← Phishing Email Triage: From Message Evidence to Containment
1. Preserve and Read the Message
Start with Safe Handling and an Investigation Question Reconstruct Routing and Sender Identities
2. Authenticate and Analyze the Content
Interpret SPF, DKIM, DMARC, and Alignment Analyze URLs, Redirects, and Landing Evidence
3. Scope, Decide, and Contain
Triage Attachments Without Turning Analysis into Execution Scope Exposure, Choose a Disposition, and Write the Case
3. Scope, Decide, and Contain

Triage Attachments Without Turning Analysis into Execution

Identify file type, preserve hashes and metadata, and escalate active-content analysis into an isolated environment.

In this lesson, you will learn to:

  • Perform a safe static triage of an attachment.
  • Select an isolated analysis method and explain the limits of a clean or malicious result.

Triage Attachments Without Turning Analysis into Execution

Explains extension and signature mismatches, archive handling, static indicators, sandbox limits, and the evidence required before broad blocking.

Establish what the file is before opening it

Preserve the attachment through the mail platform or an approved evidence export. Record the displayed filename, size, MIME declaration, archive position, cryptographic hash, and the message that carried it. Determine file type from content signatures with approved tooling rather than trusting the extension. A double extension, right-to-left display trick, macro-capable document, disk image, script, shortcut, or encrypted archive changes handling risk, but the analyst still needs evidence of behavior or policy violation.

Begin with static checks that do not render active content: file signature, archive listing, document metadata, embedded relationships, macro presence, signature status, and internal strings where authorized. Do not extract an archive onto a normal workstation or supply a password to an uncontrolled public service. Hash reputation can show prior observations, but a new file has no reputation and a shared hash can belong to a legitimate dual-use tool. Record both positive findings and collection limits.

Attachment triage passes through evidence and safety gatesPreservation, type identification, static inspection, policy checks, and isolated execution prevent accidental activation.FIELD GUIDEAttachment triage passes through evidence and safetygatesPreserve andhashIdentify realtypeStaticinspectionIsolated runif neededCHECKPOINTS1Preserve andhash2Identify realtype3StaticinspectionDECISION GATES
Attachment triage passes through evidence and safety gates — Preservation, type identification, static inspection, policy checks, and isolated execution prevent accidental activation.

Use dynamic analysis as one observation, not an oracle

Dynamic analysis belongs in an isolated, monitored environment with a defined egress policy. The sample may detect a sandbox, require user interaction, delay execution, depend on a missing application, or contact infrastructure that is already offline. A quiet run therefore means “no behavior was observed under these conditions,” not “the file is clean.” Conversely, a document spawning a script engine, writing an executable, creating persistence, or contacting an unrelated host is meaningful behavior that can guide scoping.

Capture the environment, start time, interactions performed, process tree, file and registry changes, network destinations, and screenshots that explain the conclusion. Avoid executing samples merely to satisfy curiosity; ask which decision the run will support. If enterprise blocking is proposed, consider whether the hash identifies the exact file, whether a certificate or filename is shared, and whether a behavior-based control is safer than a brittle indicator. Escalate malware handling when legal, privacy, or containment authority is unclear.

A sandbox is an observation boundaryObserved behavior depends on environment, time, interaction, network access, and evasion, so absence of activity is not proof of safety.FIELD GUIDEA sandbox is an observation boundaryTRUST BOUNDARYSample and controls •Recorded process andnetworkMissing dependency •Delay, evasion, or deadinfrastructureCHECKPOINTS1Sample andcontrols2Recorded processand network3MissingdependencySANDBOX BOUNDARY
A sandbox is an observation boundary — Observed behavior depends on environment, time, interaction, network access, and evasion, so absence of activity is not proof of safety.

Resources

  • Microsoft file submission guidance — Review the official submission workflow and evidence expectations before sending a suspected malicious or falsely detected file for vendor analysis.
← Previous: Analyze URLs, Redirects, and Landing Evidence Next: Scope Exposure, Choose a Disposition, and Write the Case →