Direct Send Email Spoofing Detection
This rule detects potential direct send email spoofing attempts where an email fails SPF, DKIM, and DMARC authentication checks, but passes Composite Authentication (CompAuth). Additionally, it looks for emails where the sender's local part (username before the @) matches the recipient's local part, suggesting an attempt to impersonate an internal user. The rule also filters out emails that were blocked and those sent via internal connectors, focusing on external spoofing attempts. It further excludes emails originating from specific countries (New Zealand, Australia) which can be customized.
Microsoft Sentinel (KQL)
