skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-spearphishing-with-email-gateway

Configure email security gateways to detect and block targeted spearphishing attacks.

954|172|Updated Mar 13, 2026
Search Tags:#threat detection#siem#dmarc#email security#phishing defense#spearphishing#impersonation detection
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-spearphishing-with-email-gateway
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-spearphishing-with-email-gateway
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/phishing-defense/detecting-spearphishing-with-email-gateway
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-spearphishing-with-email-gateway

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Targeted spearphishing emails bypass generic spam filters because they use personalized, researched content sent in low volumes, leaving executives and finance staff exposed to impersonation and fraud.

Core Features & Use Cases

  • Impersonation Protection: Configure user and domain impersonation detection in Microsoft Defender for Office 365, Proofpoint, Mimecast, and Barracuda to catch display-name spoofing and lookalike domains.
  • URL and Attachment Defense: Enable time-of-click URL detonation, newly-registered-domain blocking, and attachment sandboxing with dynamic delivery to counter delayed weaponization and sandbox evasion.
  • Use Case: A SOC analyst investigating a near-miss CEO fraud attempt uses this workflow to enable VIP impersonation policies, validate detection with test spoof emails, and wire gateway alerts into the SIEM.

Quick Start

Configure impersonation protection and URL detonation policies in my email security gateway to detect spearphishing targeting our executives.

Frequently Asked Questions about detecting-spearphishing-with-email-gateway

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect spearphishing emails that pass SPF and DKIM?▼

Spearphishing detection requires impersonation protection beyond authentication checks, since attackers spoof display names or use lookalike domains that pass SPF/DKIM legitimately. Enable user and domain impersonation policies in your gateway and add similarity matching against your domains and partners.

How to configure impersonation protection in Microsoft Defender for Office 365?▼

In Microsoft Defender for Office 365, go to Security > Anti-phishing policies > Impersonation settings, enable user and domain impersonation protection, add protected users such as the CEO and CFO, and set the action to quarantine messages.

Why does URL detonation miss malicious links in phishing emails?▼

URL detonation fails when attackers delay weaponization until after delivery, geofence or cloak pages, or gate content behind CAPTCHAs. Mitigate this by enabling time-of-click URL rewriting and blocking newly registered domains rather than relying only on delivery-time scanning.

Can attachment sandboxing detect all malicious documents?▼

Attachment sandboxing can be evaded by password-protected archives, URL-only lures with no attachment, and VM-aware payloads. Set detonation timeouts to 60 seconds or more, attempt archive passwords found in the message body, and use dynamic delivery.

How do I validate that spearphishing detection rules actually work?▼

Validate detection by sending test impersonation emails with spoofed VIP display names, delayed-detonation URLs, and macro-enabled documents, then confirm quarantine actions fire. Reduce false positives by allowlisting legitimate bulk senders before tightening thresholds.

Related Skills

Explore More Software Engineering Skills→
afoxnyc3afoxnyc3

sender-policy-check

Evaluate SPF, DKIM, and DMARC alignment with Mimecast reputation for sender domains.

Community
Intermediate
starwreckntxstarwreckntx

Security Orchestration Agent

Automate security playbooks and incident-response workflows across security swarm agents.

Community
Basic
starwreckntxstarwreckntx

Security Awareness Agent

Coordinate security awareness training, phishing simulations, and metrics tracking.

Community
Basic
YukiIto1999YukiIto1999

analyzing-email-headers-for-phishing-investigation

Parse email headers and DNS records to trace phishing origins.

Community
Intermediate