T1684.002 — Email Spoofing

Tactic: Stealth · Platforms: Linux, macOS, Office Suite, Windows

Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses. In addition to actual email content, email headers (such as the FROM header, which contains the email address of the sender) may…

Sub-technique of Social Engineering (T1684).

Sigma detection rules (4)

T1684.002 Social Engineering: Email Spoofing

title: "T1684.002 Social Engineering: Email Spoofing"
id: 5093fb5c-1546-47c8-b9b2-a804b3fbcdec
description: 'Detection Strategy for Email Spoofing. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: SpoofScoreThreshold, MonitoredDomains.'
references:
  - https://attack.mitre.org/techniques/T1684/002
author: Shahrukh Khan
date: 2026-04-23
license: MIT
tags:
  - attack.stealth
  - attack.t1684.002

logsource:
  product: m365
  service: exchange

detection:
  selection_auth:
    SPF: 'fail'
    DKIM: 'fail'
    DMARC: 'fail'
  selection_domain:
    SenderDomain: 'heyshahrukh.me'

  condition: selection_auth and selection_domain

falsepositives:
  - Legitimate third-party senders or marketing platforms sending on behalf of the monitored domain that have not been added to the SPF or DKIM records.

level: medium

T1684.002 Social Engineering: Email Spoofing

title: "T1684.002 Social Engineering: Email Spoofing"
id: f66812b7-669a-4f8b-90ac-37f3fe475752
description: 'Detection Strategy for Email Spoofing. Raw auditd EXECVE and PATH records covering sendmail or postdrop execution cannot observe SMTP envelope or header content or authentication verdicts at all, and the previous version mixed a process_creation category and a syslog service with the auditd-only exe field, an internally inconsistent combination that could never distinguish spoofed mail from ordinary relay activity. Retargeted to real Postfix policy-daemon syslog output (opendmarc and policyd-spf log lines emitted through syslog or journald), matching the SPF, DKIM, and DMARC failure and rejection messages those daemons actually write, the closest Linux-observable signal for the header-spoofing behavior this technique describes. Tune using: SenderDomainWhitelist, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1684/002
author: Shahrukh Khan
date: 2026-01-16
license: MIT
tags:
  - attack.stealth
  - attack.t1684.002

logsource:
  product: linux
  service: postfix

detection:
  selection_spf_fail:
    MESSAGE|contains|all:
      - 'Sender Policy Framework (SPF)'
      - 'fail'
  selection_dkim_fail:
    MESSAGE|contains|all:
      - 'DKIM'
      - 'fail'
  selection_dmarc_reject:
    MESSAGE|contains|all:
      - 'DMARC'
      - 'reject'

  condition: 1 of selection_*

falsepositives:
  - Misconfigured legitimate senders (missing or broken SPF/DKIM records, forwarding services that break SPF alignment) also produce these failure log lines; correlate with SenderDomainWhitelist before actioning.

level: medium

T1684.002 Social Engineering: Email Spoofing

title: "T1684.002 Social Engineering: Email Spoofing"
id: 034bb877-29a3-4f8b-821a-8913e21ceeb1
description: 'Detection Strategy for Email Spoofing. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: RecipientSensitivity, HeaderMismatchTolerance.'
references:
  - https://attack.mitre.org/techniques/T1684/002
author: Shahrukh Khan
date: 2026-03-11
license: MIT
tags:
  - attack.stealth
  - attack.t1684.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/Mail.app/Contents/MacOS/Mail'

  condition: selection

falsepositives:
  - Detecting header spoofing or a mismatched Reply-To address requires parsing raw email headers, which unified log application telemetry does not expose; this rule cannot see message content and will not reliably catch this technique without a mail gateway integration.

level: low

T1684.002 Social Engineering: Email Spoofing

title: "T1684.002 Social Engineering: Email Spoofing"
id: 09e2f29f-7a61-43f9-9b20-dd171d566644
description: 'Detection Strategy for Email Spoofing. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: MessageVolumeThreshold, TargetedUserGroups.'
references:
  - https://attack.mitre.org/techniques/T1684/002
author: Shahrukh Khan
date: 2026-05-09
license: MIT
tags:
  - attack.stealth
  - attack.t1684.002

logsource:
  product: saas
  service: email

detection:
  selection:
    event_type: 'spoofed_sender_detected'

  condition: selection

falsepositives:
  - Legitimate mail relays or a partner domain with a temporarily misconfigured SPF or DKIM record can trigger the same spoofed-sender classification.

level: medium

Related sub-techniques

Explore