October 20, 2026
I Investigated a Phishing Alert. The Email Was Only the Beginning
Learn how SOC analysts investigate phishing emails, malicious links, credential theft, and possible account compromise.
By Manubhav Sharma
2 min read
A phishing investigation does not end when you identify a suspicious email.
The email is only the starting point.
The more important question is:
"What happened after the user received or interacted with it?"
A phishing email may lead to:
- Credential theft
- Malware execution
- Unauthorized mailbox access
- Malicious forwarding rules
- Session hijacking
- Business email compromise
Here is how I would investigate it.
1. Preserve the original email
Collect:
- Sender address
- Recipient address
- Subject
- Timestamp
- Email headers
- URLs
- Attachments
- Reply-to address
- Authentication results
Do not rely only on the visible sender name.
An email may appear to come from a trusted company while using a different underlying address.
2. Analyze the URL
Check:
- The visible URL
- The actual destination
- Redirects
- Domain age and reputation
- Typosquatting
- URL shorteners
- Whether the page requests credentials
- Whether the page imitates a legitimate login portal
Do not open suspicious links directly from a production system.
Use approved analysis tools and safe procedures.
3. Check whether the user clicked
If telemetry is available, look for:
- Browser activity
- Proxy logs
- DNS requests
- Endpoint alerts
- URL click events
- Authentication events
A delivered phishing email is different from a clicked phishing email.
4. Check whether credentials were submitted
If the user entered credentials, investigate:
- Authentication attempts
- New device registrations
- Unusual locations
- Multi-factor authentication activity
- Session creation
- Password changes
- Mailbox rule changes
- Access to sensitive resources
Credential submission should be treated seriously even if no malware was downloaded.
5. Search for similar emails
Look for:
- Same sender
- Same subject
- Same URL
- Same attachment hash
- Similar wording
- Other targeted users
This helps determine whether the incident affected one person or many.
6. Investigate endpoint activity
If a file was downloaded or opened, check:
- Process creation
- Parent-child process relationships
- File creation
- Script execution
- Network connections
- Persistence mechanisms
- Security product alerts
The email may be malicious, but the endpoint evidence determines what happened next.
7. Recommend response actions
Depending on the findings, actions may include:
- Removing the email from mailboxes
- Blocking the sender or domain
- Blocking the URL
- Resetting credentials
- Revoking sessions
- Enforcing multi-factor authentication
- Isolating the endpoint
- Escalating the incident
Final thought
Phishing investigation is not just email analysis.
It is identity analysis, endpoint analysis, network analysis, and timeline analysis combined.
Take one sample phishing email and create an investigation checklist covering the email, URL, user, endpoint, and post-click activity.
If you want to practise this kind of thinking before your first role, my Cybersecurity Foundations course is built around exactly this. Real scenarios, investigation-first, no tool tutorials.
👉 Cybersecurity Foundations Course
Want me to review your resume or talk through where you're stuck?
👉 SOC Resume Review 👉 Career Clarity Call
For a weekly breakdown on real SOC workflows and how to prepare for them:
— Manubhav Sharma Threat Analyst at Sophos · Follow on LinkedIn