Description

This curriculum spans the technical and procedural rigor of a multi-workshop SOC enhancement program, addressing phishing from detection engineering through incident response and metrics, comparable to an internal capability build supported by continuous threat intelligence and cross-functional coordination.

Module 1: Understanding the Phishing Threat Landscape

Selecting and integrating threat intelligence feeds that specifically track active phishing infrastructure, including bulletproof hosting providers and fast-flux domains.
Mapping common phishing actor tactics, such as domain spoofing versus subdomain abuse, to prioritize detection rules in email gateways.
Determining whether to classify phishing attempts by payload type (e.g., credential harvesting, malware delivery) or by target sector for incident reporting.
Deciding how frequently to update internal blacklists of known malicious URLs based on telemetry from sandbox detonations.
Assessing the risk of targeted spear-phishing campaigns against executive accounts versus broad, untargeted campaigns affecting general users.
Integrating third-party brand protection services to detect fraudulent domains impersonating corporate assets before user exposure.

Module 2: Email Gateway Configuration and Filtering

Configuring SPF, DKIM, and DMARC policies with enforcement modes (quarantine vs. reject) based on domain alignment and sender volume.
Adjusting Bayesian filtering thresholds to reduce false positives on legitimate marketing emails while maintaining catch rates on obfuscated payloads.
Implementing file type blocking policies for high-risk attachments such as .js, .zip, and .iso based on organizational usage patterns.
Deploying URL rewriting at the gateway level and evaluating its impact on link inspection latency and user experience.
Managing allowlists for business-critical partners that consistently fail authentication checks due to legacy infrastructure.
Validating MIME header manipulation techniques used by attackers to bypass content filters and updating parsing rules accordingly.

Module 3: Detection Engineering for Phishing Artifacts

Developing Sigma rules to detect suspicious email headers, such as mismatched "From" and "Reply-To" addresses across mail logs.
Creating custom YARA rules to identify obfuscated JavaScript in HTML attachments extracted from email traffic.
Correlating failed login attempts with recent email delivery events to flag potential credential harvesting incidents.
Building analytics rules in SIEM to detect spikes in user-reported phishing emails within a short time window.
Implementing file reputation lookups via API integration with VirusTotal or hybrid analysis platforms during email processing.
Designing detection logic to identify homograph attacks using non-ASCII characters in apparent URLs.

Module 4: Incident Triage and Analysis Workflow

Defining escalation thresholds for phishing incidents based on target role (e.g., CFO vs. general staff) and payload severity.
Extracting and decoding embedded URLs from phishing emails using automated parsers while preserving original context for forensics.
Conducting memory and disk analysis on endpoints where malicious attachments were executed, even if EDR did not alert.
Mapping phishing URLs to associated IP addresses and checking for prior command-and-control activity in netflow data.
Determining whether to sinkhole or block malicious domains based on organizational authority and legal constraints.
Documenting attacker infrastructure patterns, such as shared hosting providers or certificate authorities, for future threat hunting.

Module 5: User Reporting and SOC Integration

Configuring email client add-ins to forward reported messages to a dedicated ingestion mailbox with metadata preservation.
Validating that user-reported emails are ingested into the SIEM with proper tagging and correlation to the reporting user’s identity.
Implementing automated triage workflows that extract IOCs from user-submitted emails and cross-reference them with existing threat data.
Setting SLAs for initial triage response to user reports based on organizational risk tolerance and staffing levels.
Designing feedback loops to inform users whether their report was actionable, while avoiding disclosure of sensitive IOCs.
Measuring false report rates from users and adjusting awareness training content based on recurring misclassifications.

Module 6: Threat Hunting for Latent Phishing Campaigns

Querying proxy logs for connections to domains that resemble corporate login portals but reside outside approved IP ranges.
Searching endpoint telemetry for PowerShell or certutil usage following the receipt of suspicious emails, even without alerts.
Using passive DNS data to identify newly registered domains that mimic legitimate business partners’ naming conventions.
Correlating email metadata with authentication logs to detect delayed credential theft attempts post-phishing.
Conducting memory dumps on high-value systems to uncover in-memory implants delivered via malicious document macros.
Developing hunting hypotheses based on adversary TTPs from recent phishing campaigns observed in industry ISACs.

Module 7: Phishing Response and Containment

Executing mailbox searches across the organization to identify additional recipients of a confirmed malicious email.
Removing malicious emails from user inboxes via automated scripts while preserving evidence for legal review.
Blocking malicious URLs at the proxy or DNS layer and assessing potential impact on legitimate business operations.
Resetting user passwords and reissuing MFA tokens for individuals who submitted credentials to phishing sites.
Coordinating with legal and PR teams before notifying external parties about compromised partner accounts.
Documenting containment actions in incident records to support post-incident review and compliance audits.

Module 8: Metrics, Reporting, and Continuous Improvement

Calculating mean time to detect (MTTD) and mean time to respond (MTTR) for phishing incidents across quarters to assess SOC performance.
Generating executive reports that quantify phishing volume, success rate, and containment effectiveness without disclosing technical vulnerabilities.
Mapping phishing incident data to MITRE ATT&CK to identify gaps in detection coverage for specific techniques.
Adjusting detection rule sensitivity based on quarterly false positive/negative analysis from analyst feedback.
Integrating phishing telemetry into tabletop exercise scenarios to validate incident response playbooks.
Reviewing third-party email security provider SLAs and performance metrics to justify renewal or migration decisions.