Lion Cipher Lab
Investigate a phishing email end-to-end (the SOC/DFIR workflow)
- Digital Forensics & IR (DFIR)
- Intermediate
- ~45 min
- Free · no account required
Why it matters
"Is this email real?" is one of the most common questions a defender is handed, and answering it well is a genuine day-one SOC and incident-response skill. Anyone can glance at an email and get a gut feeling; a professional turns that feeling into a defensible verdict backed by evidence — the true sending server pulled from the header, the authentication results read correctly, every dangerous link and file recorded safely, and a one-paragraph conclusion someone else can act on. This lab walks the whole workflow once, on a safe sample you never have to touch anything live to analyse, so the…
What you'll learn
- reading a full email header from raw text
- tracing the Received: chain back to the true sending server
- distinguishing the header From from the Return-Path (envelope-from)
- interpreting SPF, DKIM, and DMARC results — and why alignment matters
- extracting and defanging IOCs (URLs, domains, IPs, file hashes)
- hashing an attachment and checking indicators safely on VirusTotal / urlscan
- writing a short, evidence-backed phishing verdict
- mapping a case to MITRE ATT&CK T1566 (Phishing)
Steps in this lab
- What you're about to do — and the one rule that keeps it safe
- The vocabulary, defined once (header, Received chain, envelope, SPF/DKIM/DMARC, IOC, defang)
- How to get a full header in the real world (so this transfers off the sample)
- Meet the sample — save it as a file you can dissect
- Trace the Received: chain from the bottom up — find the true origin
- Two 'from' addresses that disagree — the envelope vs the display
- Read SPF, DKIM, DMARC — and learn why a passing SPF does NOT mean safe
- Extract every IOC — and defang each one as you write it down
- Hash the attachment safely — and submit the hash, not the file
- Check the indicators the safe way — VirusTotal and urlscan, never your browser
- Write the verdict — a short, evidence-backed conclusion someone can act on
- What this proves, what it doesn't, and the safety recap