Gmail Potential Spoofed Email Delivered

Description

Detects when a potentially spoofed email was successfully delivered to a user's inbox despite failing email authentication checks. This rule triggers when: 1. DMARC authentication fails, OR 2. Both SPF and DKIM authentication fail simultaneously These authentication failures indicate the sender may be impersonating a legitimate domain, which is a common tactic in phishing and business email compromise (BEC) attacks.

Query · python

from panther_gsuite_helpers import gsuite_activityevent_alert_context


def rule(event):

    if event.deep_get("id", "applicationName", default="<UNKNOWN_APPLICATION>") != "gmail":
        return False

    dmarc_passed = event.deep_get(
        "parameters",
        "message_info",
        "connection_info",
        "dmarc_pass",
        default="<UNKNOWN_DMARC_PASS>",
    )
    spf_passed = event.deep_get(
        "parameters", "message_info", "connection_info", "spf_pass", default="<UNKNOWN_SPF_PASS>"
    )
    dkim_passed = event.deep_get(
        "parameters",
        "message_info",
        "connection_info",
        "dkim_pass",
        default="<UNKNOWN_DKIM_PASS>",
    )

    event_success = event.deep_get("parameters", "event_info", "success", default=False)

    if event_success is True:  # Message was delivered despite failures
        if dmarc_passed is False:
            return True
        if spf_passed is False and dkim_passed is False:
            return True
    return False


def title(event):
    user = event.deep_get("actor", "email", default="<UNKNOWN_USER>")
    return f"[{user}] received a potentially spoofed email"


def alert_context(event):
    context = gsuite_activityevent_alert_context(event)
    return context

Analyst notes

Review the sender's email address and compare with the From: header display name
Check if the sender domain is impersonating an internal or partner domain
Verify the authentication status details (SPF, DKIM, DMARC)
Review the message subject and content if available
Check the sender's IP geolocation and reputation
Search for similar messages from the same sender to other users
If confirmed as spoofing: - Add sender domain/IP to blocklist - Remove the message from user's inbox - Notify affected users not to interact with the email
Consider strengthening DMARC policy (quarantine/reject) if not already enforced

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Stable
Query type: python
Created: 2025-11-17
Modified: 2026-03-02
Authored by: panther-labs
Source ID
Upstream: rules/gsuite_activityevent_rules/gsuite_potential_spoofed_email.yml
Type: rule
Version: 2
References: https://support.google.com/a/answer/12384955
Data sources: GSuite.ActivityEvent

ATT&CK

TA0001 T1566.001 T1566.002