Lesson 14 — Investigating Phishing Attacks
Phishing investigations connect message delivery, sender identity, authentication, URLs, attachments, user interaction and post-delivery activity.
Security Copilot can summarise email entity data and help triage user-reported messages, while Defender for Office 365 provides the original message, Threat Explorer, Safe Links, Safe Attachments and automated investigation evidence.
This lesson explains how to move from a suspicious email to a validated campaign, identity, endpoint and remediation conclusion.
What you will learn
This lesson develops a complete Defender for Office 365 phishing investigation and response workflow.
Phishing-investigation workflow
↓
Confirm the exact message and delivery status
↓
Generate the Security Copilot email summary
↓
Review sender, headers, SPF, DKIM, DMARC and composite authentication
↓
Investigate URLs, redirects, attachments and related messages
↓
Confirm user reports, clicks and credential interaction
↓
Correlate Entra sign-ins, mailbox changes and endpoint activity
↓
Build one campaign and victim timeline
↓
Separate phishing verdict from compromise verdict
↓
Preserve evidence and apply approved remediation
Phishing evidence domains
| Domain | Evidence | Investigation question |
|---|---|---|
| Message | Network Message ID, sender, recipient, subject, delivery action and location. | What exactly was delivered? |
| Authentication | SPF, DKIM, DMARC, composite authentication and headers. | Was the sender domain authenticated and aligned? |
| URL | Destination, redirects, reputation, Safe Links and click activity. | Where did the link lead and did the user interact? |
| Attachment | File type, hash, detonation, behaviour and related messages. | Did the attachment contain or deliver a payload? |
| User and identity | Reports, clicks, sign-ins, MFA, mailbox rules and forwarding. | Was the user or mailbox compromised? |
| Endpoint and response | Downloads, processes, remediation, submissions and monitoring. | What happened after delivery and what was contained? |
Learning objectives
- Investigate Defender email entities.
- Interpret SPF, DKIM, DMARC and composite authentication.
- Analyse URLs, redirects and attachments.
- Review user interaction and reported messages.
- Correlate identity, mailbox and endpoint evidence.
- Validate automated triage and remediation.
- Document campaign and compromise scope.
Start with the message entity
Open the selected email in Microsoft Defender and confirm Network Message ID, sender, recipient, subject, delivery location and detection details.
Use the Copilot email summary
The Security Copilot pane on the Email entity page can consolidate metadata, timeline events, URLs and attachments into an initial overview.
Summary is orientation
The AI summary accelerates triage but does not replace the original message headers, delivery evidence or entity records.
Confirm the exact message
Similar subjects and campaigns can involve many messages, so use immutable message identifiers rather than subject alone.
Review delivery action
Determine whether the message was delivered, blocked, junked, quarantined, replaced or removed after delivery.
Review sender identities
Compare visible From, envelope sender, return path and reply-to addresses.
Display-name impersonation
A trusted display name can hide an unrelated sender address and must be verified independently.
Domain impersonation
Look for misspellings, lookalike characters, subdomain tricks and unrelated domains.
Review SPF
SPF validates whether the sending source is authorised for the envelope sender domain, not necessarily the visible From domain.
Review DKIM
DKIM validates a cryptographic signature associated with a signing domain and selected message content.
Review DMARC
DMARC evaluates alignment between the visible From domain and SPF or DKIM results according to the sender policy.
Composite authentication
Microsoft combines SPF, DKIM, DMARC and additional reputation and behavioural signals when evaluating sender authenticity.
Authentication pass is not legitimacy
A malicious sender can correctly authenticate a domain they control.
Authentication failure is not always malicious
Forwarding, relays and legitimate infrastructure can break traditional authentication and require context.
Review Authentication-Results
Use stamped message headers to verify SPF, DKIM, DMARC and related outcomes.
Review URLs
Inspect displayed text, actual destination, redirects, domains, parameters and reputation.
Use the URL entity page
Investigate a URL or domain from the email entity, incident story, search or advanced hunting.
Review Safe Links evidence
Confirm whether Safe Links rewrote, scanned or blocked the URL and whether the user clicked it.
Review URL clicks
Threat Explorer can show clicks in email and supported Office or Teams content, including time and threat classification.
Check redirect chains
A benign-looking first link can redirect through tracking services to malicious infrastructure.
Review attachments
Inspect filename, type, hash, size, origin, detonation result and related detections.
Review Safe Attachments evidence
Safe Attachments detonates supported files in a virtual environment to identify harmful behaviour.
Archive files
Password-protected or nested archives can hide payloads and complicate automated analysis.
HTML and QR phishing
HTML attachments and QR codes can redirect users outside traditional URL controls.
Review related messages
Email analysis can identify other messages related to the original email and potentially part of the same campaign.
Use Threat Explorer
Search by sender, recipient, subject, URL, file, campaign and delivery action to understand scope.
Review user reports
User-reported messages can provide direct evidence of social-engineering attempts and affected recipients.
Phishing Triage Agent
The Security Copilot Phishing Triage Agent can triage and classify user-reported phishing messages at scale.
Agent configuration matters
The agent depends on reported-message monitoring, the relevant alert policy, plugins, identity and permissions.
Agent verdict is not final
Automated classification should be reviewed, especially for sensitive users and consequential response.
Review AIR evidence
Automated investigation and response can analyse the original message and related messages and propose remediation.
Review remediation status
Confirm whether delete, move, quarantine or other actions were approved and completed.
Check post-delivery activity
A message initially delivered may later be removed after campaign detection or analyst action.
Check user interaction
Determine whether the user opened, clicked, replied, opened an attachment or supplied credentials.
User click is not compromise
A click may have been blocked, abandoned or contained before credentials or code were delivered.
Review Entra sign-ins
Correlate suspicious email interaction with sign-in risk, MFA, Conditional Access, device and session evidence.
Review authentication changes
Look for new MFA methods, password changes, session revocation and persistence after suspected credential theft.
Review mailbox rules
Check forwarding, delete, move and hide rules that may conceal attacker activity.
Review sent mail
Determine whether the compromised mailbox sent internal or external phishing after access.
Review delegate access
Unexpected delegates or Send As permissions can indicate persistence.
Review endpoint evidence
Correlate downloads, browser activity, scripts, files, processes and network connections after a click or attachment open.
Review browser downloads
Confirm which browser process downloaded the file, the URL source and resulting child processes.
Review process chains
Validate whether Word, Excel, browser or archive processes genuinely launched scripts or payloads.
Review cloud-app activity
Check whether the user accessed SharePoint, OneDrive, Teams or other cloud applications after suspected compromise.
Build a single timeline
Combine delivery, click, sign-in, endpoint, mailbox and remediation events into one stated time zone.
Separate campaign and victim scope
A campaign can target many users while only a subset receive, click or become compromised.
Separate email verdict and incident verdict
A message can be phishing without proving account or endpoint compromise.
Ask for alternative explanations
Compare phishing with legitimate bulk mail, supplier changes, marketing redirects and approved file delivery.
Preserve headers and artefacts
Capture message headers, URLs, attachments, hashes and timeline evidence before destructive remediation.
Submit to Microsoft
Use submissions workflows to report suspected false negatives, false positives and malicious messages.
Communicate with affected users
Use a trusted channel to verify interaction and provide response instructions.
Contain confirmed compromise
Reset credentials, revoke sessions, remove persistence and isolate affected devices according to validated scope.
Remove malicious messages
Search and remediate related copies while checking action status and business impact.
Block indicators carefully
Block domains, URLs, files or senders only after considering shared infrastructure and false-positive risk.
Monitor after remediation
Watch for repeated delivery, new infrastructure, follow-on sign-ins and regenerated persistence.
Document the final verdict
Record message verdict, campaign scope, affected users, compromise status, actions and residual risk.
Example phishing-investigation prompt
Include:
1. Network Message ID, sender, recipient, subject and delivery status
2. Visible From, envelope sender, reply-to and return-path comparison
3. SPF, DKIM, DMARC and composite-authentication results
4. URLs, redirect chains, domains and Safe Links click evidence
5. Attachments, hashes and Safe Attachments analysis
6. Related messages and campaign scope
7. User interaction, mailbox and Entra evidence
8. Related endpoint activity
9. Confirmed facts, inference and missing evidence
10. Recommended remediation and monitoring steps
Separate the message verdict from identity and endpoint compromise verdicts.
Agent Foskett investigation: “SPF passed for the wrong domain…”
↓
The message displayed a trusted supplier name
↓
SPF showed Pass
↓
The first summary described the sender as authenticated
↓
Agent Foskett compared the sender identities
↓
The visible From used supplier-payments.example
↓
The envelope sender used mailer.attacker-example.net
↓
SPF passed for attacker-example.net
↓
DKIM also signed the attacker-controlled domain
↓
DMARC did not align with the supplier’s real domain
↓
The link redirected to a credential-harvesting site
↓
Safe Links blocked the destination when the user clicked
↓
No suspicious Entra sign-in or endpoint process followed
↓
The message was phishing
↓
The user and device were not confirmed compromised
Phishing-investigation validation checklist
| Area | Question | Validation action |
|---|---|---|
| Message | Is the exact Network Message ID selected? | Confirm immutable message identity. |
| Delivery | Where did the message end up? | Review action, location and post-delivery changes. |
| Authentication | Which domains passed SPF or DKIM and did DMARC align? | Inspect headers and domain relationships. |
| URL | What was the final destination and did the user click? | Review redirects and Safe Links evidence. |
| Attachment | What did the file contain or execute? | Review hash and detonation. |
| Identity | Did suspicious sign-ins or mailbox changes follow? | Review Entra and Exchange evidence. |
| Endpoint | Did a process or download follow? | Review Defender device timeline. |
| Response | Were removal and blocking actions completed? | Check AIR and Action center. |
Key takeaways
- Security Copilot can generate an AI summary from the Defender Email entity page.
- SPF validates the envelope sender source and does not prove the visible From domain is legitimate.
- DKIM and DMARC require domain alignment and sender context.
- Threat Explorer supports investigation of messages, campaigns, URLs, files and clicks.
- Safe Links and Safe Attachments provide protection and investigation evidence.
- The Phishing Triage Agent can classify user-reported messages at scale but still requires review.
- A phishing verdict does not automatically prove identity or endpoint compromise.
- Mailbox, Entra and endpoint evidence establish post-delivery scope.
- The final campaign and compromise conclusions remain human validated.
What Agent Foskett checked
- Network Message ID
- Visible From domain
- Envelope sender
- SPF and DKIM domains
- DMARC alignment
- Redirect chain
- Safe Links click
- Entra sign-ins
- Endpoint activity
- Final scope
Best practices
- Confirm the exact message.
- Inspect sender identities.
- Interpret authentication correctly.
- Review URLs and attachments.
- Search related messages.
- Validate user interaction.
- Correlate identity and endpoint evidence.
- Preserve headers and artefacts.
- Verify remediation status.
- Separate phishing from compromise.
Related Agent Foskett resources
Continue the Microsoft Security Copilot Academy
How do you investigate phishing with Microsoft Security Copilot?
Security Copilot can summarise Defender for Office 365 email entity data, including metadata, timeline events, URLs and attachments, while analysts validate the original message.
Microsoft Defender phishing investigation
A complete investigation reviews sender identities, SPF, DKIM, DMARC, URLs, Safe Links, attachments, Safe Attachments, user clicks, mailbox changes and endpoint activity.
Security Copilot Phishing Triage Agent
The Phishing Triage Agent can triage and classify user-reported phishing messages when reporting, alert policies, plugins and permissions are configured.
