investigating-phishing-email-incident

调查钓鱼邮件事件

适用场景

在以下情况下使用此技能：

• 用户通过钓鱼邮件举报按钮或服务台工单报告可疑邮件
• 电子邮件安全网关标记出绕过初始筛选的邮件
• 自动检测发现了窃取凭据的 URL 或恶意附件
• 针对组织的钓鱼活动需要评估影响范围

不要用于没有恶意意图的垃圾邮件或营销邮件——将其转交电子邮件管理团队调整筛选规则。

前提条件

• 可访问电子邮件网关日志（Proofpoint、Mimecast 或 Microsoft Defender for Office 365）
• 已接入电子邮件日志（O365 Message Trace、Exchange 跟踪日志）的 Splunk 或 SIEM
• 可访问沙箱（Any.Run、Joe Sandbox 或 Hybrid Analysis），用于引爆 URL／附件
• Microsoft Graph API 或 Exchange Admin Center，用于电子邮件搜索和清除操作
• URLScan.io 和 VirusTotal API 密钥

工作流

步骤 1：提取并分析电子邮件标头

从被举报的邮件中获取完整电子邮件标头（.eml 文件）：

import email
from email import policy

with open("phishing_sample.eml", "rb") as f:
    msg = email.message_from_binary_file(f, policy=policy.default)

# Extract key headers
print(f"From: {msg['From']}")
print(f"Return-Path: {msg['Return-Path']}")
print(f"Reply-To: {msg['Reply-To']}")
print(f"Subject: {msg['Subject']}")
print(f"Message-ID: {msg['Message-ID']}")
print(f"X-Originating-IP: {msg['X-Originating-IP']}")

# Parse Received headers (bottom-up for true origin)
for header in reversed(msg.get_all('Received', [])):
    print(f"Received: {header[:120]}")

# Check authentication results
print(f"Authentication-Results: {msg['Authentication-Results']}")
print(f"DKIM-Signature: {msg.get('DKIM-Signature', 'NONE')[:80]}")

关键检查项：

• SPF：Return-Path 域是否与发送 IP 匹配？检查是否有 spf=pass 或 spf=fail
• DKIM：签名是否有效？dkim=pass 可确认邮件在传输过程中未被修改
• DMARC：From 域是否与 SPF／DKIM 域对齐？dmarc=fail 表示存在欺骗行为

步骤 2：分析 URL 和附件

URL 分析：

import requests

# Submit URL to URLScan.io
url_to_scan = "https://evil-login.example.com/office365"
response = requests.post(
    "https://urlscan.io/api/v1/scan/",
    headers={"API-Key": "YOUR_KEY", "Content-Type": "application/json"},
    json={"url": url_to_scan, "visibility": "unlisted"}
)
scan_id = response.json()["uuid"]
print(f"Scan URL: https://urlscan.io/result/{scan_id}/")

# Check VirusTotal for URL reputation
import vt
client = vt.Client("YOUR_VT_API_KEY")
url_id = vt.url_id(url_to_scan)
url_obj = client.get_object(f"/urls/{url_id}")
print(f"VT Score: {url_obj.last_analysis_stats}")
client.close()

附件分析：

import hashlib

# Calculate file hashes
with open("attachment.docx", "rb") as f:
    content = f.read()
    md5 = hashlib.md5(content).hexdigest()
    sha256 = hashlib.sha256(content).hexdigest()

print(f"MD5: {md5}")
print(f"SHA256: {sha256}")

# Submit to MalwareBazaar for lookup
response = requests.post(
    "https://mb-api.abuse.ch/api/v1/",
    data={"query": "get_info", "hash": sha256}
)
print(response.json()["query_status"])

提交至沙箱（Any.Run 或 Joe Sandbox），动态分析宏、PowerShell 执行和 C2 回连。

步骤 3：确定活动影响范围

在 Splunk 中搜索所有收到同一封钓鱼邮件的收件人：

index=email sourcetype="o365:messageTrace"
(SenderAddress="[email protected]" OR Subject="Urgent: Password Reset Required"
 OR MessageId="<[email protected]>")
earliest=-7d
| stats count by RecipientAddress, DeliveryStatus, MessageTraceId
| sort - count

或者，使用 Microsoft Graph API：

import requests

headers = {"Authorization": f"Bearer {access_token}"}
params = {
    "$filter": f"subject eq 'Urgent: Password Reset Required' and "
               f"receivedDateTime ge 2024-03-14T00:00:00Z",
    "$select": "sender,toRecipients,subject,receivedDateTime",
    "$top": 100
}
response = requests.get(
    "https://graph.microsoft.com/v1.0/users/[email protected]/messages",
    headers=headers, params=params
)
messages = response.json()["value"]
print(f"Found {len(messages)} matching messages")

步骤 4：识别受影响用户（点击过链接的用户）

检查代理／Web 日志，查找访问过钓鱼 URL 的用户：

index=proxy dest="evil-login.example.com" earliest=-7d
| stats count, values(action) AS actions, latest(_time) AS last_access
  by src_ip, user
| lookup asset_lookup_by_cidr ip AS src_ip OUTPUT owner, category
| sort - count
| table user, src_ip, owner, actions, count, last_access

检查是否提交过凭据（向钓鱼域发送 POST 请求）：

index=proxy dest="evil-login.example.com" http_method=POST earliest=-7d
| stats count by src_ip, user, url, status

步骤 5：遏制措施

从所有邮箱中清除邮件：

# Microsoft 365 Compliance Search and Purge
New-ComplianceSearch -Name "Phishing_Purge_2024_0315" `
    -ExchangeLocation All `
    -ContentMatchQuery '(From:[email protected]) AND (Subject:"Urgent: Password Reset Required")'

Start-ComplianceSearch -Identity "Phishing_Purge_2024_0315"

# After search completes, execute purge
New-ComplianceSearchAction -SearchName "Phishing_Purge_2024_0315" -Purge -PurgeType SoftDelete

阻止指标：

• 将发件人域添加到电子邮件网关的阻止列表
• 将钓鱼 URL 域添加到 Web 代理阻止列表
• 将附件哈希添加到终端检测阻止列表
• 为钓鱼域创建 DNS 黑洞条目

重置已泄露的凭据：

# Force password reset for impacted users
$impactedUsers = @("[email protected]", "[email protected]")
foreach ($user in $impactedUsers) {
    Set-MsolUserPassword -UserPrincipalName $user -ForceChangePassword $true
    Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser -ObjectId $user).ObjectId
}

步骤 6：记录并报告

创建事件报告，记录完整时间线、IOC、受影响用户和已采取的修复措施。

| makeresults
| eval incident_id="PHI-2024-0315",
       reported_time="2024-03-15 09:12:00",
       sender="attacker@evil-domain[.]com",
       subject="Urgent: Password Reset Required",
       url="hxxps://evil-login[.]example[.]com/office365",
       recipients_count=47,
       clicked_count=5,
       credentials_submitted=2,
       emails_purged=47,
       passwords_reset=2,
       domains_blocked=1,
       disposition="True Positive - Credential Phishing Campaign"
| table incident_id, reported_time, sender, subject, url, recipients_count,
        clicked_count, credentials_submitted, emails_purged, passwords_reset, disposition

关键概念

术语	定义
SPF (Sender Policy Framework)	DNS TXT 记录，用于指定哪些邮件服务器获准代表某个域发送邮件
DKIM	DomainKeys Identified Mail——一种加密签名，用于证明邮件内容在传输过程中未被篡改
DMARC	Domain-based Message Authentication, Reporting and Conformance——一种基于 SPF 和 DKIM 对齐情况制定策略的机制
凭据窃取	一种钓鱼技术，通过伪造登录页面获取用户名／密码组合
商业电子邮件入侵 (BEC)	一种社会工程攻击，通过入侵或伪造高管电子邮件实施金融欺诈
Message Trace	O365／Exchange 日志，显示电子邮件路由、投递状态和筛选操作，可用于取证分析

工具与系统

• Microsoft Defender for Office 365：电子邮件安全平台，提供 Safe Links、Safe Attachments 和 Threat Explorer，便于调查
• URLScan.io：免费的 URL 分析服务，可捕获屏幕截图、DOM、Cookie 和网络请求
• Any.Run：交互式沙箱，可引爆恶意文件和 URL 并实时分析行为
• Proofpoint TAP：Targeted Attack Protection 仪表板，显示每位用户点击的 URL 和收到的威胁
• PhishTool：专用钓鱼邮件分析平台，可自动解析标头并提取 IOC

常见场景

• 凭据钓鱼：伪造的 O365 登录页面——检查代理中的 POST 请求，并强制要求提交者重置密码
• 启用宏的文档：带有 VBA 宏的 Word 文档——沙箱显示 PowerShell 下载器，检查终端是否执行过相关命令
• 二维码钓鱼（Quishing）：电子邮件包含指向凭据窃取页面的二维码——解码二维码，并将 URL 提交到沙箱
• 邮件线程劫持：攻击者利用已被攻陷的邮箱在现有邮件线程中回复——检查是否存在不可能的旅行记录或新建的收件箱规则
• 语音邮件钓鱼：带有 HTML 附件的虚假语音邮件通知——分析附件中的重定向链

输出格式

PHISHING INCIDENT REPORT — PHI-2024-0315
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Reported:     2024-03-15 09:12 UTC by jsmith (Finance)
Sender:       attacker@evil-domain[.]com (SPF: FAIL, DKIM: NONE, DMARC: FAIL)
Subject:      Urgent: Password Reset Required
Payload:      Credential harvesting URL

IOCs:
  URL:        hxxps://evil-login[.]example[.]com/office365
  Domain:     evil-login[.]example[.]com (registered 2024-03-14, Namecheap)
  IP:         185.234.xx.xx (VT: 12/90 malicious)

Scope:
  Recipients: 47 users across Finance and HR departments
  Clicked:    5 users visited phishing URL
  Submitted:  2 users entered credentials (confirmed via POST in proxy logs)

Containment:
  [DONE] 47 emails purged via Compliance Search
  [DONE] Domain blocked on proxy and DNS sinkhole
  [DONE] 2 user passwords reset, sessions revoked
  [DONE] MFA enforced for both compromised accounts
  [DONE] Inbox rules audited — no forwarding rules found

Status:       RESOLVED — No evidence of lateral movement post-compromise