Domain Spoofing - Spoofed Internal Email Dropping Payload (T1204.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•8

Correlates a spoofed internal email delivering an attachment that subsequently launches PowerShell on the endpoint. Specifically, it looks for emails where the sender's domain is 'yourcompany.com' but SPF authentication fails, and then links this to a device where 'powershell.exe' is executed with specific command-line arguments indicative of web requests or encoded commands.