> For the complete documentation index, see [llms.txt](https://cybersecurity-cloud-and-it-notes.gitbook.io/kyles-cybersecurity-cloud-and-it-gitbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybersecurity-cloud-and-it-notes.gitbook.io/kyles-cybersecurity-cloud-and-it-gitbook/google-cybersecurity-professional-cert/5.-assets-threats-and-vulnerabilities/module-4/activity-filter-malicious-emails.md).
# Activity: Filter malicious emails
### Activity Overview
In this activity, you will analyze a suspicious email and identify signs of a phishing attack. Then, you will determine whether the email should be allowed or quarantined.
Phishing is one of the most common and dangerous forms of social engineering that you’ll encounter in the field. Identifying phishing attempts will help you prevent threats and find ways to improve security procedures.
### Scenario
Review the scenario below. Then complete the step-by-step instructions.
You’re a security analyst at an investment firm called Imaginary Bank. An executive at the firm recently received a spear phishing email that appears to come from the board of Imaginary Bank. **Spear phishing** is a malicious email attack targeting a specific user or group of users, appearing to originate from a trusted source. In this case, the executive is being asked to install new collaboration software, ExecuTalk.
The executive suspects this email might be a phishing attempt because ExecuTalk was never mentioned during the last board meeting. They've forwarded the message to your team to verify if it’s legitimate. Your supervisor has tasked you with investigating the message and determining whether it should be quarantined.
### Step-By-Step Instructions
Follow the instructions and answer the questions below to complete the activity.
#### Step 1: Analyze the suspicious email
Previously, you learned that phishing is a type of social engineering. Threat actors who send malicious emails rely on deception and manipulation techniques to trick their targets. When investigating suspicious emails like this, it's a good idea to note the threat actor's tactics. You can use that information to alert others at your organization about similar messages they might receive and what to watch out for.
Start your investigation by analyzing the suspicious message. Try to identify clues that this is a phishing attack against this executive at Imaginary Bank:
***From:** *
***Sent:** Saturday, December 21, 2019 15:05:05*
***To:** *
***Subject:** RE: You are been added to an ecsecutiv's groups*
*Conglaturations! You have been added to a collaboration group ‘Execs.’*
*Downlode ExecuTalk to your computer.*
***Mac®** | **Windows®** | **Android™***
*You're team needs you! This invitation will expire in 48 hours so act quickly.*
*Sincerely,*
***ExecuTalk©***
*All rights reserved.*
#### Step 2: Examine the sender's information
####
Next, examine the major parts of this message in closer detail starting with the email header. You can often find clues in the message header that indicate you are dealing with a phishing attack.
Examine the email header of this suspicious message:
***From:** *
***Sent:** Saturday, December 21, 2019 15:05:05*
***To:** *
***Subject:** RE: You are been added to an ecsecutiv's groups*
**Pro tip:** Always check the domain name that comes after the @ symbol. Requests for sensitive information or asking you to download files should not come from personal accounts, like <_@gmail.com>, @icloud, @yahoo.com\_ or others.
**Question 1:**\
\&#xNAN;*Which two clues in the message header indicate to you that this is a phishing attempt?*
* **The sender is using a different domain.**\
Legitimate emails from Imaginary Bank’s board would likely come from an official company domain (e.g., @imaginarybank.com), not a free email service like @gmail.org.
* **There is a misspelling in the subject line.**\
The subject line “RE: You are been added to an ecsecutiv’s groups” contains noticeable spelling and grammatical errors. Phishing emails often contain such errors.
**Correct Answers:**
* The sender is using a different domain.
* There is a misspelling in the subject line.
***
**Question 2:**\
\&#xNAN;*What details make this message appear legitimate?*
* **The invitation time limit:** Creating a sense of urgency (“This invitation will expire in 48 hours”) often makes a message seem more legitimate and prompts the recipient to act quickly.
* **The brand labeling:** Including a brand name and copyright symbol “ExecuTalk©” gives the email an official appearance.
* **The download options for major operating systems:** Providing links for Mac®, Windows®, and Android™ seems like a professional and user-friendly detail.
**Correct Answers:**
* The invitation time limit
* The brand labeling
* The download options for major operating systems
***
**Question 3:**\
\&#xNAN;*The download options open a webpage that contains a login form. What is the main clue that indicates this form is malicious?*
* **The URL:** A suspicious or mismatched URL that doesn’t align with the company’s official domain is a major red flag. Even if the page looks authentic, an off-brand or unrelated URL signals that this is a phishing site.
**Correct Answer:**
* The URL
***
**Question 4:**\
\&#xNAN;*After completing your investigation, should this email be quarantined?*\
Since you’ve identified multiple phishing indicators—from the suspicious sender domain, poor spelling, and an untrustworthy URL—this email is almost certainly a malicious phishing attempt.
**Correct Answer:**
* Yes