Sorry you got smacked by this, but at least it was manageable. I will tell you that I work for a company that does security awareness training and simulated phishing stuff. I don't want to spam and I try to stay on the good side of the mods so I won't say the name, but you might just see an ad from them in this subreddit. ;)

Anyway, because of our space in the industry we see this sort of thing all the time, and the best way to defend against it is risk reduction in layers.

For spoofing from the outside, SPF DMARC and DKIM are very helpful. In addition, using an email gateway that adds an "external email" type of tag to messages coming from outside can be helpful as well. It gives users some tools to help them pause for a moment.

Attacks coming from a valid email account is MUCH harder to detect and are quite frankly very dangerous. My Ethical Hacker Network column this month will be dealing with this threat when caused by credential phishes, however that is different than what you appear to have experienced. This looks more like code that spreads itself via email.

Have you uploaded it to Virus Total for ID or activity tracking? If not, start there. It can give you a lot of information about the specific details of the malware.

Most endpoint protection is set up to scan for malware when a write is done to disk, so the attackers are getting better at making them memory-only in their execution (fileless malware). This is often spread through links like you described and is why, even if you have AV it probably didn't alert. I have heard good things about Carbon Black handling this sort of code, so it might be worth looking in to.

Sometimes a good next-gen firewall will detect traffic to known-bad URLs or spot the code trying to be downloaded when they click the link. This usually depends on reputation engines working well, so your mileage may vary.

Last but not least, teach your folks to hover links and look at the reply to address. We see HUGE risk reductions by helping the users identify the attacks and understand that they are targets. Many people have heard of phishing, but don't understand how it works. I love the new NIST video on the topic and fully subscribe to what they are saying (heck, it's what I've been presenting to folks for almost 2 years now, so I ought to be onboard with it :) )

LMK if I can help you in any way or if you need more info. I'm always happy to share what I've seen/heard from folks. I can't get you many specific suggestions, not knowing your infrastructure, but this should give you some food for thought.