Module 5: Phishing Analysis & Email Security
The #1 attack vector. Learn to dissect it.
6 lessons · 7 labs
Trace the phishing email that compromised sarah.jones@cyberblue.local on WS-HR-01 — the initial access for Operation APT Breach.
Path
- Lesson01
Lesson 5.1 — Email Anatomy & Header Analysis
Email structure, headers, envelope vs content, received chains, X-headers
- Lab02Beginner
Lab 5.1 — Email Header Dissection
Analyze two raw email headers with MXToolbox Header Analyzer — trace Received chains, find the hop your own gateway wrote, read the SPF/DKIM/DMARC verdicts it recorded, and detect spoofing indicators — then find the real delivered spearphish in the shared Wazuh environment and see which header fields the gateway's record kept.
- Lesson03
SPF, DKIM & DMARC Authentication
How email authentication works, reading authentication results, identifying spoofing
- Lab04Beginner
Lab 5.2 — Email Authentication Check
Read SPF, DKIM, and DMARC records with MXToolbox — compare three domains, tell a revoked DKIM key from a missing one, evaluate five scenarios — then build the authentication matrix from real gateway results in the shared Wazuh environment and prove why a spearphish passed SPF and still failed DMARC.
- Lesson05
Phishing Types, Tactics & Techniques
Credential harvesters, drive-by downloads, BEC, spear phishing, typosquatting, homographs
- Lab06Intermediate
Lab 5.3 — Classify the Phish
Analyze five email scenarios and classify each as spam, phishing, spear phishing, BEC, or legitimate — documenting evidence chains and recommended SOC response actions — then classify the real messages your mail gateway alerted on in the shared Wazuh environment and reconcile your verdicts against the gateway's own verdict and threat type.
- Lesson07
Lesson 5.4 — Artifact Extraction & Analysis
Extracting sender, URLs, attachments and hashes; enriching from your own intel alerts first, with public tools as corroboration.
- Lab08Intermediate
Lab 5.4 — Artifact Extraction & IOC Analysis
Extract every indicator from the Operation APT Breach spearphishing delivery using supplied SIEM evidence, decode the attacker's PowerShell stager in CyberChef, correlate the MISP intel alerts your own feed raised back to the detections they enrich, and decide which artifacts may never be sent to a public reputation service.
- Lesson09
Lesson 5.5 — Defensive Measures & Response
Blocking artefacts, email security controls, immediate response process, reporting
- Lab10Advanced
Lab 5.5 — Phishing Response
Investigate a phishing incident end-to-end in Wazuh — trace from email gateway delivery through the Sysmon process chain, C2 callback, proxy, DNS and firewall correlation, lateral movement and the cloud follow-on across 2,106 alerts — then establish the campaign's true blast radius in the archive index, where four unreported deliveries and a second victim never raised an alert at all.
- Lesson11
Lesson 5.6 — Phishing Investigation Report Writing
Structured phishing report: header analysis, artifacts, verdict, defensive actions, lessons learned
- Lab12Advanced
Lab 5.6 — Scope It Before You Write It
Before the report is written, decide what belongs in it. In Wazuh, follow the campaign's logon session across the domain controller, then exclude a second intrusion, a spray, a shared desk's baseline and a witness server on the field that decides each one — and attribute the exfiltration stage on infrastructure.
- Lab13Intermediate
Lab 5.7 — Write the Phishing Report
Write the formal incident report for the Operation APT Breach spearphishing incident from your Lab 5.5 findings and Lab 5.6 scope — executive summary, timeline, technical analysis, impact, containment with the domain credential response, lessons learned and a defanged IOC appendix. Browser-only: no lab environment.