# Phishing and Malware Campaign Investigation

> Investigate phishing and malware campaigns from headers, authentication results, lures, redirect chains, phishing kits and synthetic sandbox reports.

Canonical: https://codelivly.com/rooms/cti-phishing-and-malware-campaigns
Last updated: 2026-10-28

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 6 |
| XP | 100 |

Purpose: phishing and malware delivery are where most campaigns first touch a victim, and they leave the richest technical trail for an intelligence analyst. This module teaches you to turn a reported email and a sandbox report into campaign intelligence that the SOC, detection engineers and CTI team can use.

Prerequisites: the Threat Intelligence Foundations and OSINT and Indicator Analysis paths, and modules 1 to 4 of this path (ATT&CK mapping, the Diamond Model, actor profiling, campaign tracking).

Measurable outcomes. After this module you can: (1) read a Received chain bottom-up and identify the trust-boundary IP; (2) interpret SPF, DKIM and DMARC results including relaxed and strict alignment, and explain why lookalike domains pass; (3) analyse a lure across six dimensions and reconstruct a redirect chain including cloaking behaviour; (4) grade phishing kit artefacts by operator specificity and avoid kit-based attribution; (5) extract C2, persistence, mutex, beaconing and configuration from a sandbox report while excluding baseline noise; (6) map observed behaviour to ATT&CK v20 with cited evidence.

Practical completion objective: complete both labs, answering every dataset question correctly, and submit a phishing intelligence note and a malware campaign intelligence note that meet the rubrics. All material is synthetic; no live malware or real infrastructure is used.

## Lessons

1. Reading Phishing Email Headers (18 min)
2. SPF, DKIM and DMARC Results in Investigations (20 min)
3. Lures, Redirect Chains and Credential Harvesting Kits (20 min)
4. Lab: Analyse a Synthetic Phishing Email (45 min)
5. Malware Campaign Intelligence from Sandbox Reports (20 min)
6. Lab: Analyse a Synthetic Sandbox Report (50 min)

## Related

- [Learning path: Threat Actor and Campaign Investigation](https://codelivly.com/learning-paths/cti-threat-actor-investigation)
- [All rooms](https://codelivly.com/rooms)