Domain Spoofing - Envelope vs. Header Mismatch
Detects malicious emails bypassing spam filters due to a mismatch between the P1 (Envelope) and P2 (Header) sender addresses, exploiting routing misconfigurations. This rule specifically looks for instances where the 'SenderFromDomain' (P2 header) matches 'yourcompany.com' while the 'SenderMailFromDomain' (P1 envelope) is different, indicating an attempt to spoof the sender's domain.
Microsoft Sentinel (KQL)
