1. What is Phishing?
Phishing is a technique used by cybercriminals to impersonate a
trusted organization (bank, company, social network, etc.) in order
to steal personal information:
- credentials (email / password)
- banking data
- access to professional accounts
Simple example:
A fake email from PayPal or Microsoft asking you to “verify your
account”.
---
2. How does this attack work?
Phishing relies on psychological manipulation (called social
engineering).
Typical process:
1. You receive a fraudulent email or SMS
2. You are encouraged to click on a link
3. You are redirected to a fake website (a copy of a real one)
4. You enter your information
5. The attacker immediately steals it
Common techniques:
- deceptive URLs (e.g., paypaI.com with a fake “l”)
- alarming messages (“your account will be blocked”)
- malicious attachments
---
3. How to recognize phishing?
Whether you are an individual or a professional, certain signs
should alert you:
Common indicators:
- Unusual or suspicious email address
- Spelling or formatting mistakes
- Suspicious link (check by hovering over it)
- Unexpected attachment
- Urgent or unusual request
Simple rule: if it creates pressure → be cautious
---
4. What tools are used to detect it?
In companies and Security Operations Centers (SOC), several tools
are used:
Log analysis (SIEM)
- Splunk
- IBM QRadar
Used to analyze suspicious activity
Endpoint protection (EDR / XDR)
- Microsoft Defender for Endpoint
- CrowdStrike Falcon
Used to detect abnormal behavior
Email security
- Microsoft Defender for Office 365
- Proofpoint
Used to block or filter malicious emails
---
5. What do you actually see on the screen?
In a security environment:
Monitoring tools:
- Alerts such as:
- “Suspicious email detected”
- “User clicked malicious link”
- Displayed information:
- suspicious IP address
- clicked link
- affected user
Protection tools:
- Alert:
- “Credential theft suspected”
- Unusual browser or system activity
---
6. Where to find this information in the tools?
Simple examples:
In Splunk:
- Search & Reporting
- Security Alerts
In Microsoft Defender for Endpoint:
- Incidents
- Alerts
- Email & Collaboration
In Microsoft Defender for Office 365:
- Threat Explorer
- Real-time detections
---
7. What to do in case of phishing?
Basic actions (for users or organizations):
1. Identify the suspicious message
2. Do not click on links
3. Verify the sender or website
4. Report the email
5. Block the sender if possible
Advanced actions (for organizations / security teams):
- Block the domain or IP address
- Disable compromised accounts
- Isolate affected devices
- Perform in-depth investigation
---
8. How to prevent it?
For everyone:
- Never click on suspicious links
- Always verify the sender
- Use multi-factor authentication (MFA)
For organizations:
- Implement email filtering
- Train users (security awareness)
- Run phishing simulations
- Enforce strict security policies
Example:
- Enable MFA using Microsoft Entra ID
Copyright © All rights reserved.