Phishing Analysis

Question

I am currently analyzing and exploring daily phishing attempts. Some at points, I am unable to definitively verify if this is, in fact, a phishing attempt.

When analyzing phishing attempts, specifically spear phishing, has one ever felt the need for an isolated analysis machine where you can click on links to your leisure and download PUA's?

The process I have undergone is essentially:

1. check headers end-to-end,
2. if it seems legit move to URL scanners like Virus Total & Symantec URL checker etc.
3. if this checks out assume it was never scanned or crawled and try to understand why the end user reported this as phishing etc.

Beyond the typical 100% definitively confirmed phishing attempts where a user utilizes poor grammar, shortened URL's, sketchy URL extensions or sketchy attachments, at what point should one stop putting time and effort into analyzing a phishing attempt?

I understand this question may sway towards an opinion, however I would like to direct the answers towards trying to prevent false negatives. When we have a legitimate email but things still cannot be confirmed and we label it as phishing.

Is it safer to always abide by the "trust no one policy"?

Answer 1

I'm concerned that you seem to only have 2 categories:

• confirmed legitimate
• phishing

You need at least a 3rd category: "unknown".

You also do not describe how you define "phishing" but it looks like you have a very broad definition. Phishing is still a very technical term with specific markers. You might want to consider using the category of "social engineering" to avoid locking your analysis into an unhelpful model.

For instance, what about the first of a string of emails to engage in a relationship with a recipient? The email can come from a legitimate source and not have attachments or links, just a simple start to a seemingly benign conversation. The actual "phishing" happens later. How do you analyse that first email? How do you classify it? The analysis can come up clean, but you cannot decide if it is phishing (yet) or legitimate business communication. It has to fall into a 3rd category to allow the communication but to alert users to remain on guard.

This "unknown" category gives you the freedom to conclude the analysis without wasting time trying to confirm something that can never be confirmed and tagging the email in this way still informs the user who reported it. This is different from "trust no one", but rather "maintain healthy levels of suspicion until trust is warranted" which is a much more helpful message to users and avoids false negatives.