topic Re: Alert to detect email spoofing - Sender address and reply to address different in Splunk Search

Alert to detect email spoofing - Sender address and reply to address different

DDewarSplunk — Wed, 23 Jan 2019 10:25:14 GMT

Morning Splunk Gurus's, I wonder if you can solve a question I have?

If an email is sent to you and the senders email address has been spoofed, if you click reply the address changes to a fake email address. How do I monitor exchange logs to say if the "From" field in the email email is not the same as the "Return-path" field then alert me ?

X-Sender-Id - This is the real sender
The "Reply To" header is presented to the end-user but the actual reply goes to a field called "Return-Path"
Return Path: This field is what the mail server would use if the end-user chooses to reply to sender
From: This is address from someone you know \ trust, the email address of the impersonated sender.

I've been racking my brain trying to work this out, and would really appreciate any thoughts \ ideas you might have

Cheers
D

Re: Alert to detect email spoofing - Sender address and reply to address different

DDewarSplunk — Wed, 23 Jan 2019 12:30:02 GMT

Im thinking a eval and if command might work
To say if email field x is not the same as email field y then alert...any ideas ?

Many thanks

Re: Alert to detect email spoofing - Sender address and reply to address different

davidc0805 — Sun, 01 Mar 2020 09:18:37 GMT

I was wondering about this as well but want to add an exclusion list into it due to known emails that come in from certain teams that the return path is a team inbox so it will show as sent on behalf and replies go back to the team inbox so that any replies don't get dropped say when they are not at work. Have you had any luck with what you were trying.,Trying to figure this one out myself but throw a curve ball at it as well because I know some emails come into my environment using a email sent on behalf. So would have a listed of exclusions I would like to build into the alert. Have you had any luck figuring this out.

Re: Alert to detect email spoofing - Sender address and reply to address different

to4kawa — Sun, 01 Mar 2020 10:26:05 GMT

If you can find that information in the log, you can fix it.
In Smtp protocol, there is only sender and recipient.

the others is all data.

if you can see Reply To, you can detect email spoofing.
that's great.