Triaging a reported phishing message

Treat every report as real until the evidence says otherwise. The cost of

investigating a legitimate email is a few minutes; the cost of dismissing a real one

can be a payment run.

First ten minutes

1. Ask whether anyone interacted. Did they click, enter credentials, approve an

MFA prompt, open an attachment, or reply? This decides whether you are triaging a

message or responding to a compromise.

1. Preserve the message. Do not have the user delete it. You need the headers.
2. Trace it. Find every recipient — a phishing message is rarely sent to one

person. That list is the blast radius.

1. Read the authentication results. SPF, DKIM, DMARC and compauth in the

headers usually settle authenticity in seconds.

1. Check for a lookalike domain. contoso.com versus cont0so.com or

contoso-invoices.example. Display names are free to set and prove nothing.

Signals that raise it to an incident

• Anyone entered credentials or approved an unexpected MFA prompt.
• The message came from an internal mailbox — that is a compromise, not phishing.
• It asks to change bank or remittance details.
• Recipients include finance, payroll, or executives.
• A matching message was sent to many users in a short window.

Any of these: escalate to the security team now, and start containment in parallel

rather than after.

If nobody interacted

• Purge the message from all recipient mailboxes.
• Block the sender or domain if it has no legitimate use.
• Report it to Microsoft so the filters learn.
• Reply to the reporter and thank them specifically. People who get thanked report

the next one; people who get silence stop reporting.

If somebody did interact

Move straight to Responding to a compromised account. Do not wait for confirmation

that damage occurred — containment is cheap and reversible, and a stolen session

token is being used right now, not later.

What not to do

• Do not forward the suspicious message around as an attachment-free copy and lose

the headers.

• Do not tell the user "it's just spam, delete it" without tracing recipients.
• Do not release anything similar from quarantine while an investigation is open.
• Do not reply to the sender to test whether they are real.

Related

• Quarantine, SPF, DKIM and DMARC
• Responding to a compromised account
• Running a message trace