<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-email-lateral-phishing
description: >-
  Detect and respond to lateral phishing attacks where compromised internal accounts send phishing emails to other employees.
domain: cybersecurity
subdomain: email-security
tags:
  - lateral-phishing
  - account-compromise
  - internal-threats
  - email-analysis
  - detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1534"]
---

# Detecting Email Lateral Phishing

## Overview

Lateral phishing occurs when an attacker compromises an internal email
account and uses it to send phishing messages to other employees. These
attacks bypass external email security controls and exploit established
trust relationships.

## Prerequisites

| Requirement | Install |
|---|---|
| Internal mail flow logs | Visibility into internal-to-internal email |
| User behavior baseline | Normal communication patterns per user |
| SIEM platform | Correlation and alerting capabilities |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Attack Lifecycle

1. **Initial compromise** — External phishing or credential theft
2. **Reconnaissance** — Attacker reads contacts, org chart, threads
3. **Crafting** — Phishing email tailored using internal context
4. **Distribution** — Sent from compromised account to targets
5. **Expansion** — Newly compromised accounts repeat the cycle

### Detection Signals

- **Volume anomaly** — User sends more internal emails than baseline
- **Recipient anomaly** — Messages to users outside normal graph
- **Content anomaly** — Links to external credential harvesting sites
- **Timing anomaly** — Emails sent at unusual hours
- **Session anomaly** — Concurrent sessions from different locations

### Containment Actions

- Disable compromised account immediately
- Revoke active sessions and OAuth tokens
- Reset credentials and enforce MFA re-enrollment
- Purge phishing messages from recipient mailboxes
- Notify recipients who may have clicked links

## Workflow

1. **Baseline internal communication** — map normal sender/recipient graph per user
2. **Monitor internal mail volume** — alert on send volume exceeding baseline
3. **Analyze recipient patterns** — flag messages to unusual recipients
4. **Scan internal links** — inspect URLs in internal-to-internal messages
5. **Correlate with auth logs** — match anomalous sends with suspicious logins
6. **Contain compromised account** — disable, revoke tokens, reset credentials
7. **Purge and notify** — remove phishing messages and alert affected recipients


## Detection

```yaml
title: Detect Email Lateral Phishing — Internal Send Volume Spike
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects internal users sending significantly more emails than their 30-day baseline, indicating potential account compromise.
logsource:
  category: email
  service: exchange
detection:
  selection:
    Direction: 'Internal'
  condition: selection | count(Recipient) by Sender > 50
falsepositives:
  - Legitimate administrative activity from authorized accounts
level: medium
tags:
  - attack.t1534
  - attack.lateral_movement
```

## Verification

| Check | Method |
|---|---|
| Volume alerts | Send volume anomaly detected within 15 minutes |
| Recipient anomaly | Messages to unusual recipients flagged correctly |
| Link scanning | External credential harvesting URLs identified |
| Auth correlation | Suspicious login correlated with anomalous send |
| Containment speed | Account disabled within 30 minutes of detection |

## References

- [MITRE ATT&CK — T1534](https://attack.mitre.org/techniques/T1534/)
- [Microsoft — Compromised Account Response](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-user-account)
- [Google — Investigate compromised accounts](https://support.google.com/a/answer/2984349)
- [Barracuda — Lateral Phishing](https://www.barracuda.com/reports/spear-phishing)
