RUNBOOK // Phishing Triage, Scoping & Tenant-Wide Purge

COMMON INCIDENT MDO / DEFENDER FOR OFFICE 365 Target Time to Triage & Purge: < 15 minutes

Phishing remains the #1 initial access vector for credential theft, malware droppers, and business email compromise. This runbook details the rapid end-to-end triage procedure from user report to tenant-wide purge.

---

🛑 Step 1: Initial Email Analysis & Header Verification

Save the reported email as .eml or inspect headers in the Defender for Office 365 Explorer / Microsoft Message Header Analyzer:

Critical Header Inspection Points:

1. SPF (Sender Policy Framework):
   • Received-SPF: pass vs. fail / softfail.
   • Checks if sending server IP is authorized in sender domain DNS.
2. DKIM (DomainKeys Identified Mail):
   • dkim=pass (signature verified) vs. fail.
   • Validates cryptographic body signature against sender’s public key.
3. DMARC (Domain-based Message Authentication):
   • Must achieve Alignment (SPF or DKIM domain must match the visible From: header domain).
4. Mismatched Return-Path:
   • Check if Return-Path (envelope sender) differs from the friendly From: address.
5. Display Name Spoofing:
   • Attacker uses an executive’s name (e.g., “CEO Name”) with a free Gmail/Outlook address (ceo.company@gmail.com).

---

🔎 Step 2: Tenant-Wide Blast Radius Scoping (KQL)

Determine how many other users received this campaign across the organization.

1. KQL Query: Find All Inbound Messages in This Campaign

Query EmailEvents using the sender address, subject line, or sender IP:

let Lookback = 7d;
let SuspectSubject = "Urgent: Review Shared Document";
let SenderDomain = "malicious-notification.com";
EmailEvents
| where Timestamp > ago(Lookback)
| where Subject has SuspectSubject or SenderFromDomain =~ SenderDomain or SenderIPv4 == "185.220.101.5"
| project Timestamp, NetworkMessageId, InternetMessageId, RecipientEmailAddress, SenderFromAddress, Subject, DeliveryAction, DeliveryLocation
| sort by Timestamp desc

2. KQL Query: Did Any User Click the Malicious Link?

Query EmailUrlInfo and join with UrlClickEvents to see clicks and SafeLinks verdict:

let Lookback = 3d;
let SuspectUrl = "hxxps://verify-account-update[.]com";
UrlClickEvents
| where Timestamp > ago(Lookback)
| where Url has "verify-account-update" or Url == SuspectUrl
| project Timestamp, AccountUpn, ActionType, ClickVerdict, Url, IPAddress, Workload
| sort by Timestamp desc

• ClickVerdict == 'Allowed' or 'Blocked': If allowed, user actively reached the landing page. Proceed to credential compromise checklist immediately.

---

🧹 Step 3: Tenant-Wide Inbox Purge (Compliance Search & MDO)

Remove the phishing email from all recipient inboxes across Microsoft 365:

Method A: Automated PowerShell Compliance Search & Hard-Delete

# Connect to Exchange Online & Security Compliance Center
# Connect-IPPSSession

$searchName = "PhishPurge_" + (Get-Date -Format "yyyyMMdd_HHmm")
$subjectQuery = "Urgent: Review Shared Document"
$senderQuery = "notifications@malicious-notification.com"

# 1. Create and start compliance search across all mailboxes
New-ComplianceSearch -Name $searchName -ExchangeLocation All -ContentMatchQuery "subject:`"$subjectQuery`" AND from:`"$senderQuery`""
Start-ComplianceSearch -Identity $searchName

Write-Host "Waiting for search to finish indexing..." -ForegroundColor Yellow
while ((Get-ComplianceSearch -Identity $searchName).Status -ne "Completed") {
    Start-Sleep -Seconds 5
}

$results = Get-ComplianceSearch -Identity $searchName
Write-Host "Found $($results.Items) items across $($results.SuccessResults) mailboxes." -ForegroundColor Green

# 2. Hard-Delete (Permanently removes from all user mailboxes & Recoverable Items)
New-ComplianceSearchAction -SearchName $searchName -Purge -PurgeType HardDelete -Confirm:$false
Write-Host "[+] Hard Delete action submitted." -ForegroundColor Cyan

Method B: Microsoft Defender Portal (GUI Explorer)

1. Navigate to Microsoft Defender Portal (security.microsoft.com) $\rightarrow$ Email & collaboration $\rightarrow$ Explorer.
2. Filter by Sender or Subject or NetworkMessageId.
3. Select all affected messages $\rightarrow$ Click Take actions.
4. Choose Move to Deleted Items or Hard delete.
5. Log action name and reason for audit trail.

---

⚡ Step 4: Clicked-User Credential Containment

If any user clicked and reached the destination page:

1. Immediate Session Invalidation:

   Revoke-MgUserSignInSession -UserId "victim.user@company.com"

2. Force Password Reset:

   Update-MgUser -UserId "victim.user@company.com" -PasswordProfile @{ ForceChangePasswordNextSignIn = $true; Password = "TempPassword!2026" }

3. Audit Inbox Rules for Stealth Forwarders:

   Get-InboxRule -Mailbox "victim.user@company.com" | Select-Object Name, ForwardTo, RedirectTo, MoveToFolder

4. Block Malicious URL & Domain at Gateway:
   • Add URL to Tenant Allow/Block List under Microsoft Defender Settings.
   • Add destination IP/domain to perimeter firewall / Secure Web Gateway blocklist.