Domain Spoofing - Open Relay Abuse via Internal Exchange (T1566.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Detects a high volume of outbound emails originating from an internal Exchange server to external addresses with spoofed headers, indicating an Open Relay exploit.