Independent Phishing Email Analysis Lab

Purpose

This project is a portfolio-ready phishing email analysis lab designed for an entry-level SOC / cyber security CV. It does not depend on TryHackMe or any paid platform.

The lab uses safe synthetic email samples to demonstrate how a SOC analyst reviews suspicious emails, extracts indicators of compromise, and writes clear investigation notes.

This lab is designed to complement the wider Atlas SOC home-lab environment, which includes Grafana, Loki, Promtail, Pi-hole, CrowdSec, Telegram alerting, and Windows voice alerts.

Project contents

samples/
  case-01-m365-password-reset.eml
  case-02-fake-invoice-attachment.eml
  case-03-delivery-notification-url-mismatch.eml
  case-04-hr-payroll-update.eml

analysis/
  case-01-analysis.md
  case-02-analysis.md
  case-03-analysis.md
  case-04-my-analysis.md

reports/
  final-report.md
  ioc-summary.csv

docs/
  phishing-analysis-checklist.md
  atlas-soc-integration.md
  atlas-pihole-simulation.md
  cv-website-case-study.md
  github-project-page.md
  screenshots-guide.md

Skills demonstrated

• Email header analysis
• SPF, DKIM, and DMARC interpretation
• Sender spoofing detection
• URL and domain investigation
• Suspicious attachment triage
• IOC extraction
• Incident verdict writing
• Recommended containment actions
• SOC workflow integration with Atlas/Grafana/Loki/Pi-hole

How to use this lab

1. Open each .eml sample in a text editor.
2. Review the sender, Return-Path, Reply-To, Received headers, and authentication results.
3. Inspect URLs and attachments safely without clicking or opening them.
4. Complete the case analysis using the checklist in docs/phishing-analysis-checklist.md.
5. Update reports/ioc-summary.csv with any indicators found.
6. Summarise findings in reports/final-report.md.
7. Optionally use docs/atlas-soc-integration.md to connect the phishing indicators to the wider Atlas SOC monitoring story.

Portfolio packaging

Use these files when publishing or presenting the project:

• reports/final-report.md — full written report
• docs/github-project-page.md — GitHub/repository landing-page text
• docs/cv-website-case-study.md — CV website case-study text
• docs/screenshots-guide.md — recommended screenshot list and sanitisation checklist
• docs/atlas-pihole-simulation.md — safe Atlas/Pi-hole DNS investigation extension
• output/pdf/phishing-email-analysis-final-report.pdf — polished PDF report, once generated

Independent practice case

Case 04 preserves the analyst working notes alongside the completed final analysis:

samples/case-04-hr-payroll-update.eml
analysis/case-04-my-analysis.md

This shows the investigation process before the findings were normalised into the final report.

Safety note

These samples are synthetic. They are designed to look realistic enough for training but do not contain real malware, active phishing links, or live malicious infrastructure.

CV wording

Independent Phishing Email Analysis Lab

• Built a safe phishing email analysis lab using synthetic .eml samples to demonstrate SOC Level 1 investigation workflows.
• Analysed email headers, sender discrepancies, SPF/DKIM/DMARC results, URLs, and suspicious attachment indicators.
• Documented indicators of compromise, investigation verdicts, and recommended containment actions in analyst-style reports.
• Mapped phishing indicators to a self-hosted Atlas SOC workflow using Grafana/Loki/Pi-hole-style investigation notes.

Interview explanation

I built an independent phishing email analysis lab without relying on a guided platform. I created safe sample emails representing common phishing scenarios, then investigated each one by reviewing headers, authentication results, sender alignment, URLs, attachments, and social-engineering techniques. I documented the findings as a SOC analyst would: evidence, IOCs, verdict, and recommended response actions. I also mapped the indicators into my wider Atlas SOC home-lab workflow, where suspicious domains and events could be investigated through DNS logs, Loki queries, Grafana dashboards, and alerting.