Techniques › T1684 › T1684.002
T1684.002 Email Spoofing
stealth — Linux, macOS, Office Suite, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1684.002
0
KEV CVEs mapped here
<p>Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses. In addition to actual email content, email headers (such as the FROM header, which contains the email address of the sender) may also be modified. Email clients display these headers when emails appear in a victim's inbox, which may cause modified emails to appear as if they were from the spoofed entity.</p><p>Enterprise environments can use Domain-based Message Authentication, Reporting, and Conformance (DMARC) as an email authentication protocol that references results of the Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) configurations. SPF and DKIM are configured separately in DNS: SPF verifies that the sending server is authorized for the domain, while DKIM uses a digital signature to verify email integrity and domain authentication. Together, they validate email authenticity and specify how receiving servers should handle authentication failures. Without enforced identity authentication, adversaries may compromise the integrity of an authentication check with altered headers that would not have otherwise passed.</p><p>An example of a weak or absent DMARC policy is
v=DMARC1; p=none; fo=1;. The p=none. The p=none indicates no action should be taken, and therefore no filtering action will take place, even if an email fails authentication checks (i.e., SPF and/or DKIM fail). When a DMARC policy indicates no action, the email will still be delivered to the victim’s inbox.</p><p>Adversaries have abused weak or absent DMARC policies to circumvent authentication checks and conceal social engineering attempts. Adversaries can alter email headers to include legitimate domain names with fake usernames or impersonate legitimate users via Impersonation for Phishing. Additionally, adversaries may abuse Microsoft 365’s Direct Send functionality to spoof internal users by using internal devices like printers to send emails without authentication.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0431 Detection Strategy for Email Spoofing v1.0
AN1202 WindowsMonitor email message traces and headers for failed SPF, DKIM, or DMARC checks indicating spoofed sender identities. Correlate abnormal sender domains or mismatched return-paths with elevated spoofing likelihood.m365:messagetrace
AuthenticationDetails=fail OR SPF=fail OR DKIM=fail OR DMARC=fail→ DC0038 Application Log ContentTunable:SpoofScoreThresholdMonitoredDomainsAN1203 LinuxDetects spoofed emails by analyzing mail server logs (e.g., Postfix, Sendmail) for mismatched header fields, failed SPF/DKIM checks, and anomalies in SMTP proxy logs. Defender observes discrepancies between sending domain, return-path domain, and message metadata.linux:syslogSPF fail OR DKIM fail OR DMARC fail OR mismatched from_domain vs return_path_domain→ DC0038 Application Log ContentTunable:SenderDomainWhitelistTimeWindowAN1204 macOSDetects suspicious inbound mail traffic where SPF/DKIM/DMARC authentication fails or where sender and return-path domains mismatch, observable in Apple Mail unified logs or MDM-controlled logging pipelines.macos:unifiedlogSPF fail OR DKIM fail OR DMARC fail OR mismatched header vs envelope domains→ DC0038 Application Log ContentTunable:RecipientSensitivityHeaderMismatchToleranceAN1205 Office SuiteCorrelates Office 365 or Google Workspace audit logs for spoofed sender addresses, failed email authentication, and anomalies in message delivery metadata. Defender observes failed SPF/DKIM checks and domain mismatches tied to suspicious campaigns.saas:emailAuthenticationFailures (SPF/DKIM/DMARC) OR Domain Mismatch→ DC0038 Application Log ContentTunable:MessageVolumeThresholdTargetedUserGroups
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1684.002
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.