<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-email-detection-rules
description: >-
  Build detection rules for email-based threats including phishing, BEC, malicious attachments, and email infrastructure abuse across mail gateways and cloud email platforms.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - email-security
  - phishing-detection
  - bec-detection
  - mail-gateway
  - attachment-analysis
  - header-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566"]
---

# Building Email Detection Rules

## Overview

Email detection rules identify phishing, business email compromise (BEC),
malicious attachments, and email infrastructure abuse.
Covers header analysis, URL inspection, attachment sandboxing, and DMARC enforcement.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Mail gateway access | Exchange Online, Proofpoint, or Mimecast |
| Email headers | Full header capture for analysis |
| URL reputation | VirusTotal, URLhaus, or equivalent API access |

## Key Concepts

### Email Threat Detection Patterns

```yaml
# Email phishing detection rule
rule:
  name: "Suspected Executive Impersonation BEC"
  description: >-
    Detects emails impersonating executives using display name
    spoofing with external sender addresses.
  conditions:
    - header.from.display_name:
        matches_any: "${executive_names_list}"
    - header.from.address:
        not_in: "${internal_domains}"
    - header.reply_to.address:
        not_equals: header.from.address
    - header.authentication_results:
        dmarc: "fail"
  actions:
    - quarantine
    - notify_soc
    - tag: "bec_suspected"
  severity: high
  mitre: T1566.002
```

## Workflow

1. **Profile email threats** — Catalog phishing, BEC, and attachment attack patterns
2. **Configure telemetry** — Ensure mail flow logs and headers are captured
3. **Author rules** — Write detection logic for email threat indicators
4. **Test with samples** — Validate against known phishing and benign email samples
5. **Tune sender reputation** — Integrate allow/block lists and DMARC results
6. **Deploy to gateway** — Push rules to mail gateway or cloud email security
7. **Monitor and adapt** — Track detection rates and adapt to evolving tactics

## Detection

```yaml
title: Email Detection Rules Detection
id: 8703bccf-877c-4caf-a9db-017f14be8438
status: experimental
description: Detects suspicious activity related to building email detection rules techniques in detection engineering context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*email*"
  condition: selection
level: medium
tags:
  - attack.t1566
  - attack.defense_evasion
falsepositives:
  - Detection rule testing in staging SIEM environment
```

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
