Analytics BIOC Informational
✕

Suspicious DKIM Result

The email contains a suspicious DKIM entry, showing either an unexpected verification result (none, fail, or policy) or a mismatched signing domain, which may indicate potential tampering or spoofing activity.

Module:
Email Security
Licensed by:
Email Security
Data source:
Microsoft 365 Emails
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impersonation (T1656)
Detector tags: Spoofing
Attacker's goals:

Impersonate internal users or familiar individuals and trick them into clicking on malicious links or attachments.

Investigative actions:

Check the email address for any unusual spellings, missing letters, or unknown domains. Examine the sender's IP address and reputation, and check why DKIM didn't pass. Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Test period:
N/A (single event)
Deduplication:
1 Day
4 variations:
  • Known domain DKIM deviation Informational
  • Lack DKIM signature from typically signing domains Informational
  • DKIM results lacking sender correlation Informational
  • Known domain suspicious DKIM result Informational