Agent Foskett Academy • SOC Analyst Academy • Module 5 • Lesson 49 • Email & Phishing: From Message to Compromise

Lesson 49 — Was Anyone Else Targeted?

One user reported the phishing message.

One account had been investigated.

One mailbox had shown suspicious post-compromise changes.

But Agent Foskett wasn't finished.

The original message contained several reusable pivots: sender address, sender domain, subject, URL, URL domain and message identifiers.

The next question was simple:

Was this really a one-user incident — or had the same campaign reached other people?

The first victim tells you what happened. Campaign scoping tells you how far the incident may extend.

Scope the Campaign Back to SOC Analyst Academy

Agent Foskett scoping a phishing campaign across multiple users

One report may represent many targets

Reuse the strongest indicators from the confirmed message to discover related recipients, clicks and suspicious infrastructure.

✓ Pivot on sender and domain

✓ Search subject and URLs

✓ Count recipients

✓ Identify who interacted

Case briefing

KNOWN INCIDENT alex@contoso.com ↓ Phishing message delivered ↓ Link clicked ↓ Credentials entered ↓ Account activity investigated BUT THE MESSAGE ALSO GAVE US: Sender address Sender domain Subject URL URL domain NetworkMessageId ↓ NEW SOC QUESTION Who else received related messages? Who else clicked? Did anyone else show suspicious identity activity?

Investigation objective

Expand a confirmed phishing investigation beyond the original recipient by pivoting on message, sender and URL evidence to identify additional targets and prioritise users who interacted with the campaign.

Investigator's rule

Do not assume the user who reported the phish was the only recipient. Treat the confirmed message as a source of pivots and test the wider environment.

Stage 1 — build your campaign pivot list

Pivot	What it can reveal
Sender address	Other messages sent from the same address.
Sender domain	Variants using different local parts on the same domain.
Subject	Messages using the same lure, even if sender details vary.
URL / domain	Messages and clicks involving the same destination infrastructure.
NetworkMessageId	The specific message instance and related email telemetry.

Start with high-confidence evidence

A sender domain or exact URL from a confirmed phishing message is usually a stronger starting point than a broad keyword that could match legitimate mail.

One indicator may not find the whole campaign

Attackers can rotate sender addresses, subjects and URLs. Use several related pivots and compare the results rather than depending on one search.

Stage 2 — find other recipients from the same sender domain

123456789101112

let SuspiciousDomain = "contoso-payment-review.com";
EmailEvents
| where Timestamp > ago(7d)
| where SenderFromDomain =~ SuspiciousDomain
| project Timestamp,
          SenderFromAddress,
          RecipientEmailAddress,
          Subject,
          DeliveryAction,
          DeliveryLocation,
          NetworkMessageId
| order by Timestamp asc

Count the recipients

The investigation changes when one suspicious message becomes 5, 50 or 500. Establish how many distinct users were targeted and how the platform handled those messages.

Delivery status matters

A message detected and blocked is not equivalent to one delivered to the inbox. Separate targeted users from users who were actually exposed to the content.

Stage 3 — summarise campaign reach

12345678910

let SuspiciousDomain = "contoso-payment-review.com";
EmailEvents
| where Timestamp > ago(7d)
| where SenderFromDomain =~ SuspiciousDomain
| summarize
    Messages = count(),
    Recipients = dcount(RecipientEmailAddress),
    RecipientList = make_set(RecipientEmailAddress, 100)
    by Subject, DeliveryAction, DeliveryLocation
| order by Messages desc

Now you have scale

A summary turns scattered message records into a campaign view: how many messages, how many recipients and where those messages ended up.

Do not confuse recipients with victims

A recipient was targeted. A delivered message created exposure. A click proves interaction. Credential entry or subsequent malicious activity indicates a deeper level of impact.

Stage 4 — pivot on the phishing URL

1234567891011121314151617

let SuspiciousDomain = "secure-invoice-review.example";
EmailUrlInfo
| where Timestamp > ago(7d)
| where UrlDomain =~ SuspiciousDomain
| project Timestamp,
          NetworkMessageId,
          Url,
          UrlDomain
| join kind=inner (
    EmailEvents
    | project NetworkMessageId,
              RecipientEmailAddress,
              SenderFromAddress,
              Subject,
              DeliveryAction
) on NetworkMessageId
| order by Timestamp asc

URL pivots can bridge sender variation

Different messages may use different senders but still point to the same phishing infrastructure. URL evidence can reveal relationships that sender-only searches miss.

Keep message identity in the query

NetworkMessageId provides a useful bridge between email tables, allowing the analyst to connect URL evidence back to recipients and delivery information.

Stage 5 — identify who clicked

1234567891011

let SuspiciousDomain = "secure-invoice-review.example";
UrlClickEvents
| where Timestamp > ago(7d)
| where Url has SuspiciousDomain
| project Timestamp,
          AccountUpn,
          Url,
          ActionType,
          Workload,
          NetworkMessageId
| order by Timestamp asc

Clicks change prioritisation

If 40 users received the message but three clicked the phishing URL, those three require faster investigation than recipients who never interacted with it.

A click still does not equal compromise

Carry forward the lesson from earlier in the module: interaction is evidence, not an automatic verdict. Investigate what happened after each click.

Stage 6 — build an impact ladder

CAMPAIGN SCOPE 100 users targeted ↓ 62 messages delivered ↓ 7 users clicked ↓ 2 users reported entering credentials ↓ 1 suspicious successful sign-in ↓ 1 mailbox showed unauthorised changes PRIORITISE BY OBSERVED IMPACT Targeted ↓ Delivered ↓ Clicked ↓ Credentials exposed ↓ Suspicious authentication ↓ Post-compromise activity

This is triage at campaign scale

Not every user needs the same response at the same moment. Use observed interaction and compromise evidence to prioritise investigation while still accounting for the full target population.

Preserve the distinctions

“Targeted”, “delivered”, “clicked” and “compromised” describe different states. Good SOC reporting does not collapse them into one number.

Stage 7 — correlate identity evidence for affected users

USER A Message blocked No interaction ↓ Lower immediate impact USER B Message delivered No click observed ↓ Exposure confirmed USER C Message delivered Click observed ↓ Investigate post-click activity USER D Credentials entered Suspicious sign-in observed ↓ Identity investigation + containment USER E Suspicious sign-in Mailbox changes observed ↓ Confirmed wider incident impact

Move users into the correct investigation path

Users who clicked may require endpoint or identity pivots. Users who disclosed credentials require identity response. Users showing mailbox manipulation require deeper post-compromise review.

The campaign and the incident are connected

Campaign scoping finds the population. Individual investigation determines impact. The SOC needs both views to understand the event properly.

Stage 8 — write the campaign finding

SOC FINDING The confirmed phishing message was used to identify related campaign activity across the environment. Searches of sender-domain and URL telemetry identified additional recipients. Delivery evidence was separated from click activity so targeted users were not automatically classified as compromised. Users with observed interaction were prioritised for additional endpoint and identity investigation. The campaign scope was therefore expanded beyond the original reporter while preserving separate counts for targeting, delivery, interaction and confirmed impact.

Lesson 49 key takeaways

One reported phishing message may represent a much larger campaign.
Reuse sender, domain, subject, URL and message identifiers as investigation pivots.
Use multiple pivots because attackers can vary individual campaign elements.
Count distinct recipients and review message delivery outcomes.
Targeted users are not automatically victims.
Delivered, clicked, credential-exposed and compromised are different impact states.
URL evidence can connect messages that use different sender identities.
UrlClickEvents helps identify users who interacted with suspicious links.
Prioritise deeper investigation according to observed impact.
Campaign scoping and individual-user investigation should feed the same incident timeline.

Module 5 — Email & Phishing: From Message to Compromise

Lesson 49 expanded the investigation from one reported phish into organisation-wide campaign scoping. Lesson 50 brings every stage together into the complete phishing-compromise timeline.

Next: Lesson 50 — From Phish to Compromise — Build the Full Timeline

Continue your SOC Analyst training

Module 3 focuses on identity incidents, authentication, MFA, privilege, sessions and application access.

SOC Analyst Academy KQL Academy Microsoft Sentinel Academy Defender for Endpoint Academy Microsoft Entra Security Academy Security Copilot Academy Agent Foskett Academy

🔎 SOC Analyst Academy — Module 5: Email & Phishing: From Message to Compromise

Follow phishing evidence from message delivery through clicks, credential exposure, mailbox activity and campaign scope.

← Previous lesson

Lesson 48 — The Mailbox Started Forwarding Externally Identify forwarding-based persistence and exposure.

✅ Current lesson

Lesson 49 — Was Anyone Else Targeted? Scope a phishing campaign across users and infrastructure.

Next lesson →

Lesson 50 — From Phish to Compromise — Build the Full Timeline Combine email, click, identity and endpoint evidence.

Scope phishing campaigns with Microsoft Defender XDR Advanced Hunting

Lesson 49 of the Agent Foskett SOC Analyst Academy teaches analysts how to expand a confirmed phishing investigation across multiple users by pivoting on sender domains, URLs, message identifiers and click telemetry.

Use KQL to find phishing recipients and URL clicks

Use EmailEvents, EmailUrlInfo and UrlClickEvents to identify related messages, count recipients, distinguish delivery from interaction and prioritise users who require deeper identity or endpoint investigation.