Phishing Playbook - Automated Deprecated Hidden

Deprecated. We recommend using Phishing investigation - Generic playbook instead. This is an automated playbook to investigate suspected Phishing attempts. It picks up the required information from the incident metadata as created by the mail listener. Labels: - Email/from: Email address of the user targeted by the suspected phishing attempt, who reported the email by forwarding it - Email: the to recipients - Email/cc: the cc recipients - Email/format: the format of the email - text / html / etc. - Email/html: the html body - Email/text: the text body - Email/subject: subject of the email - Email/attachments: list of attachments - Email/headers: the headers for the email

Deprecated Content (Deprecated) · 31 tasks · 1 input · 0 outputs

Inputs

  • CompanyDomains — The domains for the company to try and match closeness of sender. Comma separated.

Flowchart

yes yes yes no yes no yes start_task start_task Triage and Engage Triage and Engage Auto-respond to acknowledge receipt - SendEmail Auto-respond to acknowled... SendEmail Extract IP Addresses from email - ExtractIP Extract IP Addresses from... ExtractIP Extract URLs from email - ExtractURL Extract URLs from email ExtractURL Is the attachment malicious according to Sandbox report? Is the attachment malicio... Manual Investigation Step 1: Initial Inspection Manual Investigation Step... Check sender domain distance - CheckSenderDomainDistance Check sender domain distance CheckSenderDomainDistance Manually inspect the email for anything suspicious Manually inspect the emai... Assign and involve appropriate personnel Assign and involve approp... Assess severity Assess severity Manual Investigation Step 2: Deeper Inspection Manual Investigation Step... Check if the hostname in urls is being misrepresented? Check if the hostname in ... Response Response Send email to user notifying them this email is safe - SendEmail Send email to user notify... SendEmail Close the phishing investigation - CloseInvestigation Close the phishing invest... CloseInvestigation Send email to user notifying them it's a malicious email - SendEmail Send email to user notify... SendEmail Did we find an attachment inside the email and extract its hash? - Exists Did we find an attachment... Exists Investigate further Investigate further Extract indicators Extract indicators Check indicators Check indicators Was any malicious indicator found? - IsMaliciousIndicatorFound Was any malicious indicat... IsMaliciousIndicatorFound Is the distance really small - Exists Is the distance really small Exists Review all results and decide should we close investigation Review all results and de... Store the sending account - Set Store the sending account Set 97 - Enrichment Playbook 97 Enrichment Playbook 98 - Account Enrichment 98 Account Enrichment 99 - Process Email 99 Process Email 100 - Detonate File - Generic 100 Detonate File - Generic 101 - Hunt for bad IOCs 101 Hunt for bad IOCs Search for the malicious email in other mailboxes Search for the malicious ...