SIMULATED TRAINING CASE · SOC-005 · Phishing triage
Simulated phishing email investigation
A fictional email asks the recipient to verify an account using an unfamiliar URL. The exercise demonstrates safe triage and evidence collection.
SIMULATED · NOT A REAL INCIDENTINITIAL SEVERITY: LOWInvestigation brief
Objective
Determine what the provided evidence supports, what remains unknown, and which next steps are proportionate.
Evidence scope
A deliberately small synthetic sample. There is no endpoint access, full SIEM dataset or independent threat intelligence.
Analyst posture
Validate the signal, seek corroboration, document confidence and avoid treating indicators as identities.
Evidence timeline
| Time (UTC) | Observed training event |
|---|---|
| 11:20:00 | Message received: Subject: Urgent account verification |
| 11:20:03 | Sender display name does not match sender domain |
| 11:21:00 | URL in message: https://login.example.invalid/verify |
| 11:23:00 | Analyst flags for review without opening link |
Sample log extract
11:20:00 Message received: Subject: Urgent account verification 11:20:03 Sender display name does not match sender domain 11:21:00 URL in message: https://login.example.invalid/verify 11:23:00 Analyst flags for review without opening link
Findings and limitations
Supported assessment
Suspicious indicators justify caution, but the exercise provides no sandbox detonation or malware verdict.
Recommended next steps
Preserve original headers; review sender authentication and URL reputation using approved tools; advise recipient not to interact until validated.
Learning outcomes
This exercise demonstrates a repeatable SOC workflow: validate the detection, construct a timeline, identify missing evidence, assess risk and recommend proportionate actions. The narrative is a worked training example, not a report from an actual incident.