tfMITRE ATT&CK sub-technique

Email Spoofing T1684.002

sub-technique of T1684 Social Engineering

Tactic: Stealth
Platforms: Linux, macOS, Office Suite, Windows
Version: 1.0
Created: 14 April 2026
Last modified: 12 May 2026

Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses.[1] In addition to actual email content, email headers (such as the FROM header, which contains the email address of the sender) may also be modified. Email clients display these headers when emails appear in a victim's inbox, which may cause modified emails to appear as if they were from the spoofed entity.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1684.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Email Spoofing detection strategy DET0431

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Email Spoofing

Enterprise

4 platforms

AN1202 · Windows

Monitor email message traces and headers for failed SPF, DKIM, or DMARC checks indicating spoofed sender identities. Correlate abnormal sender domains or mismatched return-paths with elevated spoofing likelihood.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	m365:messagetrace	AuthenticationDetails=fail OR SPF=fail OR DKIM=fail OR DMARC=fail

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SpoofScoreThreshold	Defines sensitivity to SPF/DKIM/DMARC failures; higher thresholds reduce false positives but may miss stealthier spoofing.
MonitoredDomains	Specifies which domains to enforce strict validation against; enterprise-specific tuning may be required.

AN1203 · Linux

Detects spoofed emails by analyzing mail server logs (e.g., Postfix, Sendmail) for mismatched header fields, failed SPF/DKIM checks, and anomalies in SMTP proxy logs. Defender observes discrepancies between sending domain, return-path domain, and message metadata.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	linux:syslog	SPF fail OR DKIM fail OR DMARC fail OR mismatched from_domain vs return_path_domain

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SenderDomainWhitelist	Defines approved sender domains to suppress alerts for expected mismatches, reducing false positives.
TimeWindow	Sets correlation period for repeated spoofing attempts to flag campaigns vs. isolated misconfigurations.

AN1204 · macOS

Detects suspicious inbound mail traffic where SPF/DKIM/DMARC authentication fails or where sender and return-path domains mismatch, observable in Apple Mail unified logs or MDM-controlled logging pipelines.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	macos:unifiedlog	SPF fail OR DKIM fail OR DMARC fail OR mismatched header vs envelope domains

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RecipientSensitivity	Allows tuning based on which users (e.g., executives, finance staff) receive stricter spoofing detection policies.
HeaderMismatchTolerance	Defines tolerance for minor discrepancies in domain alignment, balancing detection with usability.

AN1205 · Office Suite

Correlates Office 365 or Google Workspace audit logs for spoofed sender addresses, failed email authentication, and anomalies in message delivery metadata. Defender observes failed SPF/DKIM checks and domain mismatches tied to suspicious campaigns.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	saas:email	AuthenticationFailures (SPF/DKIM/DMARC) OR Domain Mismatch

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MessageVolumeThreshold	Defines thresholds for spoofed messages volume before alerts trigger, reducing noise for isolated misconfigs.
TargetedUserGroups	Restricts higher-sensitivity detection to high-value groups (executives, admins, finance) for efficiency.

Email Spoofing detections T1684.002

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs