Skip to content
EML-047 Email Evidence

Worked example: a suspicious attachment opened by the recipient

title: 'Worked example: a suspicious attachment opened by the recipient' subtitle: The email enquiry becomes both an evidence-preservation task and a live device or account incident. slug: worked-example-suspicious-attachment-opened-by-the-recipient series: email-evidence section: worked-examples card_type: worked_example pathway_order: 48 section_order: 4 status: draft public_safe: true video_ready: true word_count: 507 estimated_read_time_seconds: 210 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - worked example - attachment - malware - incident response sources: - title: 'CISA: Phishing Guidance — Stopping the Attack Cycle at Phase One' url: https://www.cisa.gov/sites/default/files/2025-03/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%20508.pdf - title: 'Microsoft Learn: Submit messages, URLs and attachments for analysis' url: https://learn.microsoft.com/en-us/defender-office-365/submissions-admin - title: 'Microsoft Learn: Email entity page in Defender for Office 365' url: https://learn.microsoft.com/en-us/defender-office-365/mdo-email-entity-page - title: 'Microsoft Learn: Email analysis in investigations' url: https://learn.microsoft.com/en-us/defender-office-365/email-analysis-investigations - title: 'NCSC: How to spot and report phishing scams' url: https://www.ncsc.gov.uk/collection/phishing-scams

Worked example: a suspicious attachment opened by the recipient

The email enquiry becomes both an evidence-preservation task and a live device or account incident.

Script

An employee receives an email containing an attachment presented as an overdue invoice.

They open the file.

A warning appears asking them to enable content.

They do so.

Nothing obvious happens, and they later report the email.

At this point, the enquiry isn’t only about who sent the message.

It is also a live device and account question.

The first response should be calm and direct.

Ask the recipient to stop using the attachment and explain exactly what they did.

Which device did they use?

Which application opened the file?

What time did they open it?

What warnings appeared?

Did they enable macros, content, editing or another feature?

Did a browser open?

Did they enter credentials?

Did anything download or close unexpectedly?

Don’t ask them to open the file again to demonstrate it.

Use the organisation’s incident process to decide whether the device should be isolated, the account secured, sessions revoked or other protective action taken.

Record each action and time.

Now preserve the email.

Keep the native original, header, message body, attachment and mailbox context.

Preserve the attachment in its original relationship to the message.

Record the displayed filename and the file type identified from its content, not only from the extension.

Create a working copy for controlled examination.

The email-security platform may already hold useful findings.

It may have recorded the file hash, malware verdict, detonation behaviour, delivery action and other recipients who received the same attachment.

Submit the message or attachment through the organisation’s approved analysis process where appropriate.

Avoid public analysis services unless their operation, disclosure and effect on the evidence are understood.

Then move to the endpoint evidence.

Look for process execution, child processes, downloaded files, network connections, persistence, credential access, browser activity and security alerts around the opening time.

A malicious document may not show an obvious window after execution.

The absence of visible harm doesn’t prove nothing happened.

Also investigate the account.

If credentials were entered or tokens may have been exposed, review sign-ins, sessions, authentication changes, mailbox rules and messages sent after the event.

The message may be one part of a wider campaign.

Search for related emails using the attachment hash, sender infrastructure, subject, URL, Message-ID pattern or security detections.

Identify other recipients and whether they interacted.

The common mistake is to preserve the attachment and ignore the device.

The other is to wipe or rebuild the device immediately without preserving useful logs and artefacts.

Protection may require urgent action, but it should be documented and coordinated.

A careful conclusion might say:

“The recipient opened this preserved attachment and enabled active content at this time. Endpoint records then show these processes and connections. The email-security platform identified related messages and assigned this verdict.”

That is much stronger than:

“The attachment looked malicious.”

The sender attribution may remain open.

The sending account may be spoofed, compromised or part of a larger service.

But once the attachment has been opened, the immediate priority is to establish the effect on the device and account while preserving the email that started it.

Key takeaway

Don’t ask the recipient to reproduce the event. Preserve the message and attachment, then use endpoint, account and security records to establish what happened.

Scenario at a glance

  • Initial fact: recipient opened the attachment and enabled active content.
  • Immediate priority: device and account protection alongside preservation.
  • Email evidence: original message, header, attachment, hash and security verdict.
  • Endpoint evidence: processes, downloads, network activity, persistence and alerts.
  • Account evidence: sign-ins, sessions, rules and post-event sending activity.
  • Campaign evidence: other recipients and related files, URLs or message patterns.
  • Avoid: asking the recipient to reproduce the action or destroying logs through unrecorded remediation.

Source notes

Keep moving

Where this question leads

These links explain why the next page may matter, rather than presenting an undifferentiated list.