Whaling attack evidence appears in email security, mail server, identity and endpoint logs. Look for targeted messages to senior staff, sender impersonation, unusual reply-to domains, suspicious login attempts after the email, and attachment or link activity on the recipient host. Mailflow, authentication, URL click and endpoint telemetry together show the campaign and any follow-on compromise.
Where the Evidence Shows Up First
Whaling usually leaves its clearest trail in email and mailflow logs, because the campaign begins with a highly targeted message to a senior or high-value recipient. Look for sender impersonation, lookalike domains, unusual reply-to addresses, and message delivery patterns that differ from normal correspondence. The Phishing Guide is useful for distinguishing whaling from broader phishing patterns and for understanding the lure types that commonly show up in email telemetry.
Those same logs often show whether the message was opened, forwarded, quarantined, or delivered with links or attachments intact. When multiple staff receive the same lure but only one executive account interacts with it, that asymmetry is often the strongest indicator that the message was crafted for a specific target rather than blasted broadly.
How Identity and Endpoint Logs Confirm Follow-On Activity
After the email stage, identity logs and endpoint telemetry help confirm whether the message was only delivered or whether it led to access attempts. Suspicious sign-in attempts, unfamiliar geolocation, impossible travel, MFA prompts that do not match user behaviour, and logins immediately following message interaction all help separate a harmless lure from an active compromise attempt.
Endpoint logs add the next layer of confirmation by showing what happened after the recipient clicked a link or opened an attachment. Process launches, script execution, child processes from office applications, browser redirections, file writes, and unusual network connections can reveal the transition from social engineering to malware, credential capture, or remote access.
Which Correlated Logs Build the Best Timeline
The most reliable whaling investigation is a timeline, not a single log source. Mail server records establish who was targeted and how the email entered the environment, identity logs show whether the recipient account was probed or accessed, URL click logs show whether a lure was followed, and endpoint logs show whether any code or payload ran on the host.
That correlation matters because whaling is often designed to look routine at each individual step. A legitimate-looking sender name, a credible executive theme, and a well-timed request can all appear benign in isolation. When you connect mailflow, authentication, URL access, and endpoint events, the campaign becomes visible as a sequence rather than a one-off email.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Whaling is a targeted phishing pattern that maps to email lure delivery and follow-on user interaction. |
| Recommendation — Map the lure and user interaction to T1566 and hunt for the downstream execution path. | ||
| NIST CSF 2.0 | DE.CM-01 — Continuous Monitoring | Whaling evidence is assembled by correlating mail, identity, click, and endpoint telemetry. |
| Recommendation — Correlate email, identity, URL, and endpoint logs to detect the campaign timeline. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | This investigation depends on reviewing and correlating audit records across systems. |
| SI-4 — System Monitoring | Endpoint and email monitoring are needed to surface the lure's execution path and follow-on activity. | |
| Recommendation — Review audit records across mail, identity, and endpoint systems for matching indicators. Monitor endpoints and mail systems for suspicious execution and post-click activity. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | The answer relies on log quality and event visibility to prove what happened after delivery. |
| Recommendation — Ensure application and security logs retain the events needed to reconstruct user interaction and abuse. | ||
Practitioner Guidance
What to verify: Confirm that the mail trace, authentication records, and endpoint evidence line up on the same recipient and time window before you declare the event contained. If the email was forwarded internally, include downstream recipients in the review because secondary exposure is common in executive-targeted lures.
What to prioritise: Start with the account that received the lure, then check for successful or failed sign-ins, suspicious token use, mailbox rule changes, and any attachment or link execution on the host. If you only inspect email logs, you can miss the compromise path that actually matters.
Practitioner takeaway: Treat whaling as a cross-telemetry investigation: email proves targeting, identity logs prove access pressure, and endpoint logs prove whether the lure became an incident.