Phishing Incident Response Playbook — Containment, Investigation, and Recovery Procedures

Phishing incidents move quickly from suspicion to operational risk. A single malicious email can lead to credential theft, unauthorized mailbox access, malware delivery, or deeper compromise of internal systems. Response teams therefore need a procedure that is both fast and disciplined: fast enough to limit exposure, but structured enough to preserve evidence and avoid missing secondary impact.

This playbook is designed for enterprise environments handling suspicious email activity, confirmed phishing attempts, or user-reported credential exposure. It focuses on practical decision-making during the early and middle stages of an incident, when security teams must determine whether the event is limited to a single inbox or whether it forms part of a broader intrusion path involving Initial Access, Credential Harvesting, Session Hijacking, or Malware Delivery.

When to Use This Playbook

This playbook should be used when any of the following conditions apply:

a user reports a suspicious email requesting credentials, payments, or urgent action
credentials may have been entered into a fraudulent login page
an attacker may have gained access to a corporate mailbox
phishing emails were delivered to multiple users across the organization
email attachments or links may have resulted in malware execution

This procedure is especially relevant where phishing activity may be associated with Credential Stuffing, Brute Force Attack follow-on activity, or broader compromise of identity systems.

Response Objectives

During a phishing response, the security team should work toward five parallel objectives.

Objective	Purpose
Confirm scope	Determine whether the incident involves one user or many
Contain access	Prevent further authentication abuse or mailbox compromise
Preserve evidence	Retain email headers, URLs, attachments, and log data
Identify impact	Establish whether credentials, sessions, or endpoints were affected
Restore trust	Reset affected accounts and remove malicious artifacts

A weak phishing response often focuses only on deleting the email. A strong response treats the message as a potential entry point into broader enterprise compromise.

Initial Triage

Triage begins the moment the report reaches the security team. The first task is to determine whether the message is merely suspicious, clearly malicious, or already tied to user interaction.

During triage, collect:

the original message, preferably as an attachment or full header export
sender details, recipient details, and delivery timestamps
all embedded URLs
attachment names, hashes, and file types
the reporting user’s actions, including clicks, downloads, or credential entry

At this stage, analysts should distinguish between three scenarios:

delivered only — the message reached the mailbox but was not interacted with
user interaction occurred — links were clicked, files opened, or credentials submitted
post-compromise indicators exist — suspicious logins, inbox rule creation, session anomalies, or endpoint alerts

That distinction determines whether the response remains email-focused or becomes an identity and endpoint incident.

Immediate Containment Actions

Containment should begin as soon as there is reasonable evidence that the message is malicious or that user interaction has taken place.

Priority actions include:

remove the malicious email from all reachable mailboxes
block sender addresses, sending domains, URLs, and attachment hashes where appropriate
disable or restrict affected user accounts if credential exposure is likely
revoke active sessions and refresh authentication tokens
isolate affected endpoints if attachments were opened or scripts executed

If the user entered credentials into a phishing page, the account should not simply receive a password reset and be left as-is. Analysts should assume existing sessions may remain valid until explicitly revoked. This is particularly important in environments with single sign-on, persistent browser sessions, or federated identity providers.

User Account Protection

When credentials may have been exposed, identity protection becomes the central part of the response.

Required actions usually include:

force password reset for the affected account
revoke active sign-in sessions
invalidate refresh tokens where supported
review recent login history and failed login events
re-register or verify multi-factor authentication settings if compromise is suspected

If the affected mailbox belongs to an executive, administrator, finance user, HR staff member, or privileged engineer, the response should be escalated immediately. Those roles often have broad access and are common targets in phishing campaigns designed for deeper intrusion or business process abuse.

Mailbox compromise should also be reviewed for persistence techniques such as unauthorized forwarding rules, hidden inbox rules, altered recovery settings, or malicious delegated access.

Email and Infrastructure Investigation

Phishing rarely exists in isolation. A message delivered to one user may also have reached shared mailboxes, distribution groups, or multiple departments.

The investigation should include:

searching mail infrastructure for matching message IDs, sender patterns, subjects, URLs, and attachments
determining how many recipients received the message
identifying whether similar messages were blocked earlier or delivered to external affiliates
reviewing whether the sending domain is newly registered, spoofed, or previously associated with abuse

Where possible, review secure email gateway telemetry, message trace results, sandbox analysis, and historical delivery patterns. If the campaign is broad, the event should be treated as an organizational phishing incident rather than a single-user issue.

This is also the stage where analysts should evaluate whether the phishing email is part of a more targeted operation involving Reconnaissance against a specific department, financial workflow, or identity system.

Endpoint Investigation

If an attachment was opened or if the user downloaded content from a malicious site, the endpoint must be examined for follow-on activity.

Review:

process execution chains after the email interaction
downloads written to temporary or user directories
script execution through office applications, archive tools, or browser child processes
outbound network connections established after the event
persistence artifacts such as scheduled tasks, startup entries, or new services

These checks are particularly important because phishing often serves as a delivery mechanism for loaders, stealers, or remote access tools. Depending on the campaign, the endpoint may show behavior consistent with Persistence, Defense Evasion, or external Command and Control communication.

If endpoint alerts exist, they should be correlated with the timing of the email event rather than analyzed separately.

Indicators of Mailbox Compromise

Where phishing led to account access, mailbox abuse can continue even after the original message is gone.

Investigators should look for:

new inbox rules forwarding, hiding, or deleting messages
changes to display name, signature, or recovery settings
unusual access from foreign IP addresses or impossible travel patterns
searches for financial terms, invoices, wire transfers, payroll, or HR topics
suspicious outbound messages sent from the compromised mailbox

Mailbox compromise frequently becomes the starting point for further fraud, especially in payment diversion and executive impersonation scenarios. If the mailbox belongs to finance, legal, or procurement personnel, downstream verification of pending transactions is essential.

Eradication and Recovery

Once containment and investigation have stabilized the incident, recovery should focus on returning the user and affected systems to a trusted state.

Core recovery actions include:

confirm malicious emails have been removed from all identified mailboxes
verify password reset, token revocation, and MFA integrity
remove malicious mailbox rules or unauthorized delegates
clean or rebuild affected endpoints where execution occurred
monitor affected accounts closely for recurrent suspicious activity

Recovery is not complete when the user regains mailbox access. It is complete when the account, endpoint, and associated identity surfaces have been reviewed and restored with reasonable confidence that the attacker no longer retains access.

Communications and Internal Coordination

A phishing incident often requires more than a technical response. Internal communications should be calibrated to the scale of the event.

Depending on impact, notify:

the affected user and their manager
identity or messaging administrators
legal or compliance stakeholders if sensitive information was exposed
finance leadership if payment processes may have been targeted
executive stakeholders if the campaign affected privileged or high-visibility accounts

User-facing communication should remain precise. Avoid broad warnings that create panic unless the campaign is organization-wide. If many employees were targeted, a short internal advisory with screenshots, sender patterns, and reporting instructions is usually more effective than generic awareness messaging.

Lessons Learned and Hardening Actions

After resolution, the incident should be reviewed for control failures and improvement opportunities.

Recommended follow-up actions include:

tuning mail filtering rules based on the campaign characteristics
improving detection logic for suspicious login patterns and token abuse
strengthening user reporting workflows for suspicious messages
reviewing high-risk roles for stronger session controls and conditional access rules
updating awareness material to reflect the actual lure and language used in the campaign

Where the event exposed a gap in visibility, teams should decide whether logging, email telemetry, browser protections, or identity controls need to be expanded. Mature programs treat phishing response as an operational feedback loop, not just an isolated ticket.

Phishing incidents frequently intersect with several other areas of the SECMONS knowledge base.

For technique background, review Phishing, Credential Harvesting, Session Hijacking, Initial Access, and Malware Delivery.

For monitoring and investigation workflows, related operational concepts include Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), and Threat Hunting.

Phishing also appears repeatedly across real-world incidents and threat activity profiles, especially where attackers aim to convert a single user interaction into a wider enterprise intrusion.