Email with Spoofed Display Name but Different Domain

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects emails sent over SMTP where the 'From:' and 'Reply-To:' headers are present, indicating a potential attempt to spoof the sender's display name while using a different domain. It triggers an alert if 10 such emails are observed from the same source within 60 seconds, suggesting a bulk email or phishing attempt.