I85PREP
⌘ K
ECIH study materials
ECIH study resources

ECIH: Handling and Responding to Email Security Incidents

ECIH · Work through your exam, one topic at a time.

All guide sections

Handling and Responding to Email Security Incidents

Incident categories

Expect phishing, spear phishing (targeted), whaling (executives), clone phishing (a real thread replayed with swapped links), business email compromise (BEC, also called CEO fraud, often with no malware or URL at all), spoofing, malicious attachments (macros, ISO/LNK, HTML smuggling), credential-harvesting pages, thread hijacking, and mailbox rule abuse (auto-forwarding, hidden rules that hide replies).

Header analysis - the core skill

Read headers bottom-up along the Received chain to trace the actual path; remember the topmost Received line can be forged by the sender, so confirm the last trustworthy hop. Compare From with Return-Path and Reply-To - a mismatch is a strong BEC/phishing indicator. Check Message-ID and originating IP reputation, SPF (envelope sender authorised?), DKIM (signature valid and domain aligned?), and DMARC (alignment of SPF/DKIM with the visible From domain plus policy). Traps: DMARC pass proves the domain was authorised to send, not that the content is benign - a compromised legitimate mailbox passes every check. Conversely, a DMARC fail on a lookalike domain is damning.

Response steps

  1. Obtain the original message with full headers (not a forward).
  2. Analyse headers, URLs (defang, expand shorteners, check domain age), attachments (hash, sandbox).
  3. Scope: search the mail gateway/SIEM for all recipients of the same sender, subject, URL or hash.
  4. Contain: purge/quarantine from mailboxes, block sender/domain/URL/hash at the gateway and proxy, reset credentials of anyone who entered them, revoke sessions and tokens, remove attacker-created mailbox rules and forwarding.
  5. If malware executed, treat as an endpoint incident.
  6. Educate users, tune detections, run a lessons-learned review.

Worked example: a finance user receives an invoice email from a supplier's real address, but Reply-To points to a lookalike domain and a mailbox rule forwards replies externally - classic BEC after supplier mailbox compromise. Response: remove the rule, block the domain, warn the supplier, re-verify the payment change out-of-band by phone.