An attachment reported by a user is not merely a suspicious file. It may be the first observable sign of a credential theft campaign, malware delivery attempt, invoice fraud operation or targeted intrusion. Knowing how to investigate malicious attachments quickly and safely helps security teams contain genuine threats without disrupting legitimate business activity.
For UK organisations running Microsoft 365, the investigation must extend beyond the individual message. The objective is to establish what the attachment is, whether it reached other mailboxes, whether anyone opened it, and what action is required to protect the wider estate.
Start with safe handling and evidence preservation
Do not open a suspicious attachment on a production endpoint, even where the sender appears familiar. Compromised supplier accounts and spoofed internal identities are routinely used to deliver credible-looking files. A document named `Updated Remittance Advice` can be more dangerous than an obviously implausible executable because it is designed to pass an initial human check.
Preserve the original email before taking action. Capture the message headers, sender and recipient details, subject line, delivery time, attachment name and file type. Retain the original message in a controlled evidence location where your retention and incident handling processes permit it. Screenshots can support an investigation, but they are not a substitute for the original message and its underlying metadata.
Record who reported the message and whether they interacted with it. There is a material difference between a file that was delivered but never opened and one that was opened, enabled content, requested credentials or triggered an endpoint alert. This early distinction determines whether the case remains phishing triage or becomes an active incident response matter.
Establish whether the attachment is genuinely suspicious
File names and icons are weak indicators. Attackers frequently use double extensions, Unicode characters, archive files and familiar document labels to make a payload look routine. Begin with the observable characteristics of the file: its true extension, size, hash value, MIME type and whether it is contained within an archive.
A mismatch deserves attention. For example, a file presented as a PDF but identified as an executable, script or shortcut should be treated as high risk. Likewise, an unexpected HTML file may be intended to capture credentials through a local browser page, while an ISO, IMG or archive may conceal an additional payload from basic inspection.
Context matters as much as the file itself. Ask whether the sender normally sends attachments, whether the message fits an active commercial relationship, and whether the language, timing and request are credible. A payroll spreadsheet arriving from a newly registered external domain, or a legal document that pressures the recipient to act immediately, should elevate concern even if the attachment initially appears benign.
Inspect the email path, not only the file
Message headers and authentication results can reveal whether the email originated from the claimed domain, passed through unusual infrastructure or failed SPF, DKIM or DMARC checks. Authentication failures are useful signals, but they are not conclusive on their own. A message can pass authentication when an attacker has compromised a legitimate sender account.
Review the reply-to address, return path, sending IP reputation where available, display-name inconsistencies and recipient pattern. A message sent to a small group of finance users may indicate targeted business email compromise. A broadly distributed message with identical wording and attachments may be part of a commodity phishing campaign. Both require action, but their likely scope and response priorities differ.
Analyse the attachment in an isolated environment
Static analysis should precede any execution. Calculate a cryptographic hash and compare it with trusted threat intelligence sources and internal detections. Examine metadata, embedded objects, macros, hyperlinks and file structure using approved analysis tooling. For Office files, determine whether macros are present and whether the document contains suspicious external relationships, embedded templates or obfuscated content.
Static findings do not always provide a final answer. A previously unseen payload may have no reputation history, while a legitimate file may appear unusual because it is password-protected or generated by specialist business software. Treat a clean reputation result as an absence of known detection, not confirmation that the file is safe.
Where policy and tooling allow, submit the attachment to a controlled malware-analysis sandbox. This should be an isolated environment, not an analyst workstation or a shared virtual machine with access to corporate services. Observe process creation, child processes, network connections, persistence attempts, dropped files and any calls to known malicious infrastructure.
Dynamic analysis has trade-offs. Some malware detects sandbox conditions and remains inactive, while certain files may contain sensitive commercial or personal information that cannot be submitted to external analysis services. In those cases, use an internally controlled environment and ensure the investigation follows your data handling requirements.
Scope the exposure across Microsoft 365
Once an attachment is confirmed malicious, or sufficiently suspicious to justify containment, search for matching messages across the tenant. Use the attachment hash where available, alongside file name, sender address, subject line, recipient groups, message identifiers and related URLs. Attackers often vary one characteristic between messages, so a single search condition may miss part of the campaign.
Establish when the campaign began, which users received it and whether any copies were forwarded internally. High-value recipients such as finance, payroll, executive support, IT administration and procurement should be prioritised because the operational impact of compromise may be greater.
Remediation should remove the malicious message from delivered mailboxes, including copies in folders where your tooling supports it. Quarantining future messages is not enough if users already received the original delivery. Document what was removed, from which mailboxes and at what time, so that the action can be evidenced and reviewed.
If a user opened the attachment, correlate email findings with endpoint telemetry, identity logs and web proxy or DNS records. Look for suspicious sign-ins, token activity, unusual process execution, new inbox rules, outbound mail anomalies and connections to infrastructure observed during analysis. Credential theft attachments may not create a conventional malware alert, so identity monitoring is essential.
Decide when to escalate to incident response
A suspicious attachment should be escalated immediately where it has executed code, led to credential entry, caused endpoint detections, contacted malicious infrastructure or reached multiple users in a sensitive function. The same applies where the sender is a trusted partner whose account may have been compromised.
Containment actions depend on the evidence. They may include isolating an endpoint, resetting credentials, revoking sessions, blocking domains or hashes, removing malicious inbox rules and notifying affected users. Avoid broad remediation based solely on an uncertain indicator if it will disrupt a legitimate supplier or critical workflow. Where confidence is incomplete, a proportionate temporary control combined with accelerated analysis is often the better decision.
The investigation record should explain the decision made, the evidence supporting it, the systems searched and the remediation completed. This supports auditability, handover between teams and lessons learned after the immediate pressure has passed.
Improve the reporting and triage workflow
The most valuable phishing investigations often begin with an employee using a reporting button rather than a security product alert. Make reporting simple in Outlook, acknowledge reports promptly and give users clear feedback where appropriate. Employees who see that reports lead to action are more likely to report the next suspicious message before someone interacts with it.
Triage quality improves when analysts work from a consistent playbook. Define what constitutes a high-risk attachment, what evidence must be gathered, who can authorise mailbox remediation and when a case transfers to incident response. Managed phishing response and specialist platforms such as Cofense can help teams turn high volumes of employee reports into prioritised, actionable cases rather than an unmanaged service desk queue.
Use confirmed investigations to tune controls. Add relevant indicators to email security policies, review sender allow lists, assess whether conditional access or attachment handling needs adjustment, and incorporate realistic examples into phishing simulations. The goal is not simply to block the last file. It is to reduce the chance that the next variation reaches, deceives and compromises a user.
A well-run attachment investigation leaves the organisation with more than a closed ticket. It creates a clearer picture of attacker behaviour, exposes gaps between email delivery and response, and gives employees confidence that reporting suspicious messages is a meaningful part of the security control.