Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
Email |
Detector Tags |
Spoofing |
ATT&CK Tactic |
Defense Evasion (TA0005) |
ATT&CK Technique |
Impersonation (T1656) |
Severity |
Informational |
Description
The email has a suspicious SPF result of fail, soft fail, or policy, which may indicate a potential domain misconfiguration or spoofing.
Attacker's Goals
- Trick users into clicking on malicious links or attachments.
Investigative actions
- Check the email address for any unusual spellings.
- Check the email address for any missing letters.
- Verify the sender's domain to confirm its legitimacy.
- Examine the sender's IP address and reputation.
- Verify the domain's connection to the IP address and investigate the reason SPF didn't pass.
- Verify whether the sender's IP address has appeared in different log sources before.
- Verify if the sender's IP address is identifiable.
- If the message contains attachments/links, scrutinize them for any suspicious indications.
- Monitor further actions taken, such as file downloads or access to potentially malicious links.
Variations
Internal domain SPF deviation
Synopsis
Description
- An email was sent from an internal root domain that has historically passed SPF checks, but returned a suspicious SPF result of fail, soft fail, or policy for the first time in the past 30 days.
- This deviation may indicate an attempt to spoof or impersonate a trusted internal sender, a tactic commonly associated with BEC and internal phishing.
- Such a sudden SPF outcome from a typically trusted domain warrants further investigation.
Attacker's Goals
- Trick users into clicking on malicious links or attachments.
Investigative actions
- Check the email address for any unusual spellings.
- Check the email address for any missing letters.
- Verify the sender's domain to confirm its legitimacy.
- Examine the sender's IP address and reputation.
- Verify the domain's connection to the IP address and investigate the reason SPF didn't pass.
- Verify whether the sender's IP address has appeared in different log sources before.
- Verify if the sender's IP address is identifiable.
- If the message contains attachments/links, scrutinize them for any suspicious indications.
- Monitor further actions taken, such as file downloads or access to potentially malicious links.
Known domain SPF deviation
Synopsis
Description
- An email was sent from a commonly seen domain that has historically passed SPF checks, but returned a suspicious SPF result of fail, soft fail, or policy for the first time in the past 30 days.
- This deviation may indicate an attempt to spoof or impersonate a legitimate external sender.
- Such a sudden SPF outcome from a previously trusted external domain warrants further investigation.
Attacker's Goals
- Trick users into clicking on malicious links or attachments.
Investigative actions
- Check the email address for any unusual spellings.
- Check the email address for any missing letters.
- Verify the sender's domain to confirm its legitimacy.
- Examine the sender's IP address and reputation.
- Verify the domain's connection to the IP address and investigate the reason SPF didn't pass.
- Verify whether the sender's IP address has appeared in different log sources before.
- Verify if the sender's IP address is identifiable.
- If the message contains attachments/links, scrutinize them for any suspicious indications.
- Monitor further actions taken, such as file downloads or access to potentially malicious links.
Known domain unusual SPF result
Synopsis
Description
- A commonly seen root domain has returned a suspicious SPF result of fail, soft fail, or policy for the first time in the past 30 days.
- While other suspicious SPF outcomes may have occurred previously for this domain, this is the first instance of this particular SPF result.
- Such a shift in SPF behavior may signal evolving abuse tactics, domain misconfiguration, or an attempted spoof using unauthorized infrastructure.
Attacker's Goals
- Trick users into clicking on malicious links or attachments.
Investigative actions
- Check the email address for any unusual spellings.
- Check the email address for any missing letters.
- Verify the sender's domain to confirm its legitimacy.
- Examine the sender's IP address and reputation.
- Verify the domain's connection to the IP address and investigate the reason SPF didn't pass.
- Verify whether the sender's IP address has appeared in different log sources before.
- Verify if the sender's IP address is identifiable.
- If the message contains attachments/links, scrutinize them for any suspicious indications.
- Monitor further actions taken, such as file downloads or access to potentially malicious links.