Respond Phishing

Phishing Incident Response Skill

Structured workflow for responding to reported phishing emails using the PICERL model.

Inputs

• CASE_ID - SOAR case ID for the incident
• ALERT_GROUP_IDENTIFIERS - Alert group identifiers from SOAR
• REPORTED_EMAIL_ARTIFACTS - Information about the email:
  • Email headers
  • Email body
  • Attached files (hashes)
  • URLs in email
  • Recipient user ID(s)
  • Sender address/domain

Required Outputs

After completing each phase, you MUST report these outputs:

Identification Phase

Containment Phase

Eradication Phase

Recovery Phase

PICERL Phases

Phase 2: Identification

Step 2.1: Get Context & Check Duplicates

secops-soar.get_case_full_details(case_id=CASE_ID)

Use /check-duplicates.

Step 2.2: Analyze Email Artifacts

Extract from email:

• All URLs → EXTRACTED_URLS
• Sender domain/IP
• Attachment hashes → EXTRACTED_HASHES
• Reply-to addresses
• Header anomalies (SPF/DKIM failures)

Step 2.3: Enrich Extracted IOCs

For each IOC (URLs, domains, IPs, hashes):

Use /enrich-ioc:

/enrich-ioc IOC_VALUE IOC_TYPE

Identify confirmed malicious IOCs → MALICIOUS_IOCs.

Step 2.4: Categorize Phishing Type

Document: PHISHING_CATEGORY

Step 2.5: Search for Related Activity (SIEM)

secops-mcp.search_security_events(
    text="Network connections or DNS to MALICIOUS_IOCs",
    hours_back=72
)

Look for:

• Other emails with same subject/sender
• URL clicks to malicious URLs
• File executions of malicious hashes
• Suspicious activity from recipients

Step 2.6: Identify Impact

• SIMILAR_EMAIL_RECIPIENTS - Who else received it
• POTENTIAL_COMPROMISED_USERS - Who clicked/interacted
• SUSPICIOUS_ENDPOINTS - Endpoints with related activity

Step 2.7: Document Identification

Use /document-in-case with findings.

Phase 3: Containment

Step 3.1: Block Network IOCs

For each IOC in MALICIOUS_IOCs:

Use /confirm-action:

"Block domain/IP/URL [VALUE]?"

If confirmed, implement blocks at:

• Email gateway
• Web proxy
• Firewall
• DNS

Step 3.2: Contain Potentially Compromised Users

For each user in POTENTIAL_COMPROMISED_USERS:

Trigger /respond-compromised-account

Step 3.3: Isolate Suspicious Endpoints

For each endpoint in SUSPICIOUS_ENDPOINTS:

Use /confirm-action:

"Isolate endpoint [HOSTNAME]?"

Step 3.4: Verify Containment

Monitor for continued activity to blocked IOCs.

Use /document-in-case with containment status.

Phase 4: Eradication

Step 4.1: Delete Malicious Emails

(Requires Email Gateway/Platform tools)

Search all mailboxes for:

• Same subject line
• Same sender
• Contains malicious URLs/attachments

Delete/quarantine identified emails. Document count of emails removed.

Step 4.2: Address Malware (If Applicable)

If phishing led to malware execution: → Trigger /respond-malware

Step 4.3: Document Eradication

Use /document-in-case with email deletion counts and actions.

Phase 5: Recovery

Step 5.1: User Account Recovery

If accounts disabled during containment:

• Verify threat is removed
• Re-enable accounts
• Force password change if credentials potentially compromised

Step 5.2: Endpoint Recovery

If endpoints isolated:

• Verify clean before reconnecting
• Follow malware response recovery if infected

Step 5.3: Validate Countermeasures

After lifting blocks, verify legitimate traffic isn't blocked.

Step 5.4: User Communication

Notify affected users:

• What happened
• Actions taken
• What they should do (change passwords, be vigilant)

Phase 6: Lessons Learned

Use /generate-report with:

• Phishing category
• Impact assessment
• Response timeline
• Emails deleted count
• Recommendations

Conduct review:

• How did it bypass email filters?
• Detection effectiveness
• User awareness gaps
• Recommended filter/rule updates

Critical Warnings

• DO check who else received the email
• DO NOT leave malicious emails in mailboxes
• DO NOT block legitimate business domains (verify first)
• VERIFY extracted domains against company-owned domains list

Phishing Response Checklist

• Email artifacts analyzed
• IOCs enriched and categorized
• All recipients identified
• Click/interaction assessed
• Malicious IOCs blocked
• Compromised users contained
• Malicious emails deleted from ALL mailboxes
• Users notified
• Report generated