<aside> 🚨

This process ensures IT can handle phishing reports effectively while leveraging expert cybersecurity support from Kmicro SOC.

</aside>

When the IT Dept receives a phishing report, they should follow these steps to triage and escalate effectively:

1. Acknowledge Receipt

• Send a quick acknowledgment to the reporting staff member to confirm their email was received (e.g., “Thank you for reporting this. We are reviewing the issue.”).

<aside> ⏩

If a ticket has not already been created, have the reporter run /assist in Slack and attach the original email as a .eml. Ping @Assist or @tate. Do not email a leftover helpdesk address.

</aside>

2. Perform Basic Checks

• Examine the Email Headers:
  • Verify the sender’s IP address and domain.
  • Look for spoofing signs or mismatched domains.
• Check Links or Attachments (Safely):
• DO NOT click links or open attachments directly.
  • Use a secure sandbox or tools like VirusTotal to scan URLs or attachments.
• Identify Patterns:
  • Determine if this email is part of a larger phishing campaign targeting other users in the organization.

3. Search for Impact Across the Organization

• Use your email gateway logs to identify if other staff members have received the same email.
• Check for any reports of unusual activity in related accounts (e.g., failed logins, suspicious access).

4. Forward to Cybersecurity Experts

• After completing the above checks, escalate to your cybersecurity team at [email protected].
• Attach the original email (use “Forward as Attachment” to preserve metadata).
• Include a summary of your findings:
• Sender’s email address and domain.
• Suspicious links or attachments.
• Whether other employees received similar emails.
• Any potential indicators of compromise (IOC).

5. Contain and Mitigate

While waiting for SOC feedback, take proactive steps to minimize risk:

• Block the Sender’s Email Address:
  • Use the email security platform to blacklist the sender or domain.
• Warn Staff (If Necessary):
  • Send an advisory to staff if the phishing campaign appears widespread (e.g., “Do not open emails with the subject line ‘Urgent Invoice.’”).
• Monitor Systems for Unusual Activity:
  • Keep an eye on logs for suspicious login attempts or data transfer.

6. Follow SOC Guidance

Once SOC responds:

• Implement their recommendations, such as blocking domains, resetting credentials, or initiating further incident response steps.
• Update internal documentation with any newly identified IOCs or preventive measures.

7. Log and Close the Ticket

• Document the incident in your ticketing system, including:
• Details of the phishing attempt.
• Steps taken by IT and SOC.
• Any follow-up actions required.
• Notify the reporting staff member that the issue has been addressed.