Phishing Investigation: No SIEM Required
The lowest-barrier project on this hub — no software install, no cloud account, no VM. Just a real email and a careful eye. By the end, you’ll have a documented investigation to show for it.
What you’ll build
This project is different from the Splunk and Sentinel builds — no SIEM, no cloud account, no local install. You’re investigating a single phishing email the way a real analyst would during triage: examining the sender, the headers, and the link, then documenting what you found and why it matters.
This maps to MITRE ATT&CK Technique T1566 (Phishing) — the single most common initial access technique in real attacks, which is exactly why every SOC analyst role expects at least basic phishing triage skills.
Setup: what you actually need
Nothing to install and nothing to pay for.
Where to get a sample — safely: Use a real phishing or spam email you’ve personally received. Check your spam/junk folder — almost everyone has genuine examples sitting there already. This is deliberately safer and more realistic than downloading “sample phishing” files from an unknown source, which is why this guide doesn’t link to one.
You’ll also want a free email header analyzer — MXToolbox’s Email Header Analyzer is a solid, well-established option that parses raw headers into something readable, checking SPF/DKIM/DMARC alignment automatically.
Step-by-step investigation
Get the full headers, not just the preview
In Gmail: Open the email → three-dot menu → “Show original.” In Outlook: File → Properties → Internet headers. This gives you the raw routing information most email clients hide by default.
Run the headers through an analyzer
Paste the full headers into MXToolbox’s analyzer. Check three things specifically:
- Does the “From” address match the actual sending server?
- Do SPF, DKIM, and DMARC show as pass or fail?
- Does the Reply-To address differ from the From address?
Inspect the link without clicking it
Hover your mouse over any link (don’t click) — most email clients show the real destination URL in a status bar or tooltip. Compare that real URL against what the link text claims to be, and against the sender’s actual domain.
Never click through directly. Per CISA’s official phishing guidance, resist the temptation to click suspicious links even out of curiosity — hovering to preview is the safe way to inspect a URL.
Extract your indicators of compromise
Write down: the sender’s actual domain, the real destination URL from the link, and any header mismatches you found. These are your IOCs — the specific artifacts that prove this was phishing, not just your opinion that it looked suspicious.
Classify the severity
Was it a broad, generic attempt or specifically targeted at you? Did it try to harvest credentials, deliver an attachment, or just phone-based social engineering? Rate it Low, Medium, or High based on sophistication and what it was actually trying to achieve.
Document your findings
Screenshot the header analysis results (with any personal information redacted) and write up your investigation using a structured format — this is where the Incident Report Template below does the heavy lifting.
Write it up properly
This project pairs directly with the Incident Report Template — severity, timeline, IOCs, all built for exactly this kind of investigation.
Get the Incident Report Template →Give it a project overview too
Pair the incident report with a README summarizing the project for anyone skimming your GitHub.
Get the README Template →What this proves to an employer
This is often the very first triage skill a SOC analyst uses on the job — most tickets in a real queue start as “is this email actually malicious?”
Frequently asked questions
Where do I get a phishing email to investigate?
Use one you’ve actually received — almost everyone has phishing or spam in their inbox or spam folder. This is safer and more realistic than downloading samples from an unknown source, and it’s genuinely how many analysts get their first hands-on look at real phishing patterns.
Is it safe to click the link to see where it goes?
No — never click a suspicious link directly. Hover over it to preview the destination URL in your browser or email client, which shows you the real address without visiting it.
Do I need any paid tools for this project?
No. A free email header analyzer and your own judgment are enough. This project is specifically designed to require no SIEM, no paid software, and no lab setup.
That’s all three SOC projects done.
Brute-force detection, identity misuse, and phishing triage — three genuinely different skills, properly documented. That’s a real portfolio.
Back to the Portfolio Hub →