Lesson 50 — From Phish to Compromise — Build the Full Timeline
The investigation had started with one suspicious email.
By itself, the message told only part of the story.
Then came the click.
The credential entry.
The suspicious sign-in.
The inbox rule.
The external forwarding.
And the discovery that other users had been targeted.
Agent Foskett now had one final job for Module 5:
Put every piece of evidence into the correct order and explain exactly what happened.
One incident. Multiple evidence sources.
Correlate email, click, identity, mailbox and campaign evidence into a single sequence that another analyst can understand and defend.
Case briefing
Investigation objective
Combine the email, URL-click, identity, mailbox and campaign evidence from Module 5 into a chronological incident timeline that clearly separates confirmed facts, analytical conclusions and remaining unknowns.
Investigator's rule
Do not write the story first and force the evidence to fit it. Build the timeline from the evidence, then let the sequence tell you what the incident became.
Stage 1 — collect the evidence anchors
| Evidence source | What it contributes |
|---|---|
| EmailEvents | Sender, recipient, subject, delivery action and message identity. |
| EmailUrlInfo | URLs and domains associated with the message. |
| UrlClickEvents | User interaction with the suspicious link. |
| Sign-in telemetry | Authentication attempts, success or failure, IP and access context. |
| CloudAppEvents | Mailbox and cloud actions after authentication. |
| Endpoint telemetry | Device activity where the incident includes downloads, processes or network behaviour. |
Every source answers a different question
Email telemetry tells you what arrived. Click telemetry tells you about interaction. Identity evidence tells you whether access was attempted or achieved. Mailbox and endpoint evidence show what happened afterwards.
Keep identifiers with the evidence
Preserve values such as NetworkMessageId, account identity, URL, IP address and device identity. They are the pivots that allow separate telemetry sources to become one investigation.
Stage 2 — establish the email event
EmailEvents
| where Timestamp > ago(7d)
| where RecipientEmailAddress =~ "alex@contoso.com"
| where Subject == "Urgent Payment Review"
| project Timestamp,
SenderFromAddress,
SenderFromDomain,
RecipientEmailAddress,
Subject,
DeliveryAction,
DeliveryLocation,
NetworkMessageId
| order by Timestamp asc
Delivery is your first confirmed event
Record when the message reached the environment and how it was handled. This gives the investigation a reliable starting point.
Do not rewrite history
If the message was originally delivered and only identified as malicious later, record that accurately. The timeline should reflect what actually happened, not what the SOC wishes had happened.
Stage 3 — add the interaction
UrlClickEvents
| where Timestamp > ago(7d)
| where AccountUpn =~ "alex@contoso.com"
| where Url has "secure-invoice-review.example"
| project Timestamp,
AccountUpn,
Url,
ActionType,
Workload,
NetworkMessageId
| order by Timestamp asc
The click changes the investigation
Once interaction is confirmed, the analyst moves from message analysis into post-click evidence. But remember: a click still does not automatically prove compromise.
Add user-reported evidence carefully
If the user confirms entering credentials at approximately 10:09, record that as confirmed user-reported credential disclosure and preserve the distinction from telemetry-derived timestamps.
Stage 4 — add identity evidence
Use the known interaction as the anchor
Authentication attempts occurring immediately after credential disclosure are more meaningful when viewed in relation to the phishing event.
State what the evidence proves
Credential disclosure can be confirmed without proving attacker access. A suspicious successful sign-in adds stronger evidence, but the final conclusion should still consider the user's normal context and authentication details.
Stage 5 — add post-authentication mailbox activity
let SuspiciousIP = "203.0.113.77";
CloudAppEvents
| where Timestamp > ago(1d)
| where AccountId =~ "alex@contoso.com"
| where IPAddress == SuspiciousIP
| project Timestamp,
ActionType,
Application,
IPAddress,
UserAgent,
RawEventData
| order by Timestamp asc
Actions after access establish impact
An inbox rule or forwarding configuration created after suspicious authentication helps show that the incident progressed beyond credential theft into mailbox manipulation.
Preserve the exact order
If forwarding was configured after the inbox rule, record it that way. Sequence can help explain attacker objectives and determine exposure windows.
Stage 6 — build the master timeline
This is the investigation story
The master timeline does not merely list alerts. It shows how the incident changed state: delivery became interaction, interaction became credential exposure, exposure became suspicious access, and access became post-compromise activity.
The timeline also exposes gaps
If there is no evidence between credential entry and mailbox manipulation, mark the gap. Do not invent an event just because it would make the story look cleaner.
Stage 7 — separate fact, inference and unknown
| Classification | Example |
|---|---|
| Confirmed fact | The message was delivered at 09:58:42. |
| Confirmed fact | The user clicked the recorded URL at 10:07:31. |
| User-confirmed fact | The user reported entering credentials into the page. |
| Analytical conclusion | The unfamiliar sign-in is assessed as likely related to the phishing event. |
| Confirmed fact | A new inbox rule was created at 10:18:08. |
| Unknown | Whether the external recipient actually read every forwarded message. |
This makes your finding defensible
Another analyst should be able to see exactly which statements came directly from telemetry, which came from the user and which represent your analytical judgement.
Unknown does not mean unimportant
Record unresolved questions. They may drive additional investigation, containment, legal review or data-exposure assessment.
Stage 8 — add campaign scope without confusing impact
Width and depth are different
Campaign scoping measures reach across users. The incident timeline measures the depth of compromise for a particular user or account. Both belong in the final assessment.
Prioritise the deepest impact
Users with successful suspicious authentication or post-compromise activity require a different response from users whose messages were blocked or never clicked.
Stage 9 — connect containment to evidence
| Evidence | Response consideration |
|---|---|
| Credential disclosure | Secure the exposed identity according to organisational procedure. |
| Suspicious authentication | Review sessions, MFA and identity state. |
| Inbox rule | Review and remove unauthorised mailbox manipulation. |
| External forwarding | Disable unauthorised forwarding and assess the exposure window. |
| Additional targeted users | Prioritise investigation according to delivery and interaction evidence. |
| Endpoint evidence | Contain and investigate affected devices where post-click execution occurred. |
Response should match observed evidence
The strongest incident response is not a generic checklist. Each action should connect back to something the investigation discovered or to a risk that must be addressed.
Document response timestamps too
Password resets, session revocation, rule removal and forwarding removal belong in the timeline. They show when exposure was contained and help define what happened before and after remediation.
Stage 10 — write the final SOC finding
Stage 11 — the handover test
Lesson 50 key takeaways
- Build the incident timeline from evidence rather than from assumptions.
- Email, click, identity, mailbox and endpoint telemetry answer different questions.
- Preserve identifiers that connect evidence sources together.
- Use the phishing interaction time as an anchor for post-click investigation.
- Separate credential exposure from confirmed or suspected account access.
- Post-authentication activity helps establish the depth and impact of compromise.
- Keep events in exact chronological order.
- Separate confirmed facts, user-reported evidence, analytical conclusions and unknowns.
- Campaign scope describes how wide the incident went; the timeline describes what happened.
- Connect containment actions to the evidence that justified them.
- Include remediation events in the timeline.
- Your final finding should be understandable by an analyst who was not present during the investigation.
Module 5 complete — Email & Phishing: From Message to Compromise
You started with a message that looked legitimate and followed the evidence through sender identity, URLs, attachments, authentication, credential exposure, mailbox manipulation, external forwarding and campaign scoping.
Continue your SOC Analyst training
🔎 SOC Analyst Academy — Module 5: Email & Phishing: From Message to Compromise
Build a complete phishing compromise timeline with Microsoft Defender XDR
Lesson 50 of the Agent Foskett SOC Analyst Academy teaches analysts how to correlate phishing delivery, URL clicks, credential exposure, suspicious authentication, mailbox manipulation, external forwarding and campaign scope into one defensible incident timeline.
Correlate email, identity and mailbox evidence with KQL
Use Microsoft Defender XDR and related Microsoft security telemetry to connect EmailEvents, UrlClickEvents, sign-in evidence and CloudAppEvents while separating confirmed facts, analytical conclusions and unknowns.
