From cybersecurity-skills
Investigates phishing emails via header analysis, URL/attachment detonation in sandboxes, impact assessment with Splunk/Defender, and containment actions.
npx claudepluginhub mukul975/anthropic-cybersecurity-skills --plugin cybersecurity-skillsThis skill uses the workspace's default tool permissions.
Use this skill when:
Applies Acme Corporation brand guidelines including colors, fonts, layouts, and messaging to generated PowerPoint, Excel, and PDF documents.
Builds DCF models with sensitivity analysis, Monte Carlo simulations, and scenario planning for investment valuation and risk assessment.
Calculates profitability (ROE, margins), liquidity (current ratio), leverage, efficiency, and valuation (P/E, EV/EBITDA) ratios from financial statements in CSV, JSON, text, or Excel for investment analysis.
Use this skill when:
Do not use for spam or marketing emails without malicious intent — route those to email administration for filter tuning.
Obtain the full email headers (.eml file) from the reported message:
import email
from email import policy
with open("phishing_sample.eml", "rb") as f:
msg = email.message_from_binary_file(f, policy=policy.default)
# Extract key headers
print(f"From: {msg['From']}")
print(f"Return-Path: {msg['Return-Path']}")
print(f"Reply-To: {msg['Reply-To']}")
print(f"Subject: {msg['Subject']}")
print(f"Message-ID: {msg['Message-ID']}")
print(f"X-Originating-IP: {msg['X-Originating-IP']}")
# Parse Received headers (bottom-up for true origin)
for header in reversed(msg.get_all('Received', [])):
print(f"Received: {header[:120]}")
# Check authentication results
print(f"Authentication-Results: {msg['Authentication-Results']}")
print(f"DKIM-Signature: {msg.get('DKIM-Signature', 'NONE')[:80]}")
Key checks:
Return-Path domain match sending IP? Look for spf=pass or spf=faildkim=pass confirms the email was not modified in transitFrom domain align with SPF/DKIM domains? dmarc=fail indicates spoofingURL Analysis:
import requests
# Submit URL to URLScan.io
url_to_scan = "https://evil-login.example.com/office365"
response = requests.post(
"https://urlscan.io/api/v1/scan/",
headers={"API-Key": "YOUR_KEY", "Content-Type": "application/json"},
json={"url": url_to_scan, "visibility": "unlisted"}
)
scan_id = response.json()["uuid"]
print(f"Scan URL: https://urlscan.io/result/{scan_id}/")
# Check VirusTotal for URL reputation
import vt
client = vt.Client("YOUR_VT_API_KEY")
url_id = vt.url_id(url_to_scan)
url_obj = client.get_object(f"/urls/{url_id}")
print(f"VT Score: {url_obj.last_analysis_stats}")
client.close()
Attachment Analysis:
import hashlib
# Calculate file hashes
with open("attachment.docx", "rb") as f:
content = f.read()
md5 = hashlib.md5(content).hexdigest()
sha256 = hashlib.sha256(content).hexdigest()
print(f"MD5: {md5}")
print(f"SHA256: {sha256}")
# Submit to MalwareBazaar for lookup
response = requests.post(
"https://mb-api.abuse.ch/api/v1/",
data={"query": "get_info", "hash": sha256}
)
print(response.json()["query_status"])
Submit to sandbox (Any.Run or Joe Sandbox) for dynamic analysis of macros, PowerShell execution, and C2 callbacks.
Search for all recipients of the same phishing email in Splunk:
index=email sourcetype="o365:messageTrace"
(SenderAddress="attacker@evil-domain.com" OR Subject="Urgent: Password Reset Required"
OR MessageId="<phishing-message-id@evil.com>")
earliest=-7d
| stats count by RecipientAddress, DeliveryStatus, MessageTraceId
| sort - count
Alternatively, use Microsoft Graph API:
import requests
headers = {"Authorization": f"Bearer {access_token}"}
params = {
"$filter": f"subject eq 'Urgent: Password Reset Required' and "
f"receivedDateTime ge 2024-03-14T00:00:00Z",
"$select": "sender,toRecipients,subject,receivedDateTime",
"$top": 100
}
response = requests.get(
"https://graph.microsoft.com/v1.0/users/admin@company.com/messages",
headers=headers, params=params
)
messages = response.json()["value"]
print(f"Found {len(messages)} matching messages")
Check proxy/web logs for users who visited the phishing URL:
index=proxy dest="evil-login.example.com" earliest=-7d
| stats count, values(action) AS actions, latest(_time) AS last_access
by src_ip, user
| lookup asset_lookup_by_cidr ip AS src_ip OUTPUT owner, category
| sort - count
| table user, src_ip, owner, actions, count, last_access
Check if credentials were submitted (POST requests to phishing domain):
index=proxy dest="evil-login.example.com" http_method=POST earliest=-7d
| stats count by src_ip, user, url, status
Purge emails from all mailboxes:
# Microsoft 365 Compliance Search and Purge
New-ComplianceSearch -Name "Phishing_Purge_2024_0315" `
-ExchangeLocation All `
-ContentMatchQuery '(From:attacker@evil-domain.com) AND (Subject:"Urgent: Password Reset Required")'
Start-ComplianceSearch -Identity "Phishing_Purge_2024_0315"
# After search completes, execute purge
New-ComplianceSearchAction -SearchName "Phishing_Purge_2024_0315" -Purge -PurgeType SoftDelete
Block indicators:
Reset compromised credentials:
# Force password reset for impacted users
$impactedUsers = @("user1@company.com", "user2@company.com")
foreach ($user in $impactedUsers) {
Set-MsolUserPassword -UserPrincipalName $user -ForceChangePassword $true
Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser -ObjectId $user).ObjectId
}
Create incident report with full timeline, IOCs, impacted users, and remediation actions taken.
| makeresults
| eval incident_id="PHI-2024-0315",
reported_time="2024-03-15 09:12:00",
sender="attacker@evil-domain[.]com",
subject="Urgent: Password Reset Required",
url="hxxps://evil-login[.]example[.]com/office365",
recipients_count=47,
clicked_count=5,
credentials_submitted=2,
emails_purged=47,
passwords_reset=2,
domains_blocked=1,
disposition="True Positive - Credential Phishing Campaign"
| table incident_id, reported_time, sender, subject, url, recipients_count,
clicked_count, credentials_submitted, emails_purged, passwords_reset, disposition
| Term | Definition |
|---|---|
| SPF (Sender Policy Framework) | DNS TXT record specifying which mail servers are authorized to send on behalf of a domain |
| DKIM | DomainKeys Identified Mail — cryptographic signature proving email content was not altered in transit |
| DMARC | Domain-based Message Authentication, Reporting and Conformance — policy combining SPF and DKIM alignment |
| Credential Harvesting | Phishing technique using fake login pages to capture username/password combinations |
| Business Email Compromise (BEC) | Social engineering attack using compromised or spoofed executive email for financial fraud |
| Message Trace | O365/Exchange log showing email routing, delivery status, and filtering actions for forensic analysis |
PHISHING INCIDENT REPORT — PHI-2024-0315
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Reported: 2024-03-15 09:12 UTC by jsmith (Finance)
Sender: attacker@evil-domain[.]com (SPF: FAIL, DKIM: NONE, DMARC: FAIL)
Subject: Urgent: Password Reset Required
Payload: Credential harvesting URL
IOCs:
URL: hxxps://evil-login[.]example[.]com/office365
Domain: evil-login[.]example[.]com (registered 2024-03-14, Namecheap)
IP: 185.234.xx.xx (VT: 12/90 malicious)
Scope:
Recipients: 47 users across Finance and HR departments
Clicked: 5 users visited phishing URL
Submitted: 2 users entered credentials (confirmed via POST in proxy logs)
Containment:
[DONE] 47 emails purged via Compliance Search
[DONE] Domain blocked on proxy and DNS sinkhole
[DONE] 2 user passwords reset, sessions revoked
[DONE] MFA enforced for both compromised accounts
[DONE] Inbox rules audited — no forwarding rules found
Status: RESOLVED — No evidence of lateral movement post-compromise