DMARC Fail with DKIM Pass via gappssmtp.com Misalignment (gasparinutrition.com)
This rule detects potential email spoofing attempts where an email claims to originate from a specific domain ('gasparinutrition.com') or is intended for external recipients, but fails critical authentication checks. Specifically, it identifies emails with DMARC failure, SPF failure, and a suspicious DKIM signing domain associated with 'gappssmtp.com', indicating an attempt to bypass sender authentication mechanisms.
Microsoft Sentinel (KQL)
