Domain Spoofing - Cross-Tenant Spoofing Bypass (T1566.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Tracks AAD/Exchange logs showing mail routed through an external tenant specifically to bypass internal domain spoofing filters via trusted connectors. This rule identifies emails where the sender's domain matches the internal company domain, but the email was routed through an external Office 365 connector and did not originate from a trusted internal IP address, indicating a potential cross-tenant spoofing attempt.