Incident write-ups to generate standardized tickets for tracking and remediation.
• Attachment screening to identify hidden macros or executable scripts in archives.
• Brand protection to detect external actors spoofing company executives or domains.

Known limitations

Analysis quality depends on providing original headers; forwarded emails lose critical routing data. The script requires a Python 3 environment to execute the triage logic.