SOC › Module 7 › Lesson 1
Detect Phishing
Phishing detection literacy — email gateway, URL click, credential harvest indicators — triage named class on $SOC_LAB sample alerts.
Visual · t29_detect_phishing
Detect phishing = named detection class literacy. $SOC_LAB sample alerts. Original Cyberlium.
Opening
Phishing detections fire on links and subjects — learn the named indicator class on YOUR sample alerts, never how to send phishing campaigns.
Phishing detection literacy names: email gateway alerts (suspicious sender, SPF/DKIM fail category), URL click telemetry, newly registered domain category, credential harvest page indicators, attachment macro category, and user-reported phish queue row. Analyst reads $SOC_LAB sample phishing alert — maps rule fields to MITRE Initial Access / Phishing tags at literacy level — documents triage steps from Module 6 — without sending phishing emails, without cloning login pages for stranger domains, without running credential harvest kits. Cyberlium teaches defender detection vocabulary on instructor synthetic email/proxy logs. Refused: phishing campaign against classmates, spoofed employer payroll login, mass mail without authorization. Lab row: five phishing indicator types with one triage action each on sample alert.
1. Named phishing indicators
Gateway block, suspicious URL click, lookalike domain, credential form, macro attachment — five literacy anchors.
Detection class literacy — not offensive email craft.
Command guide
Try these commands — Named phishing indicators
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: jq, curl. Reference sites: MITRE T1566 (https://attack.mitre.org/techniques/T1566/); MITRE T1566.001 (https://attack.mitre.org/techniques/T1566/001/); Elastic phishing (https://www.elastic.co/guide/en/security/current/prebuilt-rules.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Triage actions
Verify user click report, check proxy log stub, enrich sender domain, disposition FP/TP, open ticket if TP.
User-reported phish still needs analyst review — not auto-close.
3. $SOC_LAB boundary
Phishing triage on sample logs only — not sending phish or hosting harvest pages.
Refused: campaign execution, clone pages on stranger brands, credential theft exercises unauthorized.
4. What you ship: phishing detection literacy card
Five indicator types + triage action each + NEVER send phishing line.
5. What you record before the next lesson
Phishing detection literacy card path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Send simulated phishing to classmates without authorization as 'detection lab.'
Right
Phishing detection card from $SOC_LAB sample alert. Next: Detect Malware.
Mission: phishing detection literacy card
1) Name five phishing indicator types. 2) One triage action per type. 3) Map one sample alert to MITRE tag. 4) Write NEVER send phishing line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “User-reported phish — first enrichment step?”
Knowledge Check
APPLY: Phishing detection literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Sending unauthorized phishing email is lab.
True or False
Knowledge Check
APPLY: Email gateway alert may show:
Multiple choice