Defensive Measures & Response

The Clock Starts When the Report Arrives

You have spent four lessons learning to identify phishing, trace headers, verify authentication, and extract artifacts. All of that analysis is preparation for this moment: someone in your organization just reported a suspicious email, and your response determines whether one person got phished or the entire company gets compromised.

Phishing response is time-sensitive. From the moment the first user reports a suspicious email, the attacker's clock is ticking — but so is yours. Every minute that passes is another minute for other employees to click the same link, submit their credentials, or open the same attachment. Your job is to move faster than the threat.

Click to enlarge

Phase 1: Triage the Report

When a user reports a suspicious email (via a report button, forwarding to a phishing mailbox, or a helpdesk ticket), the first step is a rapid triage:

Triage Decision Tree

After answering the triage questions, your path branches:

• No interaction, single recipient: Block artifacts, delete the email, close the ticket
• No interaction, multiple recipients: Block artifacts, search-and-purge across all mailboxes, alert affected users
• User clicked link but did not submit credentials: Block artifacts, check endpoint for indicators, monitor the user's account
• User submitted credentials: Block artifacts, force password reset, revoke active sessions, check for unauthorized access, engage incident response
• User opened attachment: Block artifacts, isolate the endpoint, scan for malware, check for lateral movement

Phase 2: Scope the Campaign

Before you can contain, you need to know how big the problem is. Use the IOCs you extracted in Lesson PH-4 to search across your environment:

Email Gateway Search

Search your email gateway (Microsoft 365, Google Workspace, Proofpoint, Mimecast) for all messages matching:

• Sender address or domain
• Subject line (exact or fuzzy match)
• URLs contained in the body
• Attachment hash or filename

# Example: Microsoft 365 compliance search
Search-MailboxAuditLog -Subject "Urgent: Password Reset Required"
Get-MessageTrace -SenderAddress "attacker@evil-domain.xyz" -StartDate (Get-Date).AddDays(-7)

Proxy and DNS Log Search

If the phishing email contains URLs, search your web proxy logs and DNS resolver logs for any employee who visited the destination:

# Wazuh query: check for DNS queries to the phishing domain
rule.groups: "dns" AND data.dns.question.name: "evil-domain.xyz"

# Proxy log query: check for HTTP requests to the phishing URL
url.domain: "evil-domain.xyz" AND url.path: "/harvest"

Endpoint Search

If the email contained an attachment, search your EDR or Velociraptor for the file hash across all endpoints:

# Velociraptor artifact: search for file hash across fleet
SELECT * FROM Artifact.Windows.Search.FileFinder
WHERE HashSha256 = "e3b0c44298fc1c149afbf4c8996fb924..."

Phase 3: Contain and Block

Once you know the scope, block every extracted artifact to stop the bleeding:

Email Gateway Blocks

Network Blocks

SIEM Detection Rules

Create a Wazuh custom rule to detect any future interaction with the attacker's infrastructure:

<group name="phishing_campaign_2026_001">
  <rule id="100500" level="12">
    <if_group>dns</if_group>
    <field name="query">\.evil-domain\.xyz$</field>
    <description>DNS query to known phishing domain (Campaign 2026-001)</description>
    <group>phishing,ioc,</group>
  </rule>

  <rule id="100501" level="14">
    <if_group>web-log</if_group>
    <url>evil-domain.xyz/harvest</url>
    <description>HTTP request to phishing credential harvester (Campaign 2026-001)</description>
    <group>phishing,ioc,credential_theft,</group>
  </rule>
</group>

Phase 4: Check for Credential Compromise

If the phishing email directed users to a credential harvesting page, you must determine whether anyone submitted their credentials — even if they claim they did not.

Indicators of Credential Submission

Credential Compromise Response

If evidence shows credentials were submitted:

1. Force immediate password reset — do not wait for the user to "get around to it"
2. Revoke all active sessions — Azure AD: Revoke-AzureADUserAllRefreshToken; Google: Admin Console → Security → User Sessions
3. Check for persistence mechanisms — email forwarding rules, OAuth app consents, mailbox delegates
4. Review recent account activity — file access, email sends, permission changes
5. Enable enhanced monitoring — temporarily increase logging level for the compromised account
6. Check for lateral movement — if the compromised account has admin privileges, assume broader compromise

The Email Security Stack

Effective phishing defense is not a single tool — it is a layered stack where each component catches what the previous one missed.

Click to enlarge

User Awareness and Phishing Simulations

Technical controls catch most phishing. The attacks that get through are the ones that fool humans. User awareness is not a checkbox compliance exercise — it is a measurable security control.

Effective Awareness Programs

Phishing Simulation Best Practices

• Use realistic templates that mirror actual attacks (not obviously fake)
• Vary difficulty levels — some easy, some hard
• Rotate themes: credential harvesting, attachment delivery, CEO impersonation, IT helpdesk
• Do not punish users who click — educate them immediately
• Track trends over time, not individual failures

Measuring Phishing Defense Effectiveness

What you cannot measure, you cannot improve. Track these metrics to demonstrate the value of your phishing program and identify areas for improvement:

Integration with SIEM and SOAR

In a mature SOC, phishing response is not entirely manual. Wazuh (SIEM) and Shuffle (SOAR) automate portions of the workflow:

Wazuh Integration

• Email gateway log forwarding: Forward Microsoft 365 or Google Workspace email events to Wazuh for centralized alerting
• Custom rules for phishing IOCs: Deploy rules (as shown in Phase 3) that alert on DNS queries, web requests, or file hashes matching known phishing campaigns
• Correlation rules: Alert when the same user triggers both "phishing email received" and "credential submission" events within a short time window

SOAR Playbook (Shuffle)

A phishing response playbook in Shuffle can automate:

1. Parse the reported email — extract sender, URLs, attachments automatically
2. Check IOCs against threat intel — VirusTotal, AbuseIPDB, URLScan.io API calls
3. Block IOCs — push firewall rules, email gateway blocks, DNS sinkhole entries
4. Search for other recipients — query email gateway for matching messages
5. Notify affected users — send automated warning to anyone who received the email
6. Create incident ticket — populate with extracted IOCs, analysis results, and containment actions
7. Escalate if credentials compromised — trigger the credential compromise sub-playbook

Key Takeaways

• Phishing response is time-critical — the average time to first click is under 60 seconds, so every minute of analyst delay increases the blast radius
• The response process follows five phases: triage, scope, contain, check for compromise, and recover — skipping any phase leaves gaps
• DNS sinkholing is one of the fastest and most effective containment actions, redirecting all future clicks to an internal block page
• Never trust user self-reporting on credential submission — always verify with proxy logs and authentication logs
• The email security stack has six layers: gateway filtering, sandboxing, URL rewriting, post-delivery remediation, user reporting, and SOC investigation
• User awareness programs with blame-free reporting cultures achieve significantly higher phishing report rates than punitive approaches
• Measure your program with click rate (< 5%), report rate (> 70%), MTTD (< 15 min), and MTTC (< 60 min) to demonstrate value and identify gaps

What's Next

You now know how to respond when phishing is confirmed — from blocking artifacts to checking for credential compromise to measuring your program's effectiveness. In Lesson PH-6: Phishing Investigation Report Writing, you will learn how to document everything you have done into a professional investigation report that communicates your findings to management, legal, and other stakeholders. In Lab PH-5, you will execute a full phishing response workflow: scoping the campaign, blocking IOCs, checking for click-throughs, and measuring your response time.