PHISHING INCIDENT RUNBOOK / PLAYBOOK

🎯 Purpose

To detect, analyze, contain, eradicate, and recover from phishing attacks while minimizing user impact and preventing recurrence.

🔹 1. Detection & Reporting

Sources

• User-reported email (Phish Report button / helpdesk)
• Email security gateway alerts
• SIEM alerts
• EDR/XDR detections
• Threat intelligence feeds

Initial Actions

• Acknowledge report
• Create an incident ticket
• Preserve the original email (do not delete yet)

🔹 2. Initial Triage (Quick Assessment)

Ask:

• Is this phishing, spam, or legitimate?
• Was the email delivered to multiple users?
• Did any user click links or open attachments?
• Are credentials possibly compromised?

Indicators to Check

• Sender domain mismatch
• Suspicious URLs
• Urgent language (“verify now”, “account locked”)
• Unexpected attachments
• Spoofed brand or internal user

🔹 3. Classification

TypeDescriptionSpamLow risk, no action neededPhishingCredential theft attemptSpear PhishingTargeted individualWhalingTargeting executivesMalware PhishingMalicious attachment/link

Assign severity (Low / Medium / High / Critical).

🔹 4. Investigation

Analyze Email

• Headers (SPF, DKIM, DMARC)
• Sender IP & domain reputation
• URLs (sandbox / URL analysis)
• Attachments (hash, sandbox scan)

Scope

• Number of recipients
• Who clicked?
• Who entered credentials?
• Any malware execution?

🔹 5. Containment (Time-Critical)

• Block sender domain & IP
• Block URLs at email gateway, proxy, firewall
• Quarantine similar emails
• Disable compromised user accounts
• Force password resets
• Revoke active sessions / tokens

🔹 6. Eradication

• Remove malicious emails from all mailboxes
• Clean infected endpoints
• Delete malicious files
• Remove persistence mechanisms
• Update email filtering rules

🔹 7. Recovery

• Restore access for affected users
• Monitor accounts for suspicious activity
• Verify systems are clean
• Reinstate services if disrupted

🔹 8. User Communication

• Notify affected users
• Provide guidance:
• Do not click similar emails
• Report suspicious messages immediately
• Conduct targeted security awareness if needed

🔹 9. Post-Incident Activities

Lessons Learned

• How did it bypass filters?
• Which control failed?
• Detection time vs response time

Improvements

• Update email security rules
• Enhance SIEM detection
• Improve phishing simulations
• Update training content

🔹 10. Metrics to Track

• Time to detect (TTD)
• Time to contain (TTC)
• Number of affected users
• Click-through rate
• Credential compromise rate