Techniques › T1684.002 › AN1202
AN1202 Analytic 1202
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitor email message traces and headers for failed SPF, DKIM, or DMARC checks indicating spoofed sender identities. Correlate abnormal sender domains or mismatched return-paths with elevated spoofing likelihood.</p>
- Detects
- T1684.002 Email Spoofing
- Part of
- DET0431 Detection Strategy for Email Spoofing
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| m365:messagetrace | AuthenticationDetails=fail OR SPF=fail OR DKIM=fail OR DMARC=fail | DC0038 Application Log Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
SpoofScoreThreshold | Defines sensitivity to SPF/DKIM/DMARC failures; higher thresholds reduce false positives but may miss stealthier spoofing. |
MonitoredDomains | Specifies which domains to enforce strict validation against; enterprise-specific tuning may be required. |