Overview:

This repository contains a structured phishing investigation playbook developed using Microsoft Defender XDR Advanced Hunting.

The objective of this playbook is to guide Security Operations Center (SOC) analysts through:

• Phishing email analysis
• URL and attachment investigation
• User interaction validation
• Identity compromise assessment
• Endpoint compromise validation
• Threat hunting opportunities
• Detection engineering use cases
• Incident response recommendations

Investigation Workflow

1. Email Received
2. Email Analysis
3. Sender Reputation Analysis
4. URL & Attachment Analysis
5. User Click Verification
6. Identity Investigation
7. Endpoint Investigation
8. Threat Hunting
9. Containment & Remediation

Data Sources Used

Email Security

• EmailEvents
• EmailUrlInfo
• EmailAttachmentInfo
• EmailPostDeliveryEvents
• UrlClickEvents

Identity

• SigninLogs
• AADNonInteractiveUserSignInLogs
• AADRiskyUsers
• AADUserRiskEvents
• AuditLogs

Endpoint

• DeviceEvents
• DeviceProcessEvents
• DeviceNetworkEvents
• DeviceFileEvents
• DeviceRegistryEvents
• DeviceLogonEvents

Cloud Activity

• CloudAppEvents
• OfficeActivity
• AzureActivity

MITRE ATT&CK Coverage

Technique	Description
T1566	Phishing
T1078	Valid Accounts
T1114	Email Collection
T1539	Steal Web Session Cookie
T1098	Account Manipulation
T1056	Credential Access
T1027	Obfuscated Files
T1041	Exfiltration Over C2 Channel

Objectives

• Identify phishing attempts
• Detect user interaction with malicious content
• Investigate credential theft indicators
• Identify account compromise
• Validate endpoint impact
• Support containment and remediation activities

---

---

---

INVESTIGATION STEPS:

Phase 1 – Email Analysis

Objectives: Determine whether the email is Legitimate/ Spam/ Promotional/ Phishing/ Business Email Compromise (BEC)

Subject Line Analysis

Review:

• Urgency indicators
• Credential requests
• Payment requests
• Financial themes
• Executive impersonation
• MFA verification requests

Examples:

• Immediate Action Required
• Password Expiring Today
• Verify Your Account
• Unpaid Invoice
• Payroll Update

Email Metadata Analysis

Investigate:

• Sender address
• Display name spoofing
• Sender domain
• Sender IP
• Return-path
• SPF
• DKIM
• DMARC

Validate:

• Domain reputation
• Sender IP reputation
• Authentication results
• SCL & BCL score

Email Content Analysis

Review:

• Embedded URLs
• Attachments
• QR Codes
• HTML content
• Brand impersonation indicators

KQL Query:

EmailEvents
| where NetworkMessageId == ""
| project
     TimeGenerated,
     SenderFromAddress,
     SenderDisplayName,
     SenderFromDomain,
     RecipientEmailAddress,
     Subject,
     UrlCount,
     AttachmentCount,
     DeliveryAction,
     DeliveryLocation,
     OrgLevelAction,
     OrgLevelPolicy,
     EmailAction,
     EmailActionPolicy,
     EmailDirection,
     SenderIPv4,
     SenderIPv6,
     InternetMessageId,
     NetworkMessageId,
     AuthenticationDetails,
     To,
     Cc,
     EmailSize
| order by TimeGenerated desc

Phase 2 – URL and Attachment Investigation

URLs

Validate:

• URL reputation
• Domain age
• Redirect chain
• Credential harvesting behavior
• Malware delivery

Investigate:

• VirusTotal
• URLScan
• Any.Run/Sandbox
• Microsoft Defender

Attachments

Validate:

• File extension
• SHA256
• Reputation
• Sandbox results

Common malicious file types: ISO, IMG, HTA, ZIP, RAR, XLSM, DOCM, LNK, EXE, JS

KQL QUERY:

union EmailUrlInfo, EmailAttachmentInfo, EmailPostDeliveryEvents
| where NetworkMessageId == ""
| project
    Type,
    TimeGenerated,
    NetworkMessageId,
    FileName,
    FileSize,
    FileType,
    FileExtension,
    SHA256,
    SenderFromAddress,
    RecipientEmailAddress,
    Url,
    UrlLocation,
    UrlDomain,
    Action,
    ActionResult,
    ActionTrigger,
    ActionType,
    DeliveryLocation,
    InternetMessageId
| order by TimeGenerated desc

Phase 3 – User Interaction Validation

Verify:

• Email delivered?
• Email quarantined?
• URL clicked?
• Attachment opened?

If no interaction: Risk = Low

If interaction occurred: Proceed to identity investigation.

KQL QUERY:

UrlClickEvents
| where AccountUpn == ""
| project
    Timestamp,
    AccountUpn,
    Url,
    ActionType,
    IsClickedThrough,
    IPAddress
| order by Timestamp desc

Phase 4 – Identity Investigation

Investigate:

• Successful sign-ins
• Failed sign-ins
• Impossible travel
• New countries
• New IPs
• New devices
• Risky sign-ins

Review:

• MFA changes
• Password resets
• Device registrations
• Consent grants

KQL QUERY:

union SigninLogs, AADNonInteractiveUserSignInLogs
| where UserPrincipalName == ""
| project
     TimeGenerated,
     UserPrincipalName,
     Location,
     IPAddress,
     ResultType,
     ResultDescription,
     AuthenticationRequirement,
     DeviceDetail_dynamic,
     DeviceDetail_string,
     AppDisplayName,
     AuthenticationDetails, 
     AuthenticationProtocol,
     ConditionalAccessStatus,
     ClientAppUsed, Identity,
     ResourceDisplayName,
     UserAgent, 
     UserId,
     AuthenticationRequirementPolicies,
     SessionID
| order by TimeGenerated desc

SigninLogs
| where UserPrincipalName == ""
| where TimeGenerated > ago(30d)
| summarize
    Countries=make_set(Location),
    IPs=make_set(IPAddress)

union AADRiskyUsers, AADUserRiskEvents
| where UserPrincipalName == ""
| project
     Type,
     TimeGenerated,
     UserId,
     UserDisplayName,
     UserPrincipalName,
     OperationName,
     IpAddress,
     Activity,
     RiskDetail,
     RiskLevel,
     RiskState,
     RiskLastUpdatedDateTime,
     RiskEventType,
     Location,
     AdditionalInfo
| order by Type

AuditLogs
| where TargetResources contains ""
| project
     TimeGenerated,
     InitiatedBy,
     TargetResources,
     OperationName,
     Category,
     ActivityDisplayName, 
     Id,
     Identity,
     Result,
     ResultDescription,
     ResultReason,
     AdditionalDetails
| order by TimeGenerated

Phase 5 – Endpoint Investigation

Review:

• Suspicious processes
• Browser activity
• Network connections
• File downloads
• Persistence mechanisms

Look for:

• PowerShell
• CMD
• Rundll32
• Regsvr32
• MSHTA

Phase 6 – Threat Hunting

Hunt for:

• Similar emails
• Similar URLs
• Same sender domain
• Same attachment hash
• Same IP

Determine:

• Additional affected users
• Campaign spread
• Related indicators

KQL QUERIES:

EmailEvents
| where SenderFromDomain == "maliciousdomain.com"
| summarize Recipients=dcount(RecipientEmailAddress)

EmailUrlInfo
| where UrlDomain == "maliciousdomain.com"

EmailAttachmentInfo
| where SHA256 == "HASH"

UrlClickEvents
| join kind=inner (
    SigninLogs
) on $left.AccountUpn == $right.UserPrincipalName

Detectinon Logics:

• User clicks the URL -> Successful login within 30mins -> Unusual location/IP
• Multiple Users Receive these emails from Same Sender Domain
• Same attachment (SHA256) has been sent to multiple users - Malicious Attachment Campaign

Tuning/ Improvements of detection rules:

URL click + login correlation followed by,

• Inbox rule creation
• New MFA registration
• OAuth consent grants
• Impossible travel after URL click

Phase 7 – Containment

Email Actions:

• Purge emails
• Block domains
• Block URLs
• Block IPs
• Block hashes

If compromise confirmed, User account actions:

• Disable account
• Reset password
• Revoke all sessions
• Force MFA re-registration
• Initiate endpoint scan
• Investigate persistence
• Remove malicious files

Lessons Learned

Document:

• Root cause
• Affected users
• Compromised assets
• Detection gaps
• Improvements implemented
• New detections created