Email Playbook — Phishing, BEC, and AiTM Triage

Email is the most common initial access vector in enterprise incidents. The email playbook teaches you to analyze a suspicious email from headers to attachments, classify it accurately, and write a containment ticket that security engineering can act on.

The Email Pivot Chain

Email alert fires (or user reports suspicious email)
│
├─► Header analysis: From, Reply-To, Return-Path, Received chain
│
├─► SPF / DKIM / DMARC: pass / fail / softfail / neutral
│
├─► Sender reputation: domain age, WHOIS, VT, domain category
│
├─► Link analysis: defang, follow redirects (safe environment only), VirusTotal
│
├─► Attachment analysis: hash, VT, sandbox detonation
│
├─► Mailbox actions: did the user interact? Any mailbox rules created?
│
└─► Identity correlation: any sign-in anomalies after email delivery?

Step 1–2: Header Analysis

Headers are read bottom-up — the bottom Received header is where the email first entered the internet. Read upward to trace the path.

The Received chain:

Received: from mail.attacker.com (mail.attacker.com [45.33.32.156])
  by mx.corp.com with ESMTP; Wed, 14 Aug 2024 09:21:03 +0000

Received: from [192.168.1.5] (attacker-laptop)
  by mail.attacker.com with ESMTPA; Wed, 14 Aug 2024 09:20:55 +0000

Reading the chain: The outermost Received (at the top) is added by YOUR mail server. The innermost (at the bottom) is the origin. Work backward from the bottom.

Key fields to read:

Step 3: SPF / DKIM / DMARC Interpretation

SPF verdicts:

• pass: sending IP is authorized for the envelope-from domain ✓
• fail: sending IP is NOT authorized — likely spoofed envelope sender ✗
• softfail: sending IP is not authorized but DMARC policy may still quarantine/accept
• neutral: domain owner hasn’t expressed a policy
• none: no SPF record exists

DMARC verdicts:

• pass: SPF or DKIM passed AND the From: domain aligns with the authenticated domain ✓
• fail: neither SPF nor DKIM passed with alignment — triggers DMARC policy action

The DMARC/SPF false-positive: forwarding. When a user’s email is forwarded by a third party (forwarding service, secretary, alumni mail), the forwarding breaks SPF (the forwarding server isn’t in the original sender’s SPF record) and may break DKIM. SPF/DKIM failures from forwarded legitimate email are common FPs. Check: is this email forwarded (does the Received chain show a forwarding service)?

BEC Indicators Checklist

Business Email Compromise (BEC) is email fraud targeting wire transfers, W-2 data, or credential harvesting from executives or finance employees. The indicators:

AiTM: When DMARC Passes and MFA Completes

AiTM phishing is the hardest email threat class because:

1. The phishing link goes to a legitimate-looking reverse proxy — the certificate is valid, the content is the real IdP login page
2. The user completes MFA — because the proxy forwards the MFA challenge from the real IdP
3. The attacker captures the post-MFA session token

What AiTM looks like in email: Usually a credential-harvest phishing lure (SharePoint link, Microsoft login page, DocuSign) that redirects through a proxy. The URL itself may look like a legitimate service (OneDrive sharing link with a redirect parameter).

What AiTM looks like in identity logs (after the click):

• User’s Entra sign-in shows successful authentication with MFA from a suspicious IP (not the user’s known IP)
• Within minutes: MailItemsAccessed from the same suspicious IP (attacker reading mail)
• New-InboxRule created (attacker setting up forwarding)
• OAuth consent to a suspicious application