defensive-security · beginner

Phishing Email Triage

Inspect fictional email metadata and content safely, correlate indicators, and document an evidence-based classification.

beginner50 mins10 tasks100 XP

Start Lab

What you will learn

Section 1 · 10 tasks

Phishing Email Triage

Inspect sender, recipients, language, links, attachments, and authentication signals without opening or contacting anything.

Learning objectives

What Is Phishing?
Inspect the Sender
Inspect the Recipient
Read the Subject and Message
Inspect Links Safely
Inspect Attachments
Email Authentication Signals
Correlate Evidence
Classify the Email
Final Phishing Investigation

Skills

phishingspear-phishingsocial-engineeringsenderrecipientreply-toreturn-pathemail-headerspfdkimdmarcattachmenturldomainlookalike-domainauthenticationemail-securityindicatorfalse-positivetriageevidenceanalyst-note

Prerequisites

SOC Alert Triage

Recommended next rooms

Linux Event Logs
Investigate fictional Linux authentication and system events while separating observations from conclusions.
System Logs & Troubleshooting
Practice an evidence-driven troubleshooting workflow against fictional services and logs.
SSH Brute-Force Detection
Detect and document repeated fictional SSH authentication failures without attempting access.