How to Conduct a Phishing Email Investigation

Course details

According to the email security platform GreatHorn, phishing is the number one threat vector of all online breaches. But what exactly is a phishing attack, how do you identify it, and what can you do to better protect yourself, your data, and your organization? In this course, join instructor Bennett Hendrix to learn how to conduct an email investigation and identify phishing attacks, regardless of your technical background or level of experience. Explore the wide variety of indicators of an attack, analyze information collected from emails, determine a verdict, and implement a tactical, preventative approach. Along the way, discover how to leverage helpful email security resources and OSINT tools to improve your overall response.

Concepts

0. Introduction

01 - Conduct a professional phishing investigation
02 - Why email investigations matter

1. Knowing What to Look For

03 - Phishing vs. spam
04 - Phishing indicators

2. Collecting Information from the Email

05 - Analyze an email header
06 - Sender domain
07 - Email authentication - SPF, DKIM, and DMARC
08 - Step-by-step process

3. Analyzing the URL or File Collected

09 - URL and IP analysis
10 - File analysis
11 - Challenge - Which artifact(s) is suspicious
12 - Solution - Which artifact(s) is suspicious

4. Putting Everything Together

13 - Email investigation header walk-through
14 - Domain reputation investigation walk-through
15 - Challenge - Putting it all together
16 - Solution - Putting it all together

Conclusion

17 - More cybersecurity tools and tips