<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-social-engineering-indicators
description: >-
  Identify, classify, and respond to indicators of social engineering attacks across email, phone, and physical vectors.
domain: cybersecurity
subdomain: social-engineering
tags:
  - social-engineering
  - threat-analysis
  - indicators
  - detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1598"]
---

# Analyzing Social Engineering Indicators

## Overview

Identify, classify, and respond to indicators of social engineering attacks across email, phone, and physical vectors.

## Prerequisites

| Requirement | Install |
|---|---|
| Email gateway logs | Mail flow data |
| SIEM | Correlation |
| Python 3.10+ | For agent tooling |

## Key Concepts

SE indicators include suspicious email patterns, unusual request
timing, authority impersonation, urgency pressure, and information
gathering attempts across channels.

## Quick Reference

```bash
node agent.js analyze-email --file suspicious.eml
node agent.js scan --mailbox cfo@company.com --days 30
node agent.js correlate --source email --target phone-logs
node agent.js report --format json
```

## Workflow

1. Collect suspected communications
2. Parse email headers
3. Analyze body for manipulation
4. Cross-reference threat actors
5. Correlate channels
6. Classify threat level
7. Update detection rules

## Verification

- Verify parser extracts headers
- Confirm classification matches
- Validate correlation actionable
- Check severity ratings
- Verify rules updated

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
