<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: phishing-defense
description: >-
  Phishing defense operations including email security gateway configuration (SPF/DKIM/
  DMARC/ARC), phishing simulation programs, user awareness training metrics, credential
  harvesting detection, BEC/VEC identification, QR code phishing (quishing), AI-generated
  phishing detection, Microsoft Defender for Office 365 configuration, and phishing
  incident response procedures.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - phishing
  - email-security
  - spf
  - dkim
  - dmarc
  - bec
  - credential-harvesting
  - security-awareness
  - gophish
  - social-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1566", "T1566.001", "T1566.002", "T1598", "T1204.001"]
  nist-csf: ["PR.AT-1", "DE.CM-1", "DE.CM-7"]
  frameworks: ["NIST SP 800-177", "CIS Controls v8 9.1-9.7"]
---

# Phishing Defense

## When to Use

Activate when the operator asks about phishing defense, email security, SPF/DKIM/DMARC,
phishing simulation, BEC (business email compromise), credential harvesting detection,
GoPhish campaigns, or email gateway hardening.

Mode: `[MODE: BLUE]` for email security; `[MODE: RED]` for phishing simulation; `[MODE: ARCHITECT]` for email infrastructure design.

## Quick Reference

| Control | Implementation | Priority |
|---------|---------------|----------|
| SPF | `v=spf1 include:_spf.google.com -all` | 🔴 Critical |
| DKIM | 2048-bit RSA key, rotate annually | 🔴 Critical |
| DMARC | `v=DMARC1; p=reject; rua=mailto:dmarc@company.com` | 🔴 Critical |
| Link protection | URL rewriting + sandbox detonation | 🟡 High |
| Attachment sandbox | Detonate in sandbox before delivery | 🟡 High |
| Phishing simulation | Monthly campaigns with varied pretexts | 🟡 High |
| Report button | One-click phishing report in email client | 🟡 High |
| External tag | `[EXTERNAL]` banner on emails from outside org | 🟠 Medium |

## Workflow

### 1. Email Authentication (SPF/DKIM/DMARC)

```bash
# SPF record check
dig TXT company.com | grep spf
nslookup -type=txt company.com

# DKIM record check
dig TXT selector._domainkey.company.com

# DMARC record check
dig TXT _dmarc.company.com

# DMARC progression (don't jump to reject):
# Phase 1: p=none; rua=mailto:dmarc@company.com (monitor 2-4 weeks)
# Phase 2: p=quarantine; pct=25 (quarantine 25% of failures)
# Phase 3: p=quarantine; pct=100
# Phase 4: p=reject (full enforcement)

# SPF best practices:
# - Use -all (hard fail), not ~all (soft fail)
# - Stay under 10 DNS lookups (use SPF flattening if needed)
# - Include all legitimate senders (marketing platforms, CRM, ticketing)
# - Review quarterly for stale includes

# BIMI (Brand Indicators for Message Identification)
# Display company logo in email client for authenticated messages
# Requires: DMARC p=quarantine or p=reject
# v=BIMI1; l=https://company.com/logo.svg; a=https://company.com/vmc.pem
```

### 2. Phishing Simulation (GoPhish)

```bash
# GoPhish setup
docker run -d --name gophish -p 3333:3333 -p 8080:8080 gophish/gophish

# Campaign design framework:
# Pretexts (rotate monthly):
# - IT password reset (baseline test)
# - Package delivery notification
# - HR benefits enrollment
# - Shared document (OneDrive/Google Drive)
# - Invoice/payment request (BEC simulation)
# - MFA enrollment required
# - CEO request (VEC simulation)

# Metrics to track:
# - Email open rate (awareness of phishing)
# - Click rate (susceptibility)
# - Credential submission rate (critical failure)
# - Report rate (positive behavior)
# - Time to first report (detection speed)
# - Repeat clickers (remediation targeting)

# Target: <5% click rate, >60% report rate
# Repeat clickers (3+ fails): mandatory 1:1 training
```

### 3. BEC/VEC Detection

```
Business Email Compromise indicators:
├── Display name spoofing (CEO name, wrong email address)
├── Lookalike domain (company.com → cornpany.com, company-inc.com)
├── Reply-to mismatch (From: ceo@company.com, Reply-To: ceo@gmail.com)
├── Wire transfer urgency ("process this before end of day")
├── Vendor invoice modification (legitimate vendor, changed bank details)
├── Thread hijacking (compromised mailbox, reply to existing thread)
└── AI-generated content (perfect grammar, generic context)

Detection rules:
├── Flag emails with display name matching executive but external domain
├── Alert on lookalike domain registration (dnstwist monitoring)
├── Detect reply-to mismatches
├── Flag wire/ACH transfer requests from external email
├── Monitor for mailbox forwarding rules (persistence indicator)
└── Detect impossible travel on email authentication (M365/Google)
```

```bash
# Monitor for lookalike domains
dnstwist --registered company.com
# Run weekly, alert on new registrations

# Check mailbox forwarding rules (post-compromise indicator)
# M365 PowerShell:
Get-TransportRule | Where-Object {$_.RedirectMessageTo -ne $null}
Get-InboxRule -Mailbox user@company.com | Where-Object {$_.ForwardTo -or $_.RedirectTo}
```

### 4. Advanced Phishing Vectors

```
Emerging threats:
├── QR Code Phishing (Quishing)
│   ├── QR code in email → bypasses URL scanning
│   ├── Leads to credential harvesting on mobile (no desktop URL inspection)
│   └── Defense: QR code scanning in email gateway, mobile device management
├── AI-Generated Phishing
│   ├── Perfect grammar, personalized context from LinkedIn/social media
│   ├── Voice cloning for vishing (CEO voice requesting wire transfer)
│   └── Defense: Out-of-band verification for financial requests
├── Browser-in-the-Browser (BitB)
│   ├── Fake OAuth popup window within the page
│   └── Defense: Teach users to drag popup off browser window
├── MFA Fatigue / Push Bombing
│   ├── Spam MFA push notifications until user approves
│   └── Defense: Number matching, require biometric for push approval
└── OAuth Consent Phishing
    ├── Malicious app requests broad permissions via OAuth consent
    └── Defense: Admin consent workflow, restrict third-party apps
```

## Verification

- [ ] SPF, DKIM, DMARC all configured and enforced (DMARC p=reject)
- [ ] Email gateway with URL rewriting and attachment sandbox
- [ ] Phishing simulation program running monthly
- [ ] Click rate below 5%, report rate above 60%
- [ ] BEC detection rules active (display name spoofing, reply-to mismatch)
- [ ] External email banner configured
- [ ] Lookalike domain monitoring active (dnstwist weekly)
- [ ] Mailbox forwarding rules audited monthly
