Phase 2: Collect Artifacts

The goal of this phase is to gather all relevant data (artifacts) from the suspected phishing message before deeper analysis begins. These artifacts are the forensic breadcrumbs that help SOC analysts determine if the message is malicious, how it was crafted, what it's trying to do, and how they should respond.

Consider this step as digital crime scene preservation — collect first, analyze second.

What are Artifacts?

Artifacts are pieces of information or evidence that originate from or are embedded in the phishing communication. These include:

• Message metadata (headers, timestamps)

• Sender/recipient information

• Message content (text, HTML, language patterns)

• URLs, domains, and redirection chains

• File attachments and their properties

• Embedded scripts or code

• Sender IPs and hosting infrastructure

• Phone numbers, audio recordings (for voice-based phishing)

• Screenshots (especially for mobile or web-based phishing)

Handling Artifacts Safely

• Never click on live phishing links directly

• Open files and URLs in isolated environments (VMs, Sandboxes)

• Use secure artifact storage (case folder structure)

• Maintain a chain of custody when exporting forensics or logs

• Label and index artifacts in the incident tracking/ticketing system.

Attack/Communication Channel-based Artifacts to Collect 

Questions to Ask When Collecting Artifacts

• What would help another analyst reproduce this analysis?

• What would help the security team block or detect similar threats in the future?

• Can I correlate these artifacts with other incidents or threat intel?