Phishing Email Failing SPF Authentication
This rule detects SMTP traffic where an email is failing SPF (Sender Policy Framework) authentication. Specifically, it looks for the 'Received-SPF: fail' header in emails sent to port 25 ($HOME_NET). This indicates that the sending server is not authorized to send email on behalf of the domain specified in the email's 'MAIL FROM' address, which is a strong indicator of a phishing attempt or spoofed email.
Suricata
