Techniques › T1684.002 › AN1203
AN1203 Analytic 1203
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects spoofed emails by analyzing mail server logs (e.g., Postfix, Sendmail) for mismatched header fields, failed SPF/DKIM checks, and anomalies in SMTP proxy logs. Defender observes discrepancies between sending domain, return-path domain, and message metadata.</p>
- Detects
- T1684.002 Email Spoofing
- Part of
- DET0431 Detection Strategy for Email Spoofing
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| linux:syslog | SPF fail OR DKIM fail OR DMARC fail OR mismatched from_domain vs return_path_domain | DC0038 Application Log Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
SenderDomainWhitelist | Defines approved sender domains to suppress alerts for expected mismatches, reducing false positives. |
TimeWindow | Sets correlation period for repeated spoofing attempts to flag campaigns vs. isolated misconfigurations. |