mukul975/detecting-spearphishing-with-email-gateway
skills/detecting-spearphishing-with-email-gateway/SKILL.md
Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection, URL rewriting, attachment sandboxing, and custom detection rules in Microsoft Defender for Office 365, Proofpoint, Mimecast, or Barracuda. Use when hardening a mail gateway against targeted phishing or investigating a suspected spearphishing campaign.
$ install --global
skillsauthnpx skillsauth add mukul975/anthropic-cybersecurity-skills detecting-spearphishing-with-email-gatewayInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Aug 9, 2026, 3:34 AM55.7s7 files scanned
SKILL.md
- name:
- Create Fake Materials: Fake Website
- description:
- Detect and block spearphishing emails that use personalized, researched
- domain:
- cybersecurity
- subdomain:
- phishing-defense
- version:
- 1.1
- author:
- mahipal
- license:
- Apache-2.0
- - id:
- F1020.002
- tactic:
- resource-development
- source:
- f3
Detecting Spearphishing with Email Gateway
Overview
Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint, Mimecast, and Barracuda provide advanced detection capabilities including behavioral analysis, URL detonation, attachment sandboxing, and impersonation detection. This skill covers configuring these gateways to detect and block targeted phishing attacks.
When to Use
- When investigating security incidents that require detecting spearphishing with email gateway
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Access to email security gateway admin console
- Understanding of email flow architecture (MX records, transport rules)
- Familiarity with SPF/DKIM/DMARC authentication
- Knowledge of common spearphishing techniques and pretexts
Key Concepts
Spearphishing Characteristics
- Targeted recipients: Specific individuals, often executives or finance staff
- Researched pretexts: References to real projects, colleagues, or events
- Impersonation: Spoofs trusted senders (CEO, vendor, partner)
- Low volume: Few emails to avoid pattern-based detection
- Urgent tone: Creates pressure to act quickly
Gateway Detection Layers
- Reputation filtering: IP/domain/URL reputation scoring
- Authentication checks: SPF, DKIM, DMARC validation
- Content analysis: NLP-based analysis of email body
- Impersonation detection: Display name and domain similarity matching
- URL analysis: Real-time URL detonation and redirect following
- Attachment sandboxing: Behavioral analysis of attachments in isolated environments
- Behavioral analytics: Anomaly detection in communication patterns
Workflow
Step 1: Configure Impersonation Protection
Microsoft Defender for Office 365:
Security > Anti-phishing policies > Impersonation settings
- Enable user impersonation protection for VIPs
- Enable domain impersonation protection
- Add protected users (CEO, CFO, HR Director)
- Set action: Quarantine message
Proofpoint:
Email Protection > Impostor Classifier
- Enable display name spoofing detection
- Configure lookalike domain detection
- Set Impostor threshold sensitivity
Step 2: Configure URL Protection
- Enable Safe Links / URL rewriting
- Enable time-of-click URL detonation
- Block newly registered domains (< 30 days)
- Enable URL redirect chain following
Step 3: Configure Attachment Sandboxing
- Enable Safe Attachments / attachment sandboxing
- Configure dynamic delivery (deliver body, hold attachments)
- Set sandbox detonation timeout to 60+ seconds
- Block macro-enabled Office documents from external senders
Step 4: Create Custom Detection Rules
Use the scripts/process.py to analyze email gateway logs, identify spearphishing patterns, and generate custom detection rules.
Step 5: Configure Alert and Response Actions
- Real-time alerts for impersonation attempts
- Automatic quarantine for high-confidence detections
- User notification with safety tips
- Integration with SIEM for correlation
Tools & Resources
- Microsoft Defender for Office 365: https://security.microsoft.com
- Proofpoint Email Protection: https://www.proofpoint.com/us/products/email-security
- Mimecast Email Security: https://www.mimecast.com/products/email-security/
- Barracuda Email Protection: https://www.barracuda.com/products/email-protection
Validation
- Impersonation protection correctly identifies spoofed VIP display names
- URL detonation catches malicious links in test phishing emails
- Attachment sandboxing detects weaponized documents
- Custom rules trigger on known spearphishing patterns
- SIEM integration receives gateway alerts
Related Skills
mukul975/executing-phishing-simulation-campaign
tools
VerifiedTrustedCommunity
Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.
30,389SKILL.mdUpdated Aug 21, 2026
mukul975/executing-nist-rmf-authorization-to-operate
development
VerifiedTrustedCommunity
Drive a federal system through the NIST Risk Management Framework (SP 800-37 Rev 2) to an Authorization to Operate (ATO): Prepare, Categorize (FIPS 199), Select a control baseline (FIPS 200 / SP 800-53 Rev 5), Implement, Assess (SP 800-53A), Authorize, and Monitor continuously. Use when a system needs an ATO or a renewal, when working a FISMA/FedRAMP authorization package, when building or reviewing an SSP, SAR, or POA&M, when categorizing a system as Low/Moderate/High impact, when selecting or tailoring a control baseline, or when standing up continuous monitoring (ConMon) after authorization. Covers ATO, conditional ATO (cATO), and the artifacts assessors expect. Keywords: NIST RMF, 800-37, ATO, authorization to operate, FISMA, FedRAMP, SSP, SAR, POA&M, FIPS 199, FIPS 200, 800-53, 800-53A, control baseline, security categorization, continuous monitoring, authorizing official, system boundary, ongoing authorization.
30,389SKILL.mdUpdated Aug 21, 2026
mukul975/executing-active-directory-attack-simulation
development
VerifiedTrustedCommunity
Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.
30,389SKILL.mdUpdated Aug 21, 2026
mukul975/evaluating-threat-intelligence-platforms
tools
VerifiedTrustedCommunity
Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.
30,389SKILL.mdUpdated Aug 21, 2026