Chapter 9
Email Monitoring

Email is the most common attack vector used in social engineering campaigns. Understanding the escalating precision of email attacks — and the specific IOCs each produces — is essential for the exam.

Forwarding as a spoofing technique

A sophisticated spoofing variant: the attacker compromises a lower-level employee, then sends a forwarded email chain that appears to originate from a senior executive buried in the thread. The visible message is from the compromised employee, but the forwarded content appears to show executive authority. If recipients read only the top message, they may not scrutinise the chain underneath it.

Understanding the email delivery chain is the foundation for reading headers. Every hop an email makes adds information to the internet header — creating a forensic trail you can follow backward to find the true origin of a spoofed message.

Every email contains three distinct sender address fields — only one is visible to the recipient in their mail client. Attackers exploit this asymmetry to make spoofed emails appear legitimate. Understanding all three fields is essential for header analysis on the exam.

How to read a suspicious email header

MIME (Multipurpose Internet Mail Extensions) is the standard that allows email bodies to carry HTML, rich text, binary data (Base64-encoded), and attachments. It is not inherently malicious — but attackers weaponize it to deliver payloads.

Email signature blocks as an IOC

If everyone in your organisation uses an identical, standardised email signature block, a message that purports to be from inside the organisation but lacks that standard signature block — or has a poorly formatted one — is a phishing indicator. Attackers crafting spoofed internal emails often don't know the exact signature format used.

Three complementary DNS-based authentication mechanisms work together to make email spoofing significantly harder. All three are published as DNS TXT records and checked automatically by receiving mail servers.

How DMARC enforces the authentication chain

Cousin domains — what SPF/DKIM/DMARC cannot stop

A cousin domain is a DNS domain that looks visually similar to a legitimate domain when rendered in a mail client. An attacker registers the cousin domain, correctly configures its own SPF/DKIM/DMARC records, and sends email from it — which passes all authentication checks because it is, technically, a legitimate domain. It is just a different one from the real organisation.

SMTP logs record every transaction between mail servers in a request/response format. Each log entry captures the timestamp, sender/recipient address, message size, and a numeric status code. Reading these logs lets you trace where a message came from, whether it was accepted, and why it might have been rejected.

SMTP status codes

Reading an SMTP log — annotated walkthrough

S/MIME (Secure/Multipurpose Internet Mail Extensions) adds end-to-end cryptographic security to email using public key infrastructure. Each user is issued a digital certificate containing their public key. S/MIME provides two distinct security properties — and it is important to understand which key does what.

The key rule — which key does what

S/MIME visual indicators in email clients