toolsMITRE T15662026-07

Automated Phishing & Threat Intelligence IOC Triage Utility

Built a Python CLI workflow that parses suspicious email files (.eml), extracts URLs, IPs, and SHA-256 attachment hashes, and enriches them via threat intelligence APIs.

#Python #SOC Automation #Threat Intelligence #Email Security #VirusTotal API

35 views

Attack Vector (Red)

Spear-phishing emails utilizing lookalike domains, display-name spoofing, and weaponized attachments.

Detection Logic (Blue)

Automated header alignment verification (SPF/DKIM/DMARC) paired with SHA-256 reputation lookups.

Hardening & Mitigation

Standardized incident triage notes into repeatable markdown reports for faster analyst review.

Case Study & Technical Notes

Designed to reduce manual alert fatigue during initial phishing analysis. The script ingests raw .eml files, inspects authentication headers (SPF, DKIM, DMARC), extracts embedded URLs and file hashes, and queries VirusTotal and AbuseIPDB APIs to generate a structured markdown triage report.

bash

python3 phishing_triager.py --input suspicious_invoice.eml --enrich-vt --output report.md

This project bridges offensive phishing payload analysis with defensive SOC workflows by documenting common header spoofing patterns alongside automated indicator enrichment.

View on GitHub