1. before reply to any mail, please check that reply address is set as the appropriate one. from the address you received the mail and to the address the mail is suppose to going should be same. as well as check the domain name as well. because sender name, email address and domain name can be spoofed easily. so if the mail looks suspicious then check it reply-to header, domain header. you can do this by checking mail source code. for example, from thunderbard email client navigate to more > view source code
in this source code all the necessary email header you can get.
2. check mail return path. return path says if the mail bounce back then where should the bounce back mail should come. return-path should be the sender mail address. if it is another mail address then it is suspicious.
3. check the mail attachment. sometimes it is showing doc or excel attachment but behind this exe file is hidden. so analysis the following headers from the source code.
Content-Type: Application/Octet-Stream
Content-Transfer-Encoding: base64
Content-Disposition: Attachment
Here content-type header clearly saying that attachment is application which is binary and non-readable exe format to human. most email service provider forbidden to transfer exe file in email in order to prevent rogue programs transfer. that is why attacker try to hide the exe file under docs or excel or rar files.
4. check antispam header which is X-Spamd-Bar and X-Spam-Level header. Rspamd antispam filter or if any mail server perform antispam filtering then those mail server add the above two headers in the mail source code. values are written in ++++++ sign or ****** sign. more the value comes the mail is more suspicious. though it has not been standardized so manual analysis based on suspicion.
5. another important header is Received header. it shows the trail or path of a mail message from sender to receiver. the downmost Received header is the origin mail server of the mail message. after that each server adds its header when the email pass through. here delay is count. meaning to cross each email server how much the time delay occured!! generally some seconds needs to cross hops. but if you see here time delay is huge then this is suspicious. Google has a very good online tool to calculate time delay received header. but remember if attacker compromise the email server then he can send email quickly and you cannot notice that.
https://toolbox.googleapps.com/apps/messageheader/analyzeheader
https://toolbox.googleapps.com/apps/main/
6. check email Authentication-Results header. the value could be none | pass | fail
none means no SPF record found. Pass means SPF, DKIM, DMARC all values are correct. fail means SPF, DKIM, DMARC all values are not correct.
if these 3 values are correct that means your mail servers are authenticated by other mail services, mail servers and ISP's.
SPF - Sender policy framework. it says that what ip address or what servers are allowed to send email from that particular domain. based on that their hostname and ip addresses are published on their dns txt record.
DKIM - Domain keys identified mail. it follows a cryptographic formula. each mail are signed by the domain private key. and public key are stored on that domain's dns txt record. other mail server or isp's can verify that the email header and email message has not been altered or tempered.
DMARC - domain-based message authentication, reporting and conformance. it confirms senders email message are protected by both SPF and DKIM values.
mxtoolbox is a another great tool to analyze mails.
sometimes you need to extract url from email attachment (.yml file). for example say one of your organization user attach a suspicious email for you to analysis. that email could contain some url or link. on those cases, urlextractor can help.
urlscan.io can help to find out what that url actually is. virustotal can also help.
ipinfo.io will also help to find ip address of a company.
Comments
Post a Comment