Phishing Playbook - Manual

Master playbook for phishing incidents. This playbook is a manual playbook.

Phishing · 36 tasks · 0 inputs · 0 outputs

Flowchart

no yes no yes no yes yes yes start_task start_task Engage Engage Notify management chain Notify management chain Initial triage Initial triage Investigation Step 1: Initial Inspection Investigation Step 1: Ini... Inspect the email body for malicious URLs Inspect the email body fo... Inspect the email attachments Inspect the email attachm... Is the sender name or email address identified as bad by threat feeds? Is the sender name or ema... Check if the hostname is being misrepresented? Check if the hostname is ... Is this a real phishing email? Is this a real phishing e... Close the investigation as false positive Close the investigation a... Assess severity Assess severity Assign and involve appropriate personnel Assign and involve approp... Investigation Step 2: Deeper Analysis Investigation Step 2: Dee... Get all the URLs from the email Get all the URLs from the... Get all the hostnames inside the email Get all the hostnames ins... Fetch all the files from the URL Fetch all the files from ... Are the files download malicious - hash inspection? Are the files download ma... Are the files download malicious - static and dynamic analysis? Are the files download ma... Is any URL malicious based on sandbox inspection? Is any URL malicious base... Consider this email as phishing and move to "Response Section" Consider this email as ph... Consider this email as phishing and move to "Response Section" Consider this email as ph... Consider this email as phishing and move to "Response Section" Consider this email as ph... Investigation Step 3: Is it a Campaign? Investigation Step 3: Is ... Did we have a similar phishing email earlier? Did we have a similar phi... Mark this as a campaign rather than isolated incident. Mark this as a campaign r... Link old and new incidents to this master incident. Link old and new incident... Respond Respond Notify internal PR team if this is a campaign Notify internal PR team i... Block email on the server Block email on the server Notify IT to update SPAM filters Notify IT to update SPAM ... Notify email security vendor Notify email security vendor Remove email from inboxes Remove email from inboxes Blackholing phishing domain on Domain Controller Blackholing phishing doma... Blocking download URL Blocking download URL Report malware sample to AV vendors Report malware sample to ...