DKIM-Pass DMARC-Fail via gappssmtp.com Relay from gasparinutrition.com
This rule detects potential email spoofing or relay abuse by identifying emails that claim to be from the 'gasparinutrition.com' domain but fail DMARC authentication, despite showing a DKIM pass status specifically associated with 'gappssmtp.com' subdomains. This behavior is indicative of an adversary attempting to bypass email authentication mechanisms by leveraging legitimate third-party mail relay infrastructure to send spoofed messages.
Splunk (SPL)
