Phishing triage: headers to inspect first

Overview

Malicious messages are time-sensitive. Start with header facts before sandbox detonation.

Priority headers

Authentication-Results (SPF/DKIM/DMARC alignment), Return-Path vs From display, Received chain first hop anomalies.

Red flags

Newly registered domains, cousin domains (micr0soft), urgency language, unexpected shared file links.

Process

1. Quarantine user mailbox if credential entered.
2. Hunt tenant-wide for same IOC.
3. Preserve message in eDiscovery hold if legal may care.

Tools

Message trace + advanced hunting in Defender where licensed.

Closure

Ticket with classification: malicious, spam, graymail, legit false positive.