email-security

Original：🇨🇳 Chinese

Translated

Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.

3installs

Sourcezhaoxuya520/reverse-skill

Added on2026-08-16

NPX Install

npx skill4agent add zhaoxuya520/reverse-skill email-security

SKILL.md Content (Chinese)

View Translation Comparison →

Email Security & Phishing Analysis

ACTION REQUIRED (Execute Immediately After Reading)

```
NOW
```
: Confirm authorization (analyze sample emails / tenant configuration review)
```
NOW
```
: Do not re-deliver malicious samples to real users
```
ACT
```
: Header authentication → Content/URL → Attachment sandbox → Tenant control plane recommendations

Applicable Scenarios

Phishing email disassembly and IOC
SPF/DKIM/DMARC configuration evaluation
BEC business email fraud patterns
OAuth application phishing / mailbox token abuse (integrated with llm/cloud identity)
Security awareness drill design (authorized)

Workflow

text

□ Complete original headers: Received chain, consistency between From/Return-Path
□ SPF/DKIM/DMARC alignment results
□ URL sandbox and attachment static analysis (integrated with malware-analysis)
□ Counterfeit brand and reply address discrepancies
□ Tenant: Anti-phishing policies, external tagging, MFA, OAuth app consent

Toolchain

Tool	Purpose
Email client "View Source"	Headers
dig/nslookup	SPF/DKIM/DMARC records
urlscan / sandbox	Links and attachments
Tenant management center	Policies

References

```
references/email-auth-checklist.md
```

../malware-analysis/

../attack-chain/

(Phishing phase)

../windows-ad/

(Tokens)

Routing Context

Upstream: MASTER R36
MUST NOT: Unauthorized mass phishing testing on third-party domains

Task Completion Self-Check

Is the header authentication conclusion complete?
Are IOCs detectable (integrated with threat-hunting)?
Checklist completed?