Grey Mouse Studio SOC IR Navigator · IR playbook · Severity matrix · Phishing playbook · SOC metrics · NIST CSF 2.0
Incident response · Phishing & BEC

Phishing incident response playbook: step by step, including business email compromise

Grey Mouse Studio · Updated 22 October 2026 · 8-minute read

A user reports a suspicious email. Did anyone else get it? Did anyone click or type a password? This phishing incident response playbook walks your SOC from the first report to clean-up, including business email compromise (BEC), where minutes can decide whether a payment is recovered.

Typical alerts: User-reported phish, malicious attachment/URL, BEC request, new forwarding rule.
Decision point: Malicious email? Yes → contain. No → thank the reporter, document, close.

1. Triage

  1. Analyse headers: SPF/DKIM/DMARC, reply-to, sending IP (Email GW, Mail Admin)
  2. Detonate attachment and URLs (Sandbox, Threat Intel)
  3. Message trace: who else received it? Who clicked? (Mail Admin, Email GW, Proxy/SWG)
  4. For BEC: verify the request by phone with the sender (Ticketing)

Two questions decide everything that follows: who clicked and who entered credentials. Message trace and proxy or DNS logs usually answer both within minutes.

2. Contain

  1. Purge the email from all mailboxes (Mail Admin, Email GW)
  2. Block sender, domain and URLs (Email GW, Proxy/SWG, DNS Sec)
  3. Reset creds of users who entered passwords (IdP/MFA, AD Admin)
  4. Isolate hosts that opened the attachment (EDR)
  5. BEC: call bank to recall payment now (hours matter) (Ticketing)

3. Eradicate

  1. Remove inbox/forwarding rules created by attacker (Mail Admin)
  2. Hunt for related campaign emails (subject, sender, hash) (Email GW, SIEM)

4. Recover

  1. Confirm payment status with finance; report fraud (Ticketing)
  2. Thank the reporter; send awareness note to targets (Ticketing)
Evidence to preserve: Original .eml with headers, message trace, URL click logs, mailbox audit.
Escalate when: Payment fraud, executive impersonation, many clicks, credential entry.

If someone entered their password

The incident is no longer just an email. Switch to the user account playbook: revoke sessions and tokens (a password reset alone does not end an attacker's existing session), check MFA methods for anything newly registered, review sign-ins since the click, and look for new inbox rules or OAuth app consents.

If someone opened the attachment

Treat the device as a possibly compromised workstation: isolate it with your EDR and follow the workstation playbook, capturing memory before killing anything.

Free download (includes this phishing playbook): the Incident Response Playbook Template (PDF): a blank one-page template plus worked playbooks for a compromised laptop, phishing/BEC and a compromised user account.

Containment ladder for email

  1. 1 Watch: Tag/banner the message
  2. 2 Restrict: Move to junk / hold delivery
  3. 3 Isolate: Purge from all mailboxes
  4. 4 Revoke / Disable: Reset creds of users who clicked
  5. 5 Rebuild / Replace: Block sender domain permanently

MITRE ATT&CK techniques covered

Not sure how urgent it is? Score it with the incident severity matrix: one email, nobody clicked, is usually P4; a confirmed BEC payment request is at least P2.

Every phishing step, mapped to your email stack

The SOC IR Navigator places your email gateway, Microsoft 365 or Google Workspace, identity provider and EDR into each step automatically, and links the email, user account and workstation playbooks so analysts can pivot in one click.

Get the SOC IR NavigatorWatch the 2-minute demo

Frequently asked questions

What is the first thing to do when a phishing email is reported?

Check how many people received it and who clicked, using message trace. Then purge it from every mailbox so nobody else can click.

Should we reset the password of everyone who clicked?

Reset credentials (and revoke sessions) for anyone who entered a password. Clicking a link without entering anything usually needs a check of the device and browser, not a reset.

How is BEC different from regular phishing?

BEC often has no link or attachment: it impersonates an executive or supplier to request a payment or data. Verify the request by phone using a known number, and call the bank immediately if money has moved.

How do we encourage reporting?

Thank every reporter, give them a one-click report button, and share what their report stopped. Report rate is a better awareness metric than click rate.

Educational guidance only. Adapt every step to your environment, policies and legal obligations. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; technique IDs reference ATT&CK v20. NIST does not endorse any commercial product.