Automated Phishing Email Analysis And Detonation Tool — Complete Documentation & Simulation

Overview & System Context

Automated Phishing Email Analysis And Detonation Tool: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~9520 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background In a controlled study by Horizon3 researchers, models that explicitly identified a trap in their reasoning still attacked it 73.4% of the time. Read the findings and see what they mean for canaries, decoys, and early detection.

A user reports a suspicious email. It takes under ten seconds to forward it to your abuse mailbox, and it takes an experienced SOC analyst anywhere from 20 minutes to four hours to close the case correctly. The gap between those two timelines is where most phishing investigations go wrong. Either the investigation is too shallow (look at VirusTotal, mark benign, close the ticket) and misses an active compromise, or it is too deep and unfocused (spend an hour on a credential-harvesting attempt from a long-compromised real estate broker domain that your email security gateway already blocked). The difference between a good phishing investigation workflow and a bad one is having clear decision gates, specific tools for each phase, and defined criteria that tell you when to close versus when to escalate. This guide provides that workflow, with the specific queries, commands, and tools for both Microsoft 365 and Google Workspace environments.

Before any analysis, answer the single most important triage question: did the reporting user interact with the email, or are they reporting it unclicked? This distinction determines the entire scope and urgency of your investigation. An unclicked report of a phishing email is a prevention success story that requires a sweep for other recipients and a clean verdict on the email itself, but almost certainly does not involve active compromise. A clicked link or opened attachment potentially represents an active compromise, and that investigation is fundamentally different: you are now investigating a potential breach, not just a malicious email.

Ask the reporting user directly and specifically: Did you click any link in this email? Did you open any attachment? Did you enter your credentials on any page the email took you to? Did you approve any MFA prompts that arrived after you clicked? Users sometimes minimize or misremember their actions under the anxiety of reporting a potential security incident. If you get vague answers, correlate against your email security gateway logs (did the user's client fetch any URLs from the email?), proxy logs (did the user's machine make outbound requests to the destination domain?), and EDR telemetry (did a browser process make network connections to the phishing domain around the time the email was received?).

Figure 1: ThePhish: an automated phishing email analysis tool - SecSI The clicked-vs-unclicked gate should be the first branch in your investigation workflow with explicit time pressure. A clicked phishing link with credential input requires immediate parallel investigation: the email analysis continues, but simultaneously you are checking for signs of account compromise (new MFA device, impossible travel, inbox rule creation) and you have a hard timer. Most attackers using credential-harvesting pages move quickly once credentials arrive; the window between phish submission and account takeover is often measured in minutes to a few hours. Forty-five minutes of careful email header analysis while an attacker is actively using stolen credentials is forty-five minutes wasted.

Email headers contain the full authentication and routing record for a message. Reading them correctly requires understanding the layered structure: the From header that the user sees is often not the actual sending infrastructure, and the actual sending infrastructure is what the authentication results evaluate. Start by extracting the full message headers (in Outlook: File > Properties > Internet Headers; in Gmail: three dots > Show Original; in Threat Explorer: the raw message view).

The From header is controlled entirely by the sender and is trivially spoofed. What matters is the Return-Path (the address bounces go to, usually the actual sending domain), the Received chain (the relay path from originating server to destination), and the originating IP in the first Received header that is outside your own infrastructure. Resolve this IP to understand the sending organization: legitimate corporate email comes from on-premises mail servers or known cloud providers (Microsoft 365, Google Workspace, Proofpoint, Mimecast). Phishing frequently originates from compromised legitimate domains (look for mismatches between the From domain and the originating infrastructure) or from hosting providers commonly associated with bulk sending.

SPF, DKIM, and DMARC results are in the Authentication-Results header added by your receiving mail infrastructure. SPF pass means the sending IP is authorized by the From domain's SPF record. SPF fail or softfail means it is not, which is a strong phishing indicator. DKIM pass means the message body and headers were cryptographically signed by a key published in the sending domain's DNS, confirming the message was not modified in transit and was sent by infrastructure that controls the signing key. DMARC pass requires SPF or DKIM to pass with alignment (the authenticated domain must match the From header domain). A message where SPF passes but DKIM fails, or where both pass but DMARC fails due to alignment mismatch, warrants deeper examination.

Figure 2: Automated Phishing Analysis with Shuffle - Part I | 64° Adventures Look at the Reply-To header separately from the From header. Attackers frequently use a legitimate-appearing From domain (which may pass SPF if the domain is compromised, or be spoofed with a lookalike) while setting Reply-To to their actual mailbox. This means replies from victims go to the attacker even though the initial message appears to come from a trusted source. This pattern is common in business email compromise (BEC) attacks impersonating executives.

URL analysis is where many SOC analysts take unnecessary risk. Never click a suspicious URL from your work machine or any machine connected to your corporate network. The destination may serve browser exploits, initiate drive-by downloads, or fingerprint your system and IP address. Analysis happens through safe tools that create distance between you and the destination.

The first tier of URL analysis is passive: submit the URL to VirusTotal (virustotal.com), URLscan.io, and check the domain against threat intelligence feeds. VirusTotal aggregates verdicts from dozens of URL reputation and anti-malware services and flags known-malicious domains. URLscan.io performs a passive screenshot and DOM capture of the destination page in an isolated environment and shows you what the page actually looks like, any embedded URLs or redirect chains, the page technology, and network requests made on load. URLscan.io is particularly useful for credential harvesting pages because you can see the login form without submitting anything.

For URLs that are not detected by passive tools but remain suspicious, detonate in a dynamic sandbox. ANY.RUN provides an interactive sandbox with visual session replay. Hybrid Analysis (VXunderground's cloud sandbox) runs automated analysis. Joe Sandbox provides detailed behavioral reports. Upload the URL (not the email file) and observe: does it redirect through multiple hops, does it serve content only to specific geolocations or browser types (evasion), does it deploy any in-browser credential harvesting, does it initiate a download? Modern phishing infrastructure often uses cloaking: it serves a benign page to analysis IPs and sandbox environments, and the actual phishing page to real users. If a sandbox returns benign but the email context is strongly suspicious, try detonating through a residential IP proxy or with a user-agent that matches the targeted users.

Figure 3: ThePhish: an automated phishing email analysis tool - SecSI For redirect chains, trace every hop. Phishing links frequently route through legitimate URL shorteners (bit.ly, tinyurl), legitimate click-tracking infrastructure from compromised mass-email platforms, and open redirectors on trusted domains (Google, Bing, LinkedIn all have documented open redirector patterns). The final destination after all redirects is what matters for the verdict. URLscan.io's scan results show the full redirect chain.

Attachment analysis follows a similar tiered approach to URL analysis: start passive (hash lookup), escalate to dynamic (sandbox detonation) if needed. Never open a suspicious attachment on your work machine or any machine connected to your corporate network. Hash the suspicious attachment (SHA-256) and look it up in VirusTotal and your threat intelligence platform. If the hash matches a known malicious file, you have your verdict quickly. If it is clean but suspicious, submit the file to VirusTotal for fresh analysis (this will share the file with VirusTotal and its partners; consider a sandboxed environment with no external submission for sensitive incidents). For Office documents (DOCX, XLSX, PPTX, DOC, XLS) suspected of containing macros, use olevba (from the oletools Python package) or DidierStevens' oledump to extract and examine macro code without executing it. Malicious macros commonly contain base64-encoded payloads, PowerShell download-and-execute chains, or WMI execution sequences that are visible in the extracted VBA code.

For PDF attachments, extract embedded JavaScript using peepdf or pdfid. Malicious PDFs often contain JavaScript that exploits the PDF reader or launches embedded executables. PDFs can also contain embedded URLs that bypass email URL scanning by wrapping the destination in a PDF action rather than a visible link. Use pdfid to identify unusual features (JavaScript presence, embedded files, URI actions, OpenAction triggers).

For executables, LNK files, and ISO images (increasingly common delivery mechanisms for bypassing Mark of the Web protections), detonate in a full sandbox with network simulation enabled. Observe process creation chains, file system writes, registry modifications, and network connections. A malicious executable will typically write persistence (registry run key, scheduled task, startup folder entry), make a C2 connection, and potentially download secondary payloads. Capture the IOCs (C2 IPs and domains, file hashes of dropped payloads, registry keys created) for the follow-on sweep.

Microsoft 365 provides three primary investigation tools for email security analysis, and using them in sequence gives you a complete picture of a phishing campaign's reach within your tenant. Threat Explorer (in the Microsoft Defender portal under Email & Collaboration > Explorer) provides a searchable view of all email processed by Exchange Online Protection and Defender for Office 365. Filter by sender address, sender IP, subject line, URL (use the URL Clicks tab to see if anyone clicked a link in the message), or attachment hash. The 'All email' view shows both delivered and quarantined messages. For a phishing investigation, search by the sender address and delivery time range to find every instance of the campaign that entered your tenant. Switch to the 'User Reported' view to see what the reporting user's submission looked like versus the automated analysis verdict.

Message Trace (in the Exchange Admin Center or via the Microsoft Defender portal) provides delivery status for specific messages. Use it to determine whether a specific message was delivered to specific recipients, quarantined, or rejected. Message Trace is more reliable than Threat Explorer for confirming delivery status to individual mailboxes and for identifying delivery to distribution groups (where Threat Explorer may not expand all members). For high-volume sweeps, use the PowerShell Exchange Online cmdlet Get-MessageTrace with appropriate filters rather than the GUI.

Content Search (in the Microsoft Purview compliance portal) allows you to search mailbox content across all mailboxes in the tenant. Use it to find every mailbox that still contains the phishing message after initial delivery. Search by subject, sender, and date range, then refine with keywords that appear in the message body or URL. Content Search results are used to scope the message purge action.

Before purging, export the search results to document the scope.

Use New-ComplianceSearchAction with Purge -PurgeType SoftDelete for initial remediation (messages go to Recoverable Items and can be restored), or HardDelete for permanent removal when you are certain of scope and do not need recovery options. Google Workspace investigations follow a similar flow but use Google-native tooling. The primary investigation surfaces are the Admin Console Gmail Log Search, the Alert Center, and the Google Vault for preservation and eDiscovery.

Gmail Log Search is accessible in the Admin Console under Reports > Email Log Search. You can search by sender, recipient, subject, message ID, and date range. The search results show the delivery status (delivered, quarantined, rejected), the routing path, and whether any Gmail security filters applied. For a phishing investigation, search by the sender address and date range to find all messages from the campaign that entered your Workspace tenant. Note whether the messages were delivered to spam or inbox; spam delivery means users likely still saw the message. The 'Details' view for each message shows the full message path and any applied security policies.

The Alert Center (Admin Console > Security > Alert Center) shows automated security alerts generated by Google's security systems, including phishing reclassification alerts, suspicious login alerts, and user-reported phishing events. Check here first when beginning an investigation to see if Google's systems have already identified a threat. The phishing reclassification alerts are particularly useful: if Google's backend analysis determines a message was phishing after delivery, the alert appears here, and you can trigger retroactive message reclassification directly from the alert.

For sweeping and remediating messages, Google Workspace admins can use the Admin Console's Email quarantine (under Apps > Google Workspace > Gmail > Compliance) to delete messages from user mailboxes using the 'Delete From View' action in the quarantine interface. For large-scale remediation, the Gmail API's users.messages.trash and users.messages.delete methods allow programmatic remediation across all mailboxes. Unlike Microsoft 365, Google does not have a single command-line purge tool equivalent to New-ComplianceSearchAction; large-scale remediation either requires the API or a SIEM integration with remediation action capabilities.

If the reporting user clicked a link and potentially submitted credentials, the following indicators must be checked immediately and in parallel with the email analysis. Do not wait for the email verdict to check these; the timeline between credential submission and account takeover can be measured in minutes. Impossible travel is the classic indicator: sign-in from a geographic location that is physically impossible given the user's prior sign-in location and the time elapsed. In Microsoft 365, check Azure AD Sign-in logs (Azure Active Directory > Sign-ins) filtered to the affected user. Look for sign-ins from countries the user does not operate in, or sign-in location sequences that would require faster-than-possible travel. Both Microsoft's own risk detection and third-party UEBA platforms will flag impossible travel, but checking manually during an active investigation is faster than waiting for an automated alert.

New MFA device enrollment is a high-confidence compromise indicator. After stealing credentials, attackers immediately enroll their own authenticator device to maintain access even after the victim's password is changed. In Azure AD, check the user's Authentication Methods (Azure AD > Users > [user] > Authentication Methods) and review the registration history for any new devices enrolled recently. In Google Workspace, check the user's security settings for new 2-step verification devices. An MFA device enrolled within minutes to hours of the phishing email delivery is a near-certain indicator of account takeover.

Inbox rule creation is a standard attacker persistence and evasion technique: after taking over an account, the attacker creates inbox rules to delete incoming security alerts, hide replies to messages they are sending on the victim's behalf, or forward all incoming email to an external address. In Microsoft 365, query the Unified Audit Log for Set-InboxRule and New-InboxRule operations by the affected user. In Google Workspace, review the user's filters and forwarding rules under Gmail settings. An inbox rule that deletes or hides security notifications or forwards mail externally created after the phishing delivery date is conclusive evidence of compromise.

After establishing the phishing email's characteristics (sender, subject, URL domain, attachment hash), execute a tenant-wide sweep to find every other user who received the same campaign. The goal is to identify additional recipients who may have clicked before the message was quarantined or before the first report arrived. A sweep that identifies 40 recipients of the same campaign, three of whom clicked, changes the scope from a single-user investigation to a potential multi-user incident.

Design your sweep query to match the campaign at the right level of specificity. Too specific (exact subject match only) will miss messages where the attacker slightly varied the subject. Too broad (sender domain only) will flood you with results from a compromised but high-volume legitimate domain. Layer the search: start with the combination of sender IP or ASN and the URL destination domain, since these are harder to vary than subject lines or display names. If the campaign used a URL shortener or click-tracker, search on the unwrapped destination URL domain rather than the shortened URL.

For Microsoft 365, run the Content Search or Threat Explorer query for all mailboxes over the time range from the campaign's first known delivery to the current time. Export results to identify every recipient and delivery status. For any mailbox where the message was delivered (not quarantined), check that user's activity for click events (Threat Explorer URL Clicks tab) and sign-in anomalies. For Google Workspace, Gmail Log Search can query across all users; supplement with Alert Center for Google's automated phishing detection across the same time range.

Document your sweep methodology and results before taking any remediation action. The documentation serves two purposes: it establishes the scope of the incident for the IR record and any regulatory reporting, and it provides the search parameters for the subsequent purge action so you can verify that purge completed successfully by re-running the same search afterward.

Remediation for a phishing investigation has three components: removing the malicious message from mailboxes, resetting credentials for affected users, and revoking active sessions to force reauthentication with clean credentials. The sequence matters: revoke sessions before resetting passwords, because an attacker with an active session can change the password back before your reset completes in some edge cases. Reset passwords before relying on new credentials for any communication about the incident.

2. System Architecture & Core Working Principles For Microsoft 365 message purge, New-ComplianceSearchAction with PurgeType SoftDelete moves matching messages to the user's Recoverable Items folder, where they can be recovered if needed. HardDelete permanently removes them. Use SoftDelete for the initial purge to preserve recovery options, and document the content search name and result count before and after purging to verify effectiveness. Verify the purge completed successfully by re-running the content search; it should return zero results.

Revoke active sessions for all users who clicked the phishing link or show other indicators of compromise. In Microsoft 365, use Revoke-AzureADUserAllRefreshToken for the affected user account, or in the new Entra ID portal use the 'Revoke sessions' action on the user object. This forces reauthentication on all devices and applications. Follow with a conditional access check to ensure the user's reauthentication will require MFA. In Google Workspace, 'Sign out all web sessions' in the Admin Console revokes all active Google sessions for the user. If the user enrolled a new MFA device during the compromise window, remove that device from their Authentication Methods before forcing reauthentication, or the attacker will simply reauthenticate using the device they enrolled.

Clear case closure criteria prevent two failure modes: closing cases that should be escalated to incident response, and keeping cases open indefinitely because closure criteria are vague. Define your criteria explicitly and check each one before closing. Close the case as phishing (no compromise) when: the message was not clicked by any recipient, or the only interaction was opening the message without clicking links or downloading attachments; the tenant sweep confirms no other users were affected with clicked indicators; there are no authentication anomalies for any users who received the message; the message has been purged from all mailboxes; and the sending infrastructure, URL, and any attachments have been submitted as indicators to your threat intelligence platform for future detection.

Escalate to incident response when any of the following are true: a user submitted credentials to the phishing page, confirmed by proxy logs, user report, or site analytics from a URL that captured submissions; signs of account takeover are present (new MFA device, impossible travel, inbox rules, external mail forwarding); lateral movement indicators are present in EDR or authentication logs for the affected user's session; more than one user was compromised; or the phishing campaign is specifically targeting your organization (personalized lure, internal information used in the email body, executive impersonation with targeted recipient list).

Documentation before case closure must include: the original email with full headers preserved (do not just close the ticket; export the headers), the analysis verdict for each URL and attachment, the sweep query and result count, the list of affected users and their interaction status, the remediation actions taken with timestamps, and any IOCs extracted for your threat intelligence platform. This documentation supports retrospective analysis, regulatory inquiries, and pattern recognition across multiple phishing cases.

Your first question on every phishing report is whether the user clicked. Clicked and not-clicked are different investigations with different urgency. Master header analysis and the tenant-wide sweep query for your email platform before anything else: those two skills resolve 80 percent of phishing cases. Treat any reported phish as a potential credential compromise until you have verified the user did not interact with the payload.

Whether they clicked any link or opened any attachment. Specifically ask whether they entered their username or password on any page the email took them to, and whether they received and approved any MFA push notifications shortly after clicking. These questions determine whether you are running a prevention analysis or an active compromise investigation. Do not wait for technical analysis to complete before asking these questions; the answer may require immediate parallel action to prevent ongoing account takeover.

Submit it to URLscan.io first; it performs a sandboxed page capture that shows you what the page looks like, the redirect chain, and any network requests made on load, without your browser making direct contact. For URLs that appear benign on URLscan.io but remain contextually suspicious, use an interactive sandbox like ANY.RUN or Joe Sandbox for dynamic analysis. Never click a suspicious URL from your work machine or any machine on the corporate network.

What is the fastest way to find everyone else who received a phishing email in Microsoft 365? Use Threat Explorer in the Microsoft Defender portal. Filter by the originating IP or sender infrastructure combined with the destination URL domain, over the time range from first known delivery to present. The URL Clicks tab in Threat Explorer specifically shows which users clicked links in processed messages, which is more useful than just recipient count. For confirmed campaigns, follow up with a Content Search in Microsoft Purview to find messages that may have been delivered before Defender's detection caught them.

Escalate when any user submitted credentials to the phishing page, when you observe account takeover indicators such as new MFA device enrollment, impossible travel, or inbox rules created after the phishing delivery, or when lateral movement indicators appear in authentication or EDR logs. Also escalate when a campaign is clearly targeted at your organization specifically rather than generic bulk phishing, as targeted campaigns indicate a deliberate threat actor with more resources and objectives than credential harvesting alone.

Does deleting a phishing email from a user's mailbox prevent compromise if they already clicked the link? No. Deleting the message is a remediation step that prevents other users from clicking and removes the evidence from the user's environment, but it does nothing to address compromise that has already occurred. If a user clicked and submitted credentials, the attacker already has those credentials regardless of whether the email is in the mailbox. Credential reset and session revocation are the critical remediation steps for an account that was likely compromised; message purge is a cleanup step, not a compromise reversal.

25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team. Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.

50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam. Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.

Actionable threat intelligence for working practitioners. Free. No spam. Trusted by 50,000+ SOC analysts, CISOs, and security engineers. This project provides a step-by-step guide to analyzing a suspicious email to identify phishing indicators and confirm malicious intent. It covers the use of various tools and techniques to conduct a thorough phishing analysis.

The goal of this project is to provide a detailed framework for identifying suspicious emails and conducting phishing analysis. The documentation covers each step in-depth, along with the tools used for verification, decoding, and final validation of phishing indicators. A Step-by-step phishing email analysis documentation, demonstrating techniques and tools to identify suspicious emails, recognize phishing indicators, and confirm malicious intent Every phishing email that reaches a user is an intelligence opportunity. A systematic analysis methodology turns each reported message into actionable IOCs, better defenses, and a faster response workflow.

Phishing remains the most common initial access vector in security incidents worldwide. Despite billions spent on email gateways, user awareness training, and domain authentication protocols, a steady stream of malicious emails continues to land in employee inboxes. When they do, your security team needs a consistent, repeatable methodology for analyzing them — not just to neutralize the immediate threat, but to extract every piece of intelligence the attacker has inadvertently given you.

This guide presents a six-step phishing analysis methodology that takes you from raw email through header analysis, URL investigation, attachment detonation, IOC extraction, and response actions. Whether you're a SOC analyst triaging your tenth reported phish of the day or an incident responder investigating a targeted campaign, this framework ensures you don't miss critical findings.

It's tempting to treat phishing as a binary problem: block the email, delete it, move on. But every phishing email that reaches your users carries intelligence about the threat actor's infrastructure, targeting preferences, and operational patterns. Proper analysis extracts that intelligence and feeds it back into your defenses. A single well-analyzed phishing email can yield: sender infrastructure (IPs, domains, mail servers), credential harvesting pages or malware delivery URLs, payload samples with behavioral indicators, indicators of compromise that can be deployed across your security stack, and patterns that connect the email to broader campaigns targeting your industry.

Skip the analysis, and you block one email. Do it properly, and you block every future email from that campaign — and potentially share intelligence that protects other organizations too. Before you touch a suspicious email, you need a safe environment. Phishing analysis should never be performed on a production workstation. A single misclick — opening an attachment, following a URL — can compromise the analyst's system and give the attacker a foothold inside your security team.

Critical safety rule: Never open attachments or click links from suspicious emails on a production system, your corporate network, or any machine with access to sensitive resources. Even "just looking" at a URL in a browser can trigger drive-by downloads, browser exploits, or attacker-side logging that confirms your email address is active. Email headers are the metadata envelope of every message. They reveal the actual path the email took through the internet, the authentication status of the sender, and often expose inconsistencies that confirm the email is malicious. Headers are the single most information-rich artifact in phishing analysis.

Received headers are the most complex but most valuable. Read them from bottom to top to trace the email's journey. Each header includes a timestamp and typically identifies both the sending and receiving server. Look for: After the headers, examine the email body for social engineering indicators. Document the pretext — the story the attacker is using to manipulate the recipient — as this is valuable for user awareness training and campaign correlation.

Extract every URL from the email body, including URLs embedded in images and hyperlinked text where the display text differs from the actual URL. This discrepancy — display text showing https://your-bank.com while the actual link points to https://your-bank-login.malicious.com — is one of the most common phishing techniques. 3. Software Implementation, Frameworks & Protocols If the phishing email includes attachments, treat every attached file as potentially malicious. Even seemingly innocent file types can contain embedded macros, exploits, or scripts.

Common attachment lures to watch for: invoice PDFs with embedded JavaScript, delivery notification documents with macros, shared document links that download malware, password-protected ZIP files (the password is in the email body to bypass gateway scanning), and HTML attachments that render credential harvesting forms locally. By this point in the analysis, you've accumulated a significant body of indicators. The next step is to compile, categorize, and format them for deployment across your security infrastructure.

Format IOCs for your threat intelligence platform (MISP, OpenCTI, ThreatConnect) and ensure they include context: the campaign they're associated with, the confidence level, the date of observation, and a reference to your analysis report. Analysis without action is wasted effort. Once you've completed the analysis and extracted IOCs, execute your response workflow: Manual phishing analysis doesn't scale. If your SOC handles more than a handful of reported phishing emails per day, you need automation to maintain quality without burning out your analysts.

Start simple. Even automating the header extraction and initial reputation checks saves analysts significant time per reported email. Build complexity incrementally as your workflow matures. Explore the ForgeWork Malware Analysis Academy for hands-on training in phishing analysis, malware reverse engineering, and threat intelligence. Or contact our team to discuss managed phishing response for your organization.

Have a question this post did not answer? See our incident response FAQ — common questions about engagement timing, legal reporting, insurance, and evidence handling. The first hour after detecting ransomware determines the outcome. A structured minute-by-minute guide. Learn how to use the MITRE ATT&CK framework during active incidents, gap analysis, and detection engineering.

Despite advances in secure email gateways, cyberactors continue to bypass filters by abusing trust, misusing legitimate infrastructure, and creating messages that appear to be routine to recipients. This makes it all the more important for security teams to conduct regular email analysis. It’s important to understand that the exercise of examining email messages doesn’t depend on whether a message “appears” or “feels” suspicious. It’s rather a structured investigation that checks email authentication results, sender identity, routing paths, message content, and attachments to categorize an email as “legitimate” or “malicious.” When done correctly, email analysis helps organizations detect threats early, limit internal spread, and respond with confidence instead of guesswork.

This guide breaks down email analysis step by step, explaining how to examine headers, interpret authentication signals, analyse email content, and take appropriate action using evidence-driven methods rather than assumptions. Email analysis is the process of examining an email to determine the legitimacy of the sender and the safety of the content and attachments. Instead of focusing on opens or clicks, security-driven email analysis examines technical details such as sender identity, headers, domains, links, attachments, authentication results, and overall email deliverability test indicators that help assess sending health.

The goal of this email examination exercise is to detect phishing, spoofing , malware, or business email compromise (BEC) attempts before they cause damage. The analysis can be done manually by reviewing email headers and content; however, the approach is slow and error-prone, especially when dealing with a large number of emails. That’s why there are several email analysis tools that automatically break down headers, check SPF, DKIM, and DMARC alignment, scan URLs and attachments, and highlight suspicious patterns. By using structured analysis rather than gut instinct, security teams can quickly determine whether an email is safe, risky, or outright malicious.

The following process ensures that decisions are based on evidence rather than assumptions and that responses are consistent across incidents. Before you analyse an email, you need to be clear about why you are analysing it. The objective could be to confirm whether an email is phishing, understand how it bypassed filters, or assess whether other users are at risk. Defining this upfront helps narrow the scope and prevents unnecessary checks that slow down the investigation. Clear objectives also help determine which email analysis tools to use and which indicators matter most for the situation.

Once the objective is clear, the next step is to collect the full email data. This usually includes the complete email headers, body content, links, and any attachments. Relying only on screenshots or forwarded messages can hide critical details, so it is important to work with the original message whenever possible. Most email analysis tools require raw headers or full message files to provide accurate results.

Before diving into technical checks, the email data needs to be cleaned and organized. This involves separating headers from content, identifying the sender and recipient details, and noting any obvious anomalies. Duplicate or irrelevant information should be set aside so the focus remains on the indicators that matter. Tools like the Email Header Analyzer help simplify this step by automatically parsing complex headers into readable sections.

This preparation makes it easier to analyse the email logically instead of jumping between scattered fields. This is where most of the investigation happens. Using email analysis tools, analysts review authentication results such as SPF and DKIM, inspect sender domains, examine links and attachments, and trace the email’s delivery path. At the same time, contextual signals, like unusual requests or unexpected timing, are considered.

After reviewing the data, the next step is identifying what stands out. This could be a failed authentication check, a mismatched domain, a suspicious redirect link, or an attachment with unsafe characteristics. These findings help determine whether the email is malicious, suspicious, or legitimate. Clear documentation of these risks is important for both response and future reference.

Based on the findings, teams decide what action is required. This might include quarantining similar emails, blocking sender domains, warning users, or escalating the incident for deeper investigation. Email analysis tools often help automate parts of this step by flagging related messages across mailboxes. The goal is not just to analyse an email, but to act on the analysis quickly and correctly.

Examining suspicious emails does not end with one investigation. Reviewing outcomes helps teams understand what worked, what was missed, and how to detect future emails faster. Over time, this feedback loop improves detection rules, user awareness, and overall email security posture. This continuous improvement is what turns email analysis from a reactive task into a proactive security capability.

Email analysis matters because one missed email is often all an attacker needs. Here are the main benefits you can reap from regularly inspecting all the emails: One of the biggest advantages of email analysis is catching threats before someone clicks, replies, or downloads anything. Many phishing and spoofing emails are designed to look normal at first glance. The branding looks right, the language sounds familiar, and nothing immediately feels off. Email inspection helps security teams look past appearances and focus on technical signals.

By analysing sender identity, authentication results, links, and attachments, teams can spot inconsistencies that users might miss. This early visibility is critical for stopping attacks such as credential harvesting and business email compromise at the earliest stage, before real damage occurs. Once an attacker gains access or convinces a user to engage, similar messages are often sent to others inside the organization. Email analysis helps security teams track how widely a suspicious message has spread and identify related emails across multiple users.

By finding and removing these emails early, teams can prevent further exposure. This limits lateral movement, reduces the number of affected users, and keeps a small incident from turning into a larger internal security problem. Over time, consistent email reviewing builds a clearer picture of which senders and domains can be trusted. Authentication results, domain reputation, and sending patterns reveal whether an email truly comes from who it claims to be. This is especially important for detecting impersonation attempts that mimic vendors, executives, or internal teams.

Instead of relying on users to judge email legitimacy, organizations can use technical signals to make informed trust decisions. This reduces human error and creates a more reliable way to assess incoming messages. Email analysis also plays an important role in compliance and governance. Organizations often need to show that they are actively monitoring email risks, especially when sensitive data is involved. Analysis logs, reports, and investigation records provide proof that security controls are in place and working.

4. Practical Deployment, Analysis & Case Studies This documentation helps during audits and incident reviews. It demonstrates that email risks are being actively managed, not ignored, and that the organization takes responsibility for protecting its communication channels. Before you learn to analyse an email, you must understand the important fields included in an email header. Without that, you might not be able to make complete sense of the examination. Here are the fields: Email body analysis is for the visible part of the email, like the text, tone, and attachments. While attackers are becoming more sophisticated in their techniques, it’s still a good habit to use this checklist to systematically investigate all incoming emails and identify red flags.

Start by closely examining the sender’s email address, not just the display name. Phishing emails often use addresses that look legitimate at first glance but include subtle misspellings, extra characters, or unusual domains. Emails claiming to represent an organization but sent from personal email providers like Gmail or Yahoo should always be treated with caution. Legitimate organizations usually personalize their emails using your name or relevant account details. Phishing emails often rely on generic greetings such as “Dear Customer,” “Hello,” or no greeting at all. While this alone does not confirm malicious intent, it is an important signal when combined with other indicators.

Emails that create a sense of urgency are designed to push recipients into acting without thinking. Common examples include warnings about account suspension, payment failures, or security alerts that demand immediate action. Attackers use fear and pressure to bypass rational decision-making. Emails that appear to come from colleagues or senior executives but request sensitive information or urgent financial actions are a common tactic in business email compromise attacks. Requests for gift cards, wire transfers, or confidential data should always be verified through a separate communication channel.

Promises of free gifts, rewards, or prizes are frequently used to lure recipients into clicking on malicious links. Similarly, fake shipping notifications from well-known brands often ask users to confirm delivery details or payment information. Legitimate companies rarely request sensitive details through unsolicited emails. You can use Phishing Link Checker to detect malicious links in emails and other online content.

Poor spelling and grammar can be a sign of phishing, though this indicator is becoming less reliable as AI-generated content becomes more prevalent. A sudden change in writing style, tone, or formatting compared to previous legitimate emails from the same sender can still be a useful clue. Attachments are a common delivery method for malware and credential-stealing attacks. Be cautious of unexpected invoices, receipts, or documents related to services you did not request. Pay special attention to QR codes or image-based attachments that hide clickable links, as these are often used to bypass traditional filters.

Email analysis is no longer optional. It is a basic requirement for protecting organizations from phishing, spoofing, malware, and business email compromise. As attacks become more advanced, it is no longer enough to rely solely on how an email looks or on user judgment. A structured review of headers, authentication results, links, and attachments helps security teams spot threats early and respond with confidence.

EasyDMARC makes email analysis easier by providing dedicated tools to inspect email headers, verify authentication, and quickly identify suspicious patterns. Start using EasyDMARC and get a clearer view of your email security with a 14-day free trial . We’re glad you joined EasyDMARC newsletter! Get ready for valuable email security knowledge every week.

ThePhish is an automated phishing email analysis tool based on TheHive , Cortex and MISP . It is a web application written in Python 3 and based on Flask that automates the entire analysis process starting from the extraction of the observables from the header and the body of an email to the elaboration of a verdict which is final in most cases. In addition, it allows the analyst to intervene in the analysis process and obtain further details on the email being analyzed if necessary. In order to interact with TheHive and Cortex, it uses TheHive4py and Cortex4py , which are the Python API clients that allow using the REST APIs made available by TheHive and Cortex respectively.

This example aims to demonstrate how a user can send an email to ThePhish for it to be analyzed and how an analyst can actually analyze that email using ThePhish. A user can send an email to the email address used by ThePhish to fetch the emails to analyze. The email has to be forwarded as an attachment in EML format so as to prevent the contamination of the email header. In this case, the used mail client is Mozilla Thunderbird and the used email address is a Gmail address.

The analyst navigates to the web page of ThePhish and clicks on the "List emails" button to obtain the list of emails to analyze. When the analyst clicks on the "Analyze" button related to the selected email, the analysis is started and its progress is shown on the web interface.

In the meantime, ThePhish extracts the observables (URLs, domains, IP addresses, email addresses, attachments and hashes of those attachments) from the email and then interacts with TheHive to create the case. At this point the user is notified via email that the analysis has started thanks to the Mailer responder. The description of the first task allows the Mailer responder to send the notification via email.

After the first task is closed, the second task is started and the analyzers are started on the observables. The analysis progress is shown on the web interface while the analyzers are started. Once all the analyzers have terminated their execution, the second task is closed and the third one is started, then ThePhish calculates the verdict. Since the verdict is "malicious", all the observables that are found to be malicious are marked as IoC. In this case only one observable is marked as IoC.

The case is then exported to MISP as an event, with a single attribute represented by the observable mentioned above. Then, ThePhish sends the verdict via email to the user thanks to the Mailer responder. Finally, both the task and the case are closed. The description of the third task allows the Mailer responder to send the verdict via email. Moreover, the case has been closed after five minutes and resolved as "True Positive" with "No Impact", which means that the attack has been detected before it could do any damage.

Once the case is closed, the verdict is available for the analyst on the web interface together with the entire log of the analysis progress. At this point the analyst can go back and analyze another email. The above-depicted case was related to a phishing email, but a similar workflow can be observed when the analyzed email is classified as "safe". Indeed, the case is closed and the verdict is sent via email to the user.

On the other hand, when an email is classified as "suspicious", the verdict is only displayed to the analyst on the web interface. At this point the analyst needs to use the buttons on the left-hand side of the page to use TheHive, Cortex and MISP for further analysis. This is because the analysis has not been completed yet and so the user is only notified that the analysis of the email that he forwarded to ThePhish has been started. Indeed, the last task and the case have not been closed yet since they need to be closed by the analyst himself once he elaborates a final verdict.

The analyst can view the reports of all the analyzers on TheHive and Cortex and, in case this revealed not to be enough, he could also download the EML file of the email and analyze it manually. When the analyst terminates the analysis, he can populate the body of the email to send to the user in the description of the last task, start the Mailer responder, export the case to MISP if the verdict is "malicious" by clicking on the "Export" button and then close the case.

ThePhish is a web application written in Python 3. The web server is implemented using Flask, while the front-end part of the application, which is the dynamic page written in HTML, CSS and JavaScript, is implemented using Bootstrap. Apart from the web server module, the back-end logic of the application is constituted by three Python modules that encapsulate the logic of the application itself and a Python class used to support the logging facility through the WebSocket protocol. If you want to see a graphical representation of the application logic, click here . Moreover, there are several configuration files used by the aforementioned modules that serve various purposes.

5. Performance Evaluation & Extended Technical Observations When the analyst navigates to the base URL of the application, the web page of ThePhish is loaded and a bi-directional connection is established with the server. This is done by using the Socket.IO JavaScript library in the web page that enables real-time, bi-directional and event-based communication between the browser and the server. This connection is established with a WebSocket connection whenever possible and will use HTTP long polling as a fallback. For this to work, the server application uses the Flask-SocketIO Python library, which provides a Socket.IO integration for Flask applications. This connection is then used by ThePhish to display the progress of the analysis on the web interface.

Every time the analyst performs an action on the web interface, an AJAX request is sent to the server, which is an asynchronous HTTP request that permits to exchange data with the server in the background and update the page without reloading it. This allows the analyst both to visualize the list of emails to analyze and to make the analysis start. ThePhish interacts with TheHive and Cortex thanks to TheHive4py and Cortex4py. Moreover, it interacts with an IMAP server to retrieve the emails to analyze.

Since the installation and configuration of TheHive, Cortex and MISP services from scratch for a production environment may not be extremely straightforward, TheHive Project provides Docker images and Docker Compose templates here to facilitate the installation procedure. For the sake of simplicity, the provided templates are made simple, without providing the full configuration options of each docker image.

If you only want to try ThePhish or you want to have it up and running as fast as possible, you can use the provided Docker Template in the docker folder, which is a modified version of one of the Docker Templates provided by TheHive Project that also allows creating a ThePhish container. To install ThePhish using Docker and Docker Compose, please refer to this guide . I strongly recommend that you install it this way at least the first time you use it so that you can learn the basics and how to configure it with a minimal configuration that should work on the first try. Indeed, the previously linked guide also provides a step-by-step procedure to configure the TheHive, Cortex and MISP instances.

In order to install, configure and integrate TheHive, Cortex and MISP instances, please refer to their official documentation: It is advisable that the email address from which ThePhish fetches the emails to analyze be a Gmail address since it is the one with which ThePhish has been tested the most. It is preferable that the account is a newly created one, with the sole purpose of being used by ThePhish. The procedure to activate the app password that is required by ThePhish to connect to the mailbox and fetch the emails is explained here .

This installation procedure has been tested on a VM running Ubuntu 20.04.3 LTS with Python 3.8 installed and the versions of TheHive, Cortex and MISP shown in this docker-compose.yml file. Once TheHive, Cortex and MISP are configured and listening at a certain URL and the email address is ready to use, you can install and configure ThePhish.

Create a Python virtual environment and activate it (it is good practice but it is not required) In order to send emails to the user, ThePhish uses the Mailer responder. Since ThePhish uses TheHive4py to interact with TheHive, a function that allows running a responder by its ID is needed. Unfortunately, this function is not part of TheHive4py yet, but a pull request has been made to add it to TheHive4py ( #219 ). While waiting for it to be added, it must be manually added using the following command for ThePhish to work properly (replace the version of Python in the command if you use a different version of Python): The file configuration.json is the global configuration file that allows setting the parameters for the connection to the mailbox and to the instances of TheHive, Cortex and MISP. It also allows setting parameters related to the cases that will be created on TheHive.

You can learn how to create an organization and a user with org-admin role in that organization on TheHive and obtain its API key here (ThePhish documentation, recommended) or here (TheHive documentation) . Similarly, you can learn how to create an organization and a user with read, analyze roles in that organization on Cortex and obtain its API key here (ThePhish documentation, recommended) or here (Cortex documentation) .

The URLs and the IDs that are set in this file must be the same that are set in the configuration file of TheHive named application.conf , which contains a part related to Cortex and a part related to MISP. The parameters that you should look for are name and url in both parts, which correspond to the IDs and the URLs of the Cortex and MISP instances. The IDs can also be found in the About window on the web interface of TheHive. An example where the Cortex ID is the string local and the MISP ID is the string MISP THP is shown in the following figure: The file application.conf is used to integrate TheHive with Cortex and MISP. You can learn how to set up the integration with Cortex here (ThePhish documentation, recommended) or here (TheHive documentation) , while for the integration with MISP you can go here (ThePhish documentation, recommended) or here (TheHive documentation) .

The URLs at which TheHive, Cortex and MISP instances are reachable should also be replaced in the file templates/index.html so that the buttons on the web interface will be able to reach them. To do that, replace the last three href of this portion of code: The server that will be used to run the application is the WSGI server provided by eventlet, since it is listed in the requirements. It is needed for the WebSocket protocol to work and avoid falling back to HTTP long polling. Without eventlet, the default Flask WSGI server (Werkzeug) will be used. If you wish to use another WSGI server (e.g. Gunicorn) or use a reverse proxy (e.g. NGINX), the Flask-SocketIO documentation explains how to do that.

II Warning : If you are using Mozilla Firefox to use ThePhish and for some reason an error message appears during the analysis, the solution may be found here . ThePhish can start an analyzer or a responder only if it is enabled and correctly configured on Cortex. This part of the documentation explains how to enable them, while this part lists the available analyzers and responders with their configuration parameters. It should be noted that while many analyzers are free to use, some require special access and others necessitate a valid service subscription or product license.

Each analyzer outputs a report in JSON format that contains a maliciousness level for an observable that can be one of "info", "safe", "suspicious" or "malicious". However, even though the report structure usually follows a convention, this convention is not always respected. Moreover, after the analysis of the code of many analyzers and several tests, some analyzers have been found to contain bugs. For this reason, some tweaks and workarounds have been used either to obtain the maliciousness levels provided by these analyzers anyway or to prevent the application from crashing due to those bugs.

Furthermore, these levels do not always represent the real maliciousness level of an observable. Since this depends on how the analyzers themselves have been programmed, ThePhish comes with another configuration file called analyzers_level_conf.json , with which it is possible to create a mapping between the actual maliciousness levels provided by any analyzer and the levels decided by the analyst. Besides that, this file allows the analyst to choose what are the observable types to which these modifications should be applied. The file needs to follow the structure shown in the example here, using the exact name of the analyzers to configure and with the desired level on the right. If an analyzer is not listed in this file, then the maliciousness levels it provides are left untouched. The file needs to follow the structure shown in the following example, using the exact name of the analyzers to configure and with the desired level on the right. If an analyzer is not listed in this file, then the maliciousness levels it provides are left untouched.

In this example, the level "suspicious" for the MISP_2_1 analyzer is raised to "malicious" since it indicates that some observables in the email being currently analyzed have already been sighted in a previously analyzed email for which the verdict was "malicious". Conversely, the level "malicious" of the DomainMailSPFDMARC_Analyzer_1_1 analyzer is lowered to "suspicious", since many legitimate domains do not have DMARC and SPF records configured.

You can add or remove analyzers in this file at your will, but I recommend that you leave the ones that are already present in the file untouched since those modifications have been motivated by many tests performed on a lot of different emails. The analyzers emphasized in italic are the ones for which the levels have been modified (but that can be overridden, even though it is not advisable), while the analyzers emphasized in bold are the ones that are handled directly in the code of ThePhish either because they do not respect the convention for the report structure, or because they have bugs. Moreover, the following analyzers are handled in the code of ThePhish to use them in the best possible manner: DomainMailSPFDMARC_Analyzer_1_1 : It is started only on domains that are supposed to be able to send emails.

UnshortenLink_1_2 : It is started before any other analyzer on a URL so as to make it possible to unshorten a link and add the unshortened link as an additional observable. In order to integrate Cortex with MISP, you must activate the MISP_2_1 analyzer and configure it with the authentication key of the user created on MISP that Cortex will use to interact with MISP. This means that an organization and a user with sync_user role in that organization must be created on MISP beforehand (you can learn how to do that and obtain the authentication key here (ThePhish documentation, recommended) or here (MISP documentation) .

If you want to use the Yara_2_0 analyzer, you must create a folder on the machine on which Cortex is running that contains: Then, you must configure the path of this folder on Cortex. For example, if you created the folder yara_rules in the path /opt/cortex , then you need to configure the path /opt/cortex/yara_rules on Cortex (on the web interface). In order to send the emails to the users, the Mailer responder must be enabled and correctly configured. The procedure used to enable a responder is identical to the procedure used to enable an analyzer. If you are using a Gmail address, these are the correct parameters to set: ThePhish allows creating a whitelist in order to avoid analyzing observables that may cause false positives or that the analyst decides that they should not be considered during the analysis. The whitelist is contained in a file named whitelist.json and is constituted by many different lists so as to offer great flexibility both in terms of observable types to match and matching modes. It supports the following matching modes: While both the parts related to exact matching and regex matching are used without any modification, the remaining parts are used to create three more lists of regular expressions. It is not required for you to design complex regular expressions to enable those features, but you only need to add the domains to the right lists and ThePhish will do the rest. For instance, in the example shown above, not only the domain "paypal.com" is filtered, but any subdomain, URL and email address containing the domain "paypal.com" is filtered as well. These regular expressions have been designed to avoid some unwanted behaviors, for instance they prevent domains like "paypal.com.attacker.com" to be mistakenly whitelisted.

Note : If you add a domain under "domainsInSubdomains," the domain itself will also be filtered. Therefore, adding the same domain to the list of domains under "exactMatching" is unnecessary. The distinction is made for cases where only the domain needs to be whitelisted, not its subdomains. Thus, in this example, including "paypal.com" in both lists is redundant. The whitelist file which is provided in this repository is already populated with some whitelisted observables, but it is just an example, you can (and should) edit it to suit your needs by removing or adding elements.

Harvested Online Documentation & Reference Sources • https://www.decryptiondigest.com/blog/phishing-email-investigation-workflow • https://github.com/JesseKavungal/phishing-email-analysis • https://forge-work.com/blog/phishing-analysis-methodology.html • https://easydmarc.com/blog/how-to-do-email-analysis-complete-guide/ • https://github.com/emalderson/ThePhish