<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-email-incident-response
description: >-
  Implement structured incident response procedures for email-based attacks
  including phishing campaigns, BEC compromise, account takeover, and
  malware delivery. Covers triage, containment, evidence collection,
  eradication, and post-incident hardening.
domain: cybersecurity
subdomain: email-security
tags:
  - incident-response
  - phishing
  - bec
  - containment
  - email-forensics
  - triage
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001", "T1566.002", "T1534", "T1114"]
  tools: [python3, msgextract, oletools, grep, jq]
---

# Implementing Email Incident Response

## Overview

Email remains the primary initial access vector. Effective incident response
requires rapid triage of reported messages, automated IOC extraction, mailbox
search for lateral spread, containment actions (purging, blocking), and
post-incident rule updates. This skill covers the full IR lifecycle for
email-borne threats.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Mail admin access | Mailbox search, message purge, transport rules |
| SIEM integration | Correlate email IOCs with endpoint/network events |
| oletools / msgextract | Attachment analysis and macro extraction |
| Threat intel feeds | Enrich extracted IOCs with reputation data |

## Workflow

### Step 1: Triage Reported Message

```bash
# Extract headers from .eml file
grep -E "^(From|To|Subject|Date|Return-Path|Message-ID|X-Originating-IP):" reported.eml

# Extract URLs from message body
grep -oE 'https?://[^ ">\)]+' reported.eml | sort -u

# Extract attachment hashes
python3 -c "
import hashlib, email, sys
msg = email.message_from_file(open('reported.eml'))
for part in msg.walk():
    fn = part.get_filename()
    if fn:
        data = part.get_payload(decode=True)
        print(f'{fn}: SHA256={hashlib.sha256(data).hexdigest()}')
"
```

### Step 2: IOC Extraction and Enrichment

```python
import re
from typing import Any

def extract_iocs(eml_path: str) -> dict[str, Any]:
    with open(eml_path) as f:
        content = f.read()
    urls = list(set(re.findall(r'https?://[^\s"<>)\]]+', content)))
    domains = list(set(re.findall(r'@([\w.-]+\.\w+)', content)))
    ips = list(set(re.findall(r'\b(?:\d{1,3}\.){3}\d{1,3}\b', content)))
    return {"urls": urls, "domains": domains, "ips": ips}
```

### Step 3: Scope Assessment — Search Mailboxes

```powershell
# Exchange Online — find all recipients of the malicious message
Get-MessageTrace -SenderAddress "attacker@evil.com" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) |
  Select-Object Received, SenderAddress, RecipientAddress, Subject, Status

# Search mailboxes for matching subject/sender
New-ComplianceSearch -Name "Phish-IR-001" -ExchangeLocation All `
  -ContentMatchQuery 'from:attacker@evil.com AND subject:"Urgent Invoice"'
Start-ComplianceSearch -Identity "Phish-IR-001"
```

### Step 4: Containment — Purge and Block

```powershell
# Hard-delete matched messages from all mailboxes
New-ComplianceSearchAction -SearchName "Phish-IR-001" -Purge -PurgeType HardDelete

# Block sender domain at transport layer
New-TransportRule -Name "Block-evil.com" -FromAddressContainsWords "evil.com" `
  -DeleteMessage $true

# Block extracted URLs at gateway/proxy
# Export IOC list for firewall/proxy block
```

### Step 5: Post-Incident Hardening

```bash
# Update DMARC policy to reject if not already enforced
dig TXT _dmarc.example.com +short

# Add Sigma detection rule for observed pattern
cat <<'EOF'
title: Phishing Campaign IOC Match — Sender Domain
id: a1b2c3d4-5678-9012-abcd-ef0123456789
status: experimental
description: Detects emails from domains observed in recent phishing campaign
logsource:
  category: email
  product: exchange
detection:
  selection:
    SenderAddress|endswith:
      - "@evil.com"
      - "@ev1l.com"
  condition: selection
falsepositives:
  - Legitimate correspondence with similarly named domains
level: high
tags:
  - attack.t1566.001
  - attack.initial_access
EOF
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Mass phish delivery | Mail trace | Same sender/subject to many recipients |
| User-reported phish | Abuse mailbox | Reported messages matching known IOCs |
| Post-purge redelivery | Transport logs | Attacker resending after block attempt |

```yaml
title: Email Incident Response Detection
id: 04401d4a-e229-4fb7-8c66-6a84026068c6
status: experimental
description: Detects suspicious activity related to implementing email incident response techniques in email security context
logsource:
  category: email
  service: exchange
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: medium
tags:
  - attack.t1566.001
  - attack.t1566.002
  - attack.t1534
  - attack.t1114
  - attack.initial_access
falsepositives:
  - Bulk email migration by authorized IT administration tools
```

## Verification

- [ ] Triage workflow extracts headers, URLs, and attachment hashes
- [ ] IOC extraction automated and feeds threat intel platform
- [ ] Mailbox search identifies all affected recipients
- [ ] Malicious messages purged from all mailboxes
- [ ] Transport rules block sender and related IOCs
- [ ] Post-incident detection rules deployed

## References

- [NIST SP 800-61 — Computer Security Incident Handling](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)
- [MITRE T1566 — Phishing](https://attack.mitre.org/techniques/T1566/)
- [Microsoft — Content Search and Purge](https://learn.microsoft.com/en-us/purview/ediscovery-content-search)

---
v1.0 | Validated: 2026-03-18
