Agent Foskett Academy • SOC Analyst Academy • Module 5 • Lesson 44 • Email & Phishing: From Message to Compromise

Lesson 44 — The Attachment Reached the Inbox

The email had already been delivered.

Sitting inside the user's inbox was an attachment named Invoice_September.zip.

The user was not sure whether they had opened it.

Agent Foskett had two separate questions to answer:

What exactly arrived in the email?
And did that attachment ever become activity on the endpoint?

Delivery proves the attachment reached the mailbox. It does not prove the file executed.

Trace the Attachment Back to SOC Analyst Academy

Agent Foskett tracing a suspicious email attachment into endpoint evidence

The attachment was delivered

Identify the attachment, preserve its hash, determine who received it and then look for evidence that the file reached or executed on a device.

✓ Confirm delivery

✓ Identify the attachment

✓ Preserve the hash

✓ Trace endpoint activity

Case briefing

EMAIL DELIVERED Subject: Outstanding Invoice — September Attachment: Invoice_September.zip Recipient: alex@contoso.com Delivery: Inbox ↓ USER REPORT "I saw the attachment. I'm not sure if I opened it." ↓ SOC QUESTIONS What file was attached? What hash identifies it? Who else received it? Did the file appear on a device? Was it extracted? Was anything executed?

Investigation objective

Trace a suspicious attachment from email delivery through attachment telemetry and into endpoint file and process evidence without assuming that delivery, download and execution are the same event.

Investigator's rule

Keep delivery, file appearance and execution separate. Each stage requires its own evidence.

Stage 1 — confirm the email and delivery

123456789101112

EmailEvents
| where Timestamp > ago(7d)
| where Subject =~ "Outstanding Invoice — September"
| project Timestamp,
          NetworkMessageId,
          SenderFromAddress,
          SenderFromDomain,
          RecipientEmailAddress,
          Subject,
          DeliveryAction,
          DeliveryLocation
| order by Timestamp desc

Delivery establishes exposure

If the message reached the inbox, the recipient had the opportunity to interact with it. That matters, but it still does not establish what happened to the attachment afterwards.

Preserve the NetworkMessageId

Use the message identifier to move from the email record into attachment telemetry without relying only on the subject or sender.

Stage 2 — identify the attachment

1234567891011

let MessageId = "<NETWORK-MESSAGE-ID>";
EmailAttachmentInfo
| where NetworkMessageId == MessageId
| project Timestamp,
          NetworkMessageId,
          FileName,
          FileType,
          SHA256,
          ThreatTypes,
          DetectionMethods

The filename is not the identity

Invoice_September.zip is useful context, but filenames are easy to change. A cryptographic hash provides a much stronger pivot when it is available.

Record what detection saw

Threat and detection fields can provide useful context, but the analyst should still correlate the attachment with delivery and endpoint evidence before describing what happened.

Stage 3 — separate the stages of attachment activity

Stage	What the evidence would establish
Email delivery	The message and attachment reached the recipient's mailbox.
File appearance	A matching file or related extracted file appeared on an endpoint.
File execution	A process event shows a file actually ran.
Child activity	The executed file initiated additional processes or commands.
Network activity	A process contacted remote infrastructure after execution.

Do not skip a stage

“Attachment delivered” should never silently become “malware executed” in the incident notes. The evidence chain must show the transition.

User memory is supporting context

The user's recollection can help define the search window, but endpoint telemetry should determine whether the file actually appeared or executed.

Stage 4 — hunt for the attachment hash on endpoints

123456789101112

let AttachmentHash = "<SHA256>";
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 == AttachmentHash
| project Timestamp,
          DeviceName,
          FileName,
          FolderPath,
          SHA256,
          ActionType,
          InitiatingProcessFileName
| order by Timestamp asc

A hash match creates a bridge

If the same SHA256 appears in email attachment telemetry and endpoint file telemetry, the SOC has a strong correlation between the delivered attachment and a file observed on a device.

No match is still a result

If the attachment hash never appears in available endpoint telemetry, record that finding carefully. It may reduce evidence of endpoint interaction, but it does not prove the user never accessed the attachment.

Stage 5 — account for archives and extracted files

EMAIL ATTACHMENT Invoice_September.zip SHA256 = AAAAA... ↓ FILE APPEARS ON DEVICE Invoice_September.zip ↓ USER EXTRACTS ARCHIVE Invoice_September/ Invoice_September.pdf InvoiceViewer.exe ↓ IMPORTANT The extracted files have DIFFERENT hashes. The email attachment hash may identify the ZIP, but execution may involve a file created from it.

Archives change the pivot

A ZIP attachment may be only the container. Once extracted, the investigation must follow newly created files by time, path, filename and initiating activity rather than expecting the archive hash to identify every child file.

Build around the file-creation time

If the archive appears on the endpoint, inspect nearby DeviceFileEvents for additional files created shortly afterwards.

Stage 6 — inspect nearby file activity

123456789101112

let FileTime = datetime(2026-09-01 11:18:42);
DeviceFileEvents
| where Timestamp between (FileTime - 2m .. FileTime + 10m)
| where DeviceName =~ "WS-FIN-021"
| project Timestamp,
          FileName,
          FolderPath,
          SHA256,
          ActionType,
          InitiatingProcessFileName
| order by Timestamp asc

Look for extraction patterns

Several new files appearing within seconds of the archive can reveal that the attachment was opened or extracted even when the original container itself was never executed.

Preserve new hashes

Any suspicious extracted executable, script or document becomes a new investigation entity with its own hash and endpoint history.

Stage 7 — determine whether a suspicious file executed

12345678910111213

let StartTime = datetime(2026-09-01 11:18:42);
DeviceProcessEvents
| where Timestamp between (StartTime .. StartTime + 15m)
| where DeviceName =~ "WS-FIN-021"
| project Timestamp,
          FileName,
          FolderPath,
          SHA256,
          ProcessCommandLine,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by Timestamp asc

Execution changes the incident

Once a suspicious extracted file is observed as a process, the investigation has crossed from email exposure into endpoint execution and should follow the process tree and resulting activity.

Ask what launched it

The initiating process can help explain whether the file was launched through Explorer, an Office application, a script host, a browser or another process.

Stage 8 — check what the process did next

123456789101112

let ExecutionTime = datetime(2026-09-01 11:20:03);
DeviceNetworkEvents
| where Timestamp between (ExecutionTime .. ExecutionTime + 15m)
| where DeviceName =~ "WS-FIN-021"
| project Timestamp,
          InitiatingProcessFileName,
          InitiatingProcessSHA256,
          RemoteUrl,
          RemoteIP,
          RemotePort,
          ActionType
| order by Timestamp asc

Follow behaviour, not just the file

Execution is important, but the next question is what the process did: child processes, network connections, persistence or other suspicious behaviour may determine the true impact.

Keep the timeline connected

The strongest investigation shows the sequence from mailbox delivery to attachment identity, endpoint appearance, extraction, execution and subsequent behaviour.

Stage 9 — build the attachment timeline

11:12:08 Email delivered to inbox ↓ 11:18:42 Invoice_September.zip appears on WS-FIN-021 ↓ 11:19:01 Files extracted from archive ↓ 11:20:03 InvoiceViewer.exe executes ↓ 11:20:09 Process contacts external infrastructure ↓ SOC CONCLUSION Delivery ✓ Evidence File present ✓ Evidence Extraction ✓ Evidence Execution ✓ Evidence Network ✓ Evidence Each conclusion is supported by a separate event.

Stage 10 — write the investigation finding

SOC FINDING The suspicious email and attachment were delivered to the recipient's inbox. EmailAttachmentInfo identified the attachment and provided a SHA256 value used to pivot into endpoint telemetry. A matching archive was observed on the recipient's device. Additional files appeared shortly afterwards, consistent with extraction activity. A suspicious extracted executable was subsequently observed in DeviceProcessEvents and was followed by outbound network activity. The evidence therefore supports progression from email delivery into endpoint execution rather than delivery alone.

Lesson 44 key takeaways

Delivery, download, extraction and execution are different investigation stages.
Use the NetworkMessageId to correlate the message with attachment telemetry.
Use EmailAttachmentInfo to identify filename, file type and SHA256 where available.
A filename is context; a hash is a stronger technical pivot.
Use DeviceFileEvents to look for the attachment on endpoints.
Archive attachments may create new files with completely different hashes.
Inspect nearby file events to identify extraction activity.
Use DeviceProcessEvents to establish execution rather than assuming it.
Follow executed files into subsequent process and network behaviour.
Write conclusions that distinguish each stage the evidence actually proves.

Module 5 — Email & Phishing: From Message to Compromise

Lesson 44 traced an attachment from mailbox delivery into endpoint activity. Lesson 45 introduces a different trap: the message passed authentication, but the evidence still says it deserves investigation.

Next: Lesson 45 — The Message Passed Authentication — But Was Still Suspicious

Continue your SOC Analyst training

Module 3 focuses on identity incidents, authentication, MFA, privilege, sessions and application access.

SOC Analyst Academy KQL Academy Microsoft Sentinel Academy Defender for Endpoint Academy Microsoft Entra Security Academy Security Copilot Academy Agent Foskett Academy

🔎 SOC Analyst Academy — Module 5: Email & Phishing: From Message to Compromise

Follow phishing evidence from message delivery through clicks, credential exposure, mailbox activity and campaign scope.

← Previous lesson

Lesson 43 — The Link Was Clicked Follow a message into URL-click and endpoint evidence.

✅ Current lesson

Lesson 44 — The Attachment Reached the Inbox Trace attachment delivery and execution.

Next lesson →

Lesson 45 — The Message Passed Authentication — But Was Still Suspicious Understand why authentication results do not settle the case.

Investigating suspicious email attachments in Microsoft Defender XDR

Lesson 44 of the Agent Foskett SOC Analyst Academy teaches SOC analysts how to correlate EmailEvents and EmailAttachmentInfo with DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents to trace an attachment from mailbox delivery into endpoint activity.

Trace phishing attachment delivery and execution with KQL

Learn how to preserve attachment hashes, identify files on endpoints, investigate archive extraction, establish process execution and follow post-execution network activity using Microsoft Defender XDR Advanced Hunting.