ASF-GitBook
CtrlK
LinkedInX (ex-Twitter)
ENGLISH
ENGLISH
  • PRESENTATION
  • Cloud/SysOps
    • Securing your AWS Infrastructure
      • ABOUT
      • DISCLAIMER
      • IN CASE OF SECURITY PROBLEMS
      • AUTHENTIFICATION
      • ACCOUNT MANAGEMENT
      • DATABASE
      • ENCRYPTION
      • LOGS - AWS CloudTrail
    • Send_email_with_RSS_feed_content
      • Script (powershell)
    • Count_how_many_actives_users_service_account
      • Active Directory
      • Azure AD
    • Active Directory Tiering
      • What is the tiering ?
      • ADVANTAGES / DISADVANTAGES
      • Presentations
      • ADMINISTRATION
      • Practical exercice : LetsDefend
      • Documentations
  • Asset Security
    • Securing your BIOS / UEFI
      • ABOUT
      • DEFINITIONS
      • GPO AND INTUNE
      • LIST OF RECOMMANDATIONS
        • GENERIC RECOMMANDATIONS
        • PROTECTIONS
        • VIRTUALISATION
        • WAKE UP
        • NETWORK COMMUNICATION
        • CONFIGURATION OF EQUIPMENT
        • HEALTHCHECK
        • UPDATE AND DOWNGRADE
        • COMPUTRACE
    • Smartphones_configuration
      • ABOUT
      • UPDATE (ANDROID / IPHONE)
      • ENABLE SCREEN LOCK WITH A PASSCODE / PATTERN / FINGERPRINT (ANDROID / IPHONE)
      • ENABLE ENCRYPTED BACKUP (ANDROID / IPHONE)
      • DISPLAY A MESSAGE ON THE LOCK SCREEN (ANDROID / IPHONE)
      • ENSURE DEVELOPER MODE IS DISABLED (ANDROID / IPHONE)
      • DISALLOW INSTALLATION OF UNKNOWN APPS (ANDROID)
      • DO NOT ROOT THE PHONE (ANDROID / IPHONE)
      • USE NETWORK-PROVIDED TIME (ANDROID / IPHONE)
      • ENABLE REMOTE LOCATION OF THE PHONE (ANDROID / IPHONE)
      • ENABLE REMOTE LOCK AND ERASE (ANDROID / IPHONE)
      • ENABLE GOOGLE SCAN ON THE PHONE (ANDROID)
      • DISABLE WI-FI ASSISTANT (ANDROID)
      • DISABLE / REMOVE USER ADDITION FROM THE LOCK SCREEN (ANDROID)
      • DISABLE INSTANT APPS (ANDROID)
      • DISABLE BLUETOOTH
      • DO NOT USE KEYBOARD APPS
      • DO NOT DISPLAY NOTIFICATIONS ON THE LOCK SCREEN (ANDROID/IPHONE)
      • DISABLE SIRI WHEN THE PHONE IS LOCKED (IPHONE)
      • DISABLE CONTROL CENTER FROM THE LOCK SCREEN (IPHONE)
      • ENABLE FRAUD PROTECTION (IPHONE)
  • GRC
    • Vulnerability Management Basics
      • DEFINITIONS
      • EXERCICE PRATIQUE - LECTURE D'UNE CVE FORTI DE JUIN CVE CVE-2023-27997
      • VULNERABILITY MANAGEMENT LIFECYCLE
    • Ready_for_cyber_disaster
      • ABOUT
      • Inventory
      • Backups
      • Phishing prevention
      • Internet browsing protection
      • Patching
      • Access control
      • Risk analysis
      • Network
      • Incident Response
      • Summary statement
      • Read more
    • Cyber threat mapping
      • OBJECTIVE
      • PRIORITIZATION TABLE
      • MITRE ATT&CK
        • INDICATOR OF COMPROMISE
      • ATTACK FLOW PROJECT: CREATING THE ATTACK DIAGRAM
      • MITRE D3FEND
      • VERIFY THE CAPABILITIES OF YOUR EDR/XDR
      • CVE2CAPEC: CVE AND MITRE MAPPING
    • Be prepare for Cybercrises
      • Definitions
      • To note
      • Preparation
      • Prepare response cells
        • Management Cell
        • Ops Cell
      • Expected from the Operational cell
      • Backups
      • Alerts
      • End of crisis
  • Security Assessment and Testing
    • Newsletter_CVE
      • ABOUT
      • FLOWCHART
      • WHY THIS SCRIPT?
      • PREREQUISITES
      • ADDITIONAL SCRIPTS
      • CVEMAP
      • SCRIPT EXECUTION
      • EXECUTE THE SCRIPT (MONTHLY CRONTAB)
      • SCRIPT
    • CISA_KEV_Alert_Script
      • WHY ONLY THESE VULNERABILITIES?
      • SCRIPT DESCRIPTIONS
      • USING THE SCRIPT
      • DOCUMENTATIONS
    • Create a SOC lab
      • PURPOSE
      • SOFTWARES
      • 01-PFSENSE
      • 02-ActiveDirectory
      • 03-Windows_Workstation
      • 04-Sysmon
      • 05-CROWDSEC
      • 06-SPLUNK
  • FORENSICS
    • IR playbook
      • Denial Of Service
      • Impossible Travel
      • Large Upload
      • Malicious URL
      • Malware
      • Phishing
      • Ransomware
    • Investigate Phishing
      • Why fighting phishing is important?
      • Why is blocking the sender not enough?
      • Process Overview
      • Prerequisites
        • Analysis of the email code
      • What to do now that we know the email is malicious?
      • Feedback
      • Tools
      • Report the email to the authorities
      • Go further
  • INCIDENT HANDLING
    • TweetFeed Jira Check
      • OBJECTIVE
      • SCRIPT ACTION DIAGRAM
      • Using the script
      • Script (python)
    • Rebuild_your_AD_after_compromise
      • Definitions
      • CHRONOLOGY
      • USUAL MODUS OPERANDI OF RANSOMWARE
      • LIST OF ACTIONS TO TAKE
        • NETWORK
        • STOP THE DEPLOYMENT OF ENCRYPTION
        • BUILD THE NEW DOMAIN
        • CERTIFICATE
        • HARDENING YOUR NEW INFRASTRUCTURE
        • TIER MODEL / ENTERPRISE ACCESS MODEL
      • FLOWCHART
    • Restore AD without third party software
      • Purpose
      • BACKUP FONCTIONALITY
      • SNAPSHOT
      • RECYCLE BIN
      • VMDK / VHD and 7zip
      • CONCLUSION
      • SOURCES
    • Windows-Emergency-update-out-of-WSUS-schedule
      • Requirments
      • Présentation
      • Computer in Active Directory
        • Solution 1 : Scheduled task with automatic execution
        • Solution 2: At reboot
      • Computer out of Active Directory
      • Deployment control using SIEM
      • Post-Deployment
      • SOURCES
    • OS for Blue Team work
      • Roles and Their Requirements
      • Overview of Distributions by Use Case
      • Windows Subsystem for Linux (WSL)
      • Distribution Mapping by Profile
  • UNIVERSITAIRES (unis)
    • Books CTI Fundamentals
      • CTI Theory
      • Practical Threat Intelligence
      • Enterprise Threat Intelligence
    • Security Certification Roadmap
Powered by GitBook
On this page
  1. FORENSICS

Investigate Phishing

Process and tool for investigating a malicious email

Why fighting phishing is important?Why is blocking the sender not enough?Process OverviewPrerequisitesWhat to do now that we know the email is malicious?FeedbackToolsReport the email to the authoritiesGo further
PreviousRansomwareNextWhy fighting phishing is important?