Safely Analyzing Phishing Emails with Trusted Tools

Have you ever felt that sinking feeling when you realize you might have just opened a phishing email? Welcome to the club! 🎣 It’s like a rite of passage in the digital age.

If you haven’t been targeted by at least one phishing attack, are you even really using the internet? 🤔

But don’t worry, I’ve got you covered. Let’s dive into my personal toolkit for safely analyzing those pesky phishing emails — because who doesn’t love to be prepared?

MITRE ATT&CK Framework Exploration 🎣🔍

The tactics and techniques representing the MITRE ATT&CK® Matrix for Enterprise

Phishing: T1566

Sub-techniques: T1566.001, T1566.002, T1566.003, T1566.004

Action varieties in Social Engineering incidents

According to the Verizon 2023 Data Breach Investigations Report (DBIR), phishing now makes up 44% of social engineering incidents. So, if you’ve ever felt like you’re the only one getting those weird emails, fear not — you’re definitely not alone in dealing with this modern digital menace!

Spotting Suspicious Emails

1. Check the Sender’s Email Address: Look closely at the sender’s email address. Often, phishing emails use spoofed or slightly altered addresses that mimic legitimate ones.
2. Look for Generic Greetings or Salutations: Phishing emails often use generic greetings like “Dear Customer” instead of addressing you by name. Legitimate organizations usually personalize their communications.
3. Verify Links Before Clicking: Hover your mouse over any links in the email (without clicking) to see the actual URL. Check for misspellings or strange domains that don’t match the organization’s website.
4. Watch for Urgency or Threats: Phishing emails often create a sense of urgency, threatening consequences if you don’t act immediately. Be cautious of emails demanding urgent action.
5. Review the Email Content for Errors: Phishing emails often contain grammatical errors, spelling mistakes, or awkward language. Legitimate communications from reputable organizations are usually well-written and error-free. Although, with AI getting better at writing, this might not be as reliable as it used to be! 🤖📧
6. Be Cautious of Attachments: Avoid opening attachments from unknown senders or unexpected emails. They could contain malicious software or links.

So, here you are!

An example of a suspicious or altered email

Alright, enough theory for now — let’s dive into the tools!

Email Header Analysis

Tools Utilized for Analysis: MX toolbox, Message Header Analyzer

The SMTP envelope header contains essential information about the email’s origin, including the IP address and domain of the sending server. This helps trace the physical source of the email, which can be critical in identifying the true sender in cases of spoofing or impersonation.
Depending on your email service or client, find the option to view message details or email headers. This is typically found under options like “View,” “More,” or “Message Details.”

How to get email headers in Outlook

How to get email headers in Gmail

To analyze the SMTP envelope headers you’ll need to copy the email headers and paste them into the MX toolbox.
Result:

For the standalone Message Header Analyzer, you also need to copy-paste the headers. However, it can also be installed as an Outlook add-in, making life easier by reducing the amount of copying and pasting you need to do. Let’s be honest, anything that reduces the need for more copy-pasting is a win!

URLs Analysis

Tools Utilized for Analysis: Zulu ZScaler, Virus Total

Zscaler uses various techniques such as URL filtering, malware detection, SSL inspection, and sandboxing to analyze and mitigate potential threats in real-time.

VirusTotal is a free online service that analyzes files and URLs to detect viruses, worms, trojans, and other types of malicious content using multiple antivirus engines and URL scanners. VirusTotal leverages a large number of antivirus engines and URL scanners (currently over 70) from various cybersecurity companies. Each engine uses its own algorithms and virus definitions to detect malware. When a file or URL is submitted, VirusTotal distributes the content to these scanning engines simultaneously.

Result:

Attachments Analysis

Tools Utilized for Analysis: Virus Total, Hybrid Analysis

Analyzing attachments from phishing emails without downloading them directly to your local machine is crucial for maintaining security. Malicious attachments can contain harmful software that, once downloaded, can instantly infect your device. This malware can then spread across networks, potentially compromising multiple devices.

To safely analyze email attachments, consider using online analysis tools such as Virus Total or Hybrid Analysis. Alternatively, use a sandbox environment or virtual machine specifically designed for testing suspicious files, ensuring any potential threats are contained and isolated from your main system.

Another option is to use MD5Hash in combination with Virus Total search.

For instance, imagine you receive a sensitive document containing financial records via email. Before opening or sharing this file, you can calculate its MD5 hash locally. By submitting this hash to Virus Total, you can quickly determine if the document has been flagged as malicious by antivirus engines and security tools without exposing its contents.

Evaluating the Sending Domain Reputation

Tools Utilized for Analysis: CISCO Talos Intelligence

Assessing the reputation of the sending domain helps to determine the trustworthiness of the sender and can prevent potential phishing or malware attacks. By checking the sending domain’s reputation, organizations can take proactive measures to block or filter out emails from these suspicious sources. Adding such blacklisted domains to the corporate network’s blocklist can further protect against known threats, ensuring that employees do not interact with potentially harmful emails.
Result:

Enhancing Email Security with S/MIME Certificates

To further protect yourself against phishing attacks, consider using S/MIME (Secure/Multipurpose Internet Mail Extensions) certificates. S/MIME provides a way to send and receive e2e encrypted and digitally signed emails, ensuring that the content of your emails remains confidential and tamper-proof.

S/MIME works by using a pair of cryptographic keys: a public key and a private key. The public key is shared with others to encrypt emails sent to you, while the private key is kept secure on your device to decrypt received emails.

Image sourced from Microsoft: Digital signing and encrypting of an e-mail message.

Image sourced from Microsoft: Decrypting an e-mail message and verifying a digital signature

Conclusion

By utilizing these tools and techniques, you can effectively analyze and mitigate phishing threats. From scrutinizing email headers to evaluating domain reputations and leveraging S/MIME certificates, every step enhances your security posture.

Stay safe and happy phishing-spotting! 🌐🔍🚫 And don’t forget to report phishing attempts to your IT department or email provider to help others stay safe too.