analyzing-email-headers-for-phishing-investigation

分析电子邮件头部用于钓鱼调查

适用场景

• 调查疑似钓鱼（Phishing）邮件以确定其真实来源时
• 验证发件人真实性并检测电子邮件伪造时
• 用户点击钓鱼链接后的事件响应期间
• 追踪可疑邮件的投递路径和中继服务器时
• 验证 SPF、DKIM 和 DMARC 对齐以识别伪造时

前置条件

• 来自可疑邮件的原始邮件头部（EML 或 MSG 格式）
• 了解 SMTP 协议和电子邮件头部字段
• 访问 DNS 查询工具（dig、nslookup）用于 SPF/DKIM/DMARC 验证
• 电子邮件头部分析工具（MHA、emailheaders.net 相关概念）
• 带邮件解析库的 Python 用于自动化分析
• 访问威胁情报（Threat Intelligence）平台进行 IP/域名声誉查询

工作流程

步骤 1：提取原始电子邮件头部

# 从 Outlook 导出: 打开邮件 > 文件 > 属性 > Internet 头部
# 从 Gmail 导出: 打开邮件 > 三个点 > 显示原始邮件
# 从 Thunderbird 导出: 查看 > 消息源码

# 如果从取证镜像处理 EML 文件
cp /mnt/evidence/Users/suspect/AppData/Local/Microsoft/Outlook/phishing_email.eml \
   /cases/case-2024-001/email/

# 如果处理 PST 文件，提取单个消息
pip install pypff
python3 << 'PYEOF'
import pypff

pst = pypff.file()
pst.open("/cases/case-2024-001/email/outlook.pst")
root = pst.get_root_folder()

def extract_messages(folder, path=""):
    for i in range(folder.get_number_of_sub_messages()):
        msg = folder.get_sub_message(i)
        headers = msg.get_transport_headers()
        subject = msg.get_subject()
        if headers:
            filename = f"/cases/case-2024-001/email/msg_{i}_{subject[:30]}.txt"
            with open(filename, 'w') as f:
                f.write(headers)
    for i in range(folder.get_number_of_sub_folders()):
        extract_messages(folder.get_sub_folder(i))

extract_messages(root)
PYEOF

步骤 2：解析电子邮件头部链

# 使用 Python email 库解析头部
python3 << 'PYEOF'
import email
from email import policy

with open('/cases/case-2024-001/email/phishing_email.eml', 'r') as f:
    msg = email.message_from_file(f, policy=policy.default)

print("=== 关键头部字段 ===")
print(f"From:          {msg['From']}")
print(f"To:            {msg['To']}")
print(f"Subject:       {msg['Subject']}")
print(f"Date:          {msg['Date']}")
print(f"Message-ID:    {msg['Message-ID']}")
print(f"Reply-To:      {msg['Reply-To']}")
print(f"Return-Path:   {msg['Return-Path']}")
print(f"X-Mailer:      {msg['X-Mailer']}")
print(f"X-Originating-IP: {msg['X-Originating-IP']}")

print("\n=== Received 头部（从底部到顶部 = 时间顺序）===")
received_headers = msg.get_all('Received')
if received_headers:
    for i, header in enumerate(reversed(received_headers)):
        print(f"\n跳 {i+1}: {header.strip()}")

print("\n=== 认证结果 ===")
auth_results = msg.get_all('Authentication-Results')
if auth_results:
    for result in auth_results:
        print(result)

print(f"\nARC-Authentication-Results: {msg.get('ARC-Authentication-Results', '不存在')}")
print(f"Received-SPF: {msg.get('Received-SPF', '不存在')}")
print(f"DKIM-Signature: {msg.get('DKIM-Signature', '不存在')}")
PYEOF