Investigates phishing email incidents from user reports via header analysis, URL/attachment detonation in sandboxes, affected user identification in Splunk, and containment with Microsoft Defender. For SOC phishing response.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
以下情况使用本技能：
Investigates phishing emails via header analysis, URL/attachment detonation in sandboxes, impact assessment with Splunk/Defender, and containment actions.
Investigates phishing email incidents via header analysis, URL/attachment detonation in sandboxes, impacted user identification, and containment using Splunk, Microsoft Defender, and SOC tools.
Guides phishing incident response: analyzes reported emails and headers, extracts IOCs from URLs/attachments via sandboxing, assesses credential compromise, isolates malicious emails organization-wide, and remediates accounts.
Share bugs, ideas, or general feedback.
以下情况使用本技能：
不适用于没有恶意意图的垃圾邮件或营销邮件——将这些邮件路由给邮件管理员进行过滤器调优。
从举报邮件中获取完整邮件头（.eml 文件）：
import email
from email import policy
with open("phishing_sample.eml", "rb") as f:
msg = email.message_from_binary_file(f, policy=policy.default)
# 提取关键邮件头
print(f"From: {msg['From']}")
print(f"Return-Path: {msg['Return-Path']}")
print(f"Reply-To: {msg['Reply-To']}")
print(f"Subject: {msg['Subject']}")
print(f"Message-ID: {msg['Message-ID']}")
print(f"X-Originating-IP: {msg['X-Originating-IP']}")
# 解析 Received 头（从下向上追溯真实来源）
for header in reversed(msg.get_all('Received', [])):
print(f"Received: {header[:120]}")
# 检查认证结果
print(f"Authentication-Results: {msg['Authentication-Results']}")
print(f"DKIM-Signature: {msg.get('DKIM-Signature', 'NONE')[:80]}")
关键检查项：
Return-Path 域是否与发送 IP 匹配？查看 spf=pass 或 spf=faildkim=pass 确认邮件在传输过程中未被修改From 域是否与 SPF/DKIM 域对齐？dmarc=fail 表明存在欺骗URL 分析：
import requests
# 向 URLScan.io 提交 URL
url_to_scan = "https://evil-login.example.com/office365"
response = requests.post(
"https://urlscan.io/api/v1/scan/",
headers={"API-Key": "YOUR_KEY", "Content-Type": "application/json"},
json={"url": url_to_scan, "visibility": "unlisted"}
)
scan_id = response.json()["uuid"]
print(f"扫描 URL：https://urlscan.io/result/{scan_id}/")
# 在 VirusTotal 检查 URL 信誉
import vt
client = vt.Client("YOUR_VT_API_KEY")
url_id = vt.url_id(url_to_scan)
url_obj = client.get_object(f"/urls/{url_id}")
print(f"VT 得分：{url_obj.last_analysis_stats}")
client.close()
附件分析：
import hashlib
# 计算文件哈希值
with open("attachment.docx", "rb") as f:
content = f.read()
md5 = hashlib.md5(content).hexdigest()
sha256 = hashlib.sha256(content).hexdigest()
print(f"MD5: {md5}")
print(f"SHA256: {sha256}")
# 向 MalwareBazaar 查询
response = requests.post(
"https://mb-api.abuse.ch/api/v1/",
data={"query": "get_info", "hash": sha256}
)
print(response.json()["query_status"])
将附件提交至沙箱（Any.Run 或 Joe Sandbox）进行动态分析，检查宏执行、PowerShell 运行和 C2 回调。
在 Splunk 中搜索同一钓鱼邮件的所有收件人：
index=email sourcetype="o365:messageTrace"
(SenderAddress="attacker@evil-domain.com" OR Subject="Urgent: Password Reset Required"
OR MessageId="<phishing-message-id@evil.com>")
earliest=-7d
| stats count by RecipientAddress, DeliveryStatus, MessageTraceId
| sort - count
或者使用 Microsoft Graph API：
import requests
headers = {"Authorization": f"Bearer {access_token}"}
params = {
"$filter": f"subject eq 'Urgent: Password Reset Required' and "
f"receivedDateTime ge 2024-03-14T00:00:00Z",
"$select": "sender,toRecipients,subject,receivedDateTime",
"$top": 100
}
response = requests.get(
"https://graph.microsoft.com/v1.0/users/admin@company.com/messages",
headers=headers, params=params
)
messages = response.json()["value"]
print(f"找到 {len(messages)} 封匹配邮件")
检查代理/Web 日志，查找访问了钓鱼 URL 的用户：
index=proxy dest="evil-login.example.com" earliest=-7d
| stats count, values(action) AS actions, latest(_time) AS last_access
by src_ip, user
| lookup asset_lookup_by_cidr ip AS src_ip OUTPUT owner, category
| sort - count
| table user, src_ip, owner, actions, count, last_access
检查是否有凭据被提交（向钓鱼域名的 POST 请求）：
index=proxy dest="evil-login.example.com" http_method=POST earliest=-7d
| stats count by src_ip, user, url, status
从所有邮箱清除邮件：
# Microsoft 365 合规搜索和清除
New-ComplianceSearch -Name "Phishing_Purge_2024_0315" `
-ExchangeLocation All `
-ContentMatchQuery '(From:attacker@evil-domain.com) AND (Subject:"Urgent: Password Reset Required")'
Start-ComplianceSearch -Identity "Phishing_Purge_2024_0315"
# 搜索完成后执行清除
New-ComplianceSearchAction -SearchName "Phishing_Purge_2024_0315" -Purge -PurgeType SoftDelete
封锁指标：
重置被入侵凭据：
# 强制受影响用户重置密码
$impactedUsers = @("user1@company.com", "user2@company.com")
foreach ($user in $impactedUsers) {
Set-MsolUserPassword -UserPrincipalName $user -ForceChangePassword $true
Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser -ObjectId $user).ObjectId
}
创建包含完整时间线、IOC、受影响用户和已采取修复行动的事件报告。
| makeresults
| eval incident_id="PHI-2024-0315",
reported_time="2024-03-15 09:12:00",
sender="attacker@evil-domain[.]com",
subject="Urgent: Password Reset Required",
url="hxxps://evil-login[.]example[.]com/office365",
recipients_count=47,
clicked_count=5,
credentials_submitted=2,
emails_purged=47,
passwords_reset=2,
domains_blocked=1,
disposition="真阳性 - 凭据钓鱼攻击活动"
| table incident_id, reported_time, sender, subject, url, recipients_count,
clicked_count, credentials_submitted, emails_purged, passwords_reset, disposition
| 术语 | 定义 |
|---|---|
| SPF（发件人策略框架） | DNS TXT 记录，指定哪些邮件服务器被授权代表某域名发送邮件 |
| DKIM | 域密钥识别邮件（DomainKeys Identified Mail）——证明邮件内容在传输过程中未被篡改的密码学签名 |
| DMARC | 基于域的邮件认证、报告和一致性（Domain-based Message Authentication, Reporting and Conformance）——结合 SPF 和 DKIM 对齐的策略 |
| 凭据收割（Credential Harvesting） | 使用伪造登录页面捕获用户名/密码组合的钓鱼技术 |
| 商业邮件欺诈（BEC） | 利用被入侵或伪造的高管邮件进行金融欺诈的社会工程攻击 |
| 消息跟踪（Message Trace） | O365/Exchange 日志，显示邮件路由、投递状态和过滤操作，用于取证分析 |
钓鱼事件报告 — PHI-2024-0315
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
举报时间： 2024-03-15 09:12 UTC，举报人 jsmith（财务部）
发件人： attacker@evil-domain[.]com（SPF：失败，DKIM：无，DMARC：失败）
主题： Urgent: Password Reset Required
载荷： 凭据收割 URL
IOC：
URL： hxxps://evil-login[.]example[.]com/office365
域名： evil-login[.]example[.]com（注册于 2024-03-14，Namecheap）
IP： 185.234.xx.xx（VT：12/90 恶意）
范围：
收件人： 财务和 HR 部门 47 名用户
点击者： 5 名用户访问了钓鱼 URL
已提交： 2 名用户输入了凭据（通过代理日志中的 POST 请求确认）
遏制措施：
[已完成] 通过合规搜索清除 47 封邮件
[已完成] 代理和 DNS 黑洞已封锁该域名
[已完成] 2 名用户密码已重置，会话已撤销
[已完成] 两个被入侵账号已强制启用 MFA
[已完成] 收件箱规则已审计——未发现转发规则
状态： 已解决——无证据表明被入侵后发生横向移动