The Phishing Triage Handbook

Stop memorizing definitions and start understanding the logic.

Most Junior SOC Analysts struggle with technical interview questions regarding email security protocols, but this 25-page comprehensive guide is designed to take you from a junior level to mastering professional Standard Operating Procedures (SOPs).

This handbook provides a deep dive into the technical roadmap of email investigation, moving beyond the visible "From" field to uncover the truth behind malicious messages.

What’s Inside the Handbook?

Chapter 1: Fundamentals of Email Forensics: Learn the critical difference between a "nuisance" (Spam) and a "targeted criminal attack" (Phishing).

Chapter 2: Advanced Header Analysis: Master the "Magic Three"—SPF, DKIM, and DMARC. Learn why emails failing these checks are 3.2 times more likely to contain malicious URLs.

Chapter 3: Tracing the Email Journey: Learn to read "Received" headers from bottom to top to find the true origin and identify sender discrepancies in the "Return-Path" or "Message-ID."

Chapter 4: Safe Sandboxing & Artifact Scrutiny: Step-by-step instructions for using Windows Sandbox, VirusTotal, and ANY.RUN to detonate suspicious files without risking your host machine.

Chapter 5: Decision-Making Frameworks: Distinguish between social engineering tactics (urgency, whaling) and technical red flags (Punycode, typosquatting).

Chapter 6: The SOC Phishing Report Template: A standardized reporting guide based on the NIST forensic framework (Collection, Examination, Analysis, and Reporting).

Exclusive Analyst Tools Included:

✅ The 60-Second Investigator’s Flowchart: A rapid decision-making framework for high-pressure environments.

✅ The Analyst’s Communications Kit: Professional email templates for alerting users of "True Positives" or clearing "False Positives."

✅ Final Knowledge Assessment: A 15-question quiz designed like a "flight simulator" to test your application of forensic concepts in real-world scenarios.

✅ Glossary of Essential Terms: 20 critical industry terms to ensure you "stop guessing and start using the right tools."

Whether you are preparing for your first SOC interview or looking to standardize your team’s incident response, this handbook provides the technical foundation you need to mitigate cyber risks effectively.

Publisher: GhostCode Reboot (2025) Format: Digital PDF (25 Pages)

The Mechanic's Tool Chest Analogy: Learning this handbook is like memorizing the labels on a mechanic’s tool chest; once you know exactly what a "DMARC" or a "Sandbox" is, you can stop guessing and start using the right tool to fix the security problem in front of you.