<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-email-security-monitoring
description: >-
  Monitor and analyze email security logs for phishing, BEC, malware delivery,
  and policy violations. Covers mail flow analysis, header inspection, attachment
  sandboxing integration, and DMARC/DKIM/SPF enforcement monitoring.
domain: cybersecurity
subdomain: blue-team
tags:
  - email-security
  - phishing-detection
  - dmarc
  - microsoft-365
  - mail-flow
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566"]
---

# Implementing Email Security Monitoring

## Overview

Email remains the primary initial access vector for enterprise attacks. Monitoring
email security logs enables detection of phishing campaigns, business email
compromise (BEC), malware delivery, and authentication failures. This skill covers
log collection from mail platforms, header analysis, and detection rule authoring.

## Prerequisites

| Requirement | Install |
|---|---|
| Microsoft 365 / Exchange | Mail platform with audit logging |
| Message Trace logs | Exchange admin center or PowerShell |
| DMARC/DKIM/SPF records | DNS-based email authentication |
| SIEM with email data | Indexed mail flow and audit logs |
| Python 3.10+ | Agent tooling |

## Key Concepts

### Email Log Sources

| Source | Data | Use Case |
|---|---|---|
| Message Trace | Sender, recipient, subject, status | Mail flow analysis |
| Safe Attachments | Detonation verdict, file hash | Malware detection |
| Safe Links | URL click, user, verdict | Phishing click tracking |
| DMARC reports | SPF/DKIM alignment, source IP | Authentication monitoring |
| Mailbox Audit | Login, delegation, forwarding rules | BEC detection |

### Detection Queries

```spl
| -- Phishing: Office macro attachment from external sender
index=o365 sourcetype="o365:messageTrace" Direction="Inbound"
  (Subject="*invoice*" OR Subject="*payment*" OR Subject="*urgent*")
  AttachmentNames="*.xlsm" OR AttachmentNames="*.docm"
| stats count by SenderAddress, RecipientAddress, Subject, AttachmentNames

| -- BEC: new inbox forwarding rule created
index=o365 sourcetype="o365:management" Operation="New-InboxRule"
| spath input=Parameters
| search ForwardTo="*" OR RedirectTo="*"
| stats count by UserId, ForwardTo, RedirectTo, ClientIP

| -- Authentication failure: DMARC reject
index=email sourcetype="dmarc"
| spath input=record
| search policy_evaluated.dkim="fail" policy_evaluated.spf="fail"
| stats count by source_ip, header_from, policy_evaluated.disposition
```

### Sigma Rule for Email Threats

```yaml
title: Suspicious Inbox Forwarding Rule to External Address
id: e5f6a7b8-9c0d-1e2f-3a4b-5c6d7e8f9a0b
status: experimental
description: Detects creation of inbox rules forwarding to external domains
logsource:
  product: m365
  service: exchange
detection:
  selection:
    Operation: 'New-InboxRule'
  filter_internal:
    ForwardTo|endswith: '@company.com'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate forwarding rules for shared mailboxes
level: high
tags:
  - attack.collection
  - attack.t1114.003
```

### DMARC Monitoring

```bash
# Parse DMARC aggregate reports
cat dmarc-report.xml | python3 -c "
import xml.etree.ElementTree as ET, sys
tree = ET.parse(sys.stdin)
for record in tree.findall('.//record'):
    ip = record.find('row/source_ip').text
    count = record.find('row/count').text
    dkim = record.find('row/policy_evaluated/dkim').text
    spf = record.find('row/policy_evaluated/spf').text
    print(f'{ip}: count={count} dkim={dkim} spf={spf}')
"
```

## Workflow

1. **Enable logging** — Turn on message trace, mailbox audit, DMARC reporting
2. **Forward to SIEM** — Ingest via O365 Management API or syslog
3. **Parse and normalize** — Map to CIM Email data model
4. **Baseline** — Profile normal mail flow patterns (top senders, volumes)
5. **Build detections** — Create rules for phishing, BEC, and auth failures
6. **Monitor DMARC** — Track SPF/DKIM alignment and reject rates
7. **Respond** — Integrate with SOAR for automated phishing response

## Verification

| Check | Method |
|---|---|
| Message Trace flowing | `index=o365 sourcetype="o365:messageTrace"` returns data |
| Audit logs enabled | Mailbox audit events appearing in SIEM |
| DMARC reports parsed | Aggregate reports processed and indexed |
| Detection rules active | Test phishing simulation triggers alert |
| Forwarding rules monitored | New-InboxRule events captured |

## References

- [Microsoft 365 Message Trace](https://learn.microsoft.com/en-us/exchange/monitoring/trace-an-email-message)
- [DMARC Specification (RFC 7489)](https://datatracker.ietf.org/doc/html/rfc7489)
- [MITRE ATT&CK T1566 Phishing](https://attack.mitre.org/techniques/T1566/)
- [O365 Management Activity API](https://learn.microsoft.com/en-us/office/office-365-management-api/)
