Skip to main content

Reporting a Phish Email to Huntress SOC Support

Melissa
  • Updated

Team: Huntress Managed Identity Threat Detection and Response (ITDR, formerly MDR for Microsoft 365)

Environment: Microsoft 365, Google Workspace

Summary: This guide will cover how to obtain a suspicious email reported by one of your users, which will allow Huntress SOC Support to perform further analysis.

Be sure to handle all suspicious emails securely to prevent further unauthorized access. Additionally, ensure that you have the necessary permissions and authorization and are adhering to all legal requirements and organizational policies regarding user data and privacy. 


Microsoft 365

Google Workspace


Microsoft 365

Method 1 - Using eDiscovery Content Search

Note: this requires a plan with access to eDiscovery. If you do not have a Microsoft 365 plan that includes eDiscovery, please use Method 2 or Method 3 instead. 

  1. Follow the instructions here to create and run a content search. You must ensure that you have proper role group access (noted in the “Before you run a search” section of the linked document).
  2. Once the content search is complete, follow the instructions here to export the content search results
    1. Under “Export Exchange content as,” choose the “Individual messages” option
  3. Send/upload the .msg to your SOC Support Agent

Method 2 - Using Administrative Granted Access to Access the Mailbox

  1. Log into admin.microsoft.com
  2. Navigate to Users > Active users
  3. Click on the affected user’s name
  4. Click on the “Mail” tab
  5. Click “Read and manage permissions”
  6. Click “Add permissions,” then select your account and click “Add”
  7. Navigate to outlook.office.com
  8. Click on your profile photo/avatar in the top right corner and click “Open another mailbox.” Start typing the name or email address of the affected user, then click on the user and click “Open”
  9. Find the email and right-click on the list item to “Save as” a .eml (or click the 3 dots to “Save as” if already viewing the opened email)
  10. Send/upload the .eml to your SOC Support Agent.

Method 3 - Asking the User to Forward the Email to you as an Attachment

  • If the user is on a mobile device, instruct them to “Forward as Attachment” the phish to you by clicking the 3 dot menu while viewing the email.

iOS
   

 

Android

   

 

  • If the user is on a desktop, instruct them to “Forward as attachment” the phish to you by clicking the dropdown arrow next to the forward button while viewing the email.
  • Once you receive the email, right-click on “Save as” a .eml and send/upload the .eml to your SOC Support agent.

 

Google Workspace

Method 1 - Using Google Vault

Note: this requires a plan with access to Google Vault. If you do not have a Google Workplace plan that includes access to Google Vault, please use Method 2 instead.  

  1. Log into your Google Admin account
  2. Navigate to vault.google.com
  3. Click on “Matters”
  4. Create and name a new “Matter”
  5. Choose the “Gmail” service
  6. Enter your user’s email address in the “Account email addresses” field
  7. Query for the email by subject (in the “Terms (optional)” field) and, if necessary, by Date sent
  8. Hit the “Search” button
  9. Click on the email in the results list
  10. Click on the “Original” button and save the file as a .eml
  11. Send/upload the .eml to your SOC Support Agent.

You may also follow more detailed instructions here, although these instructions will result in the export of a .mbox and contain more information than Huntress requires. Huntress needs only the .eml of the phish, so be sure to filter the contents of the .mbox and only provide us with the phish in question. 

 

Method 2 - Asking the User to Forward the Email to you as an Attachment

Instruct the user to do the following:

  1. Log into the Gmail web app
  2. Locate the original phishing email in their inbox, but don’t click on it
  3. Right-click on the email and select “Forward as attachment”
  4. Send the email to you
  5. Once you receive the email, send/upload the .eml to your SOC Support Agent.

Related articles