◆CyberHUBBlue Team Level 1
Blue Team Level 1 domain

Phishing Analysis

Email infrastructure, phishing techniques, artifact analysis, investigations, defensive actions and reporting.

45 lessons7 sections153 source pages
45 lessons
01

Introduction to Phishing and Emails

4 lessons

001Section IntroductionPDF pages 1-1001How Electronic Mail WorksPDF pages 1-5005Anatomy of an EmailPDF pages 5-10010What is Phishing?PDF pages 10-11
02

Types of Phishing Emails

8 lessons

012ReconPDF pages 12-16016Credential HarvesterPDF pages 16-21022Social EngineeringPDF pages 22-22023Vishing and SmishingPDF pages 23-26027WhalingPDF pages 27-27028Malicious FilePDF pages 28-33034SpamPDF pages 34-37038False PositivePDF pages 38-38
03

Tactics and Techniques Used

9 lessons

039Spear PhishingPDF pages 39-40040ImpersonationPDF pages 40-41042Typosquatting and HomoglyphsPDF pages 42-45045Sender SpoofingPDF pages 45-46047HTML StylingPDF pages 47-51052AttachmentsPDF pages 52-57058HyperlinksPDF pages 58-69069Use of Legitimate ServicesPDF pages 69-71072Business Email CompromisePDF pages 72-74
04

Investigating a Phishing Email

5 lessons

074Artifacts to CollectPDF pages 74-76077Manual Collection - Email ArtifactsPDF pages 77-82082Manual Collection - Web ArtifactsPDF pages 82-85085Manual Collection - File ArtifactsPDF pages 85-87087Automated Collection With PhishToolPDF pages 87-93
05

Analyzing Artifacts

5 lessons

093Visualization ToolsPDF pages 93-95096URL Reputation ToolsPDF pages 96-100100File Reputation ToolsPDF pages 100-104104Malware SandboxingPDF pages 104-109109Automated Artifact AnalysisPDF pages 109-113
06

Taking Defensive Actions

9 lessons

114Preventative: Marking External EmailsPDF pages 114-118118Preventative: Email Security TechnologyPDF pages 118-121121Preventative: Spam FilterPDF pages 121-124124Preventative: Attachment FilteringPDF pages 124-125125Preventative: Security Awareness TrainingPDF pages 125-127127Reactive: Immediate Response ProcessPDF pages 127-129129Reactive: Blocking Email ArtifactsPDF pages 129-131132Reactive: Blocking Web ArtifactsPDF pages 132-136136Reactive: Blocking File ArtifactsPDF pages 136-138
07

Report Writing

5 lessons

138Email Header, Artifacts, and Body ContentPDF pages 138-143143Analysis Process, Tools, and ResultsPDF pages 143-145145Defensive Measures TakenPDF pages 145-149150Artifact SanitizationPDF pages 150-151151Activity) Report Writing AnswersPDF pages 151-153