Email Security

Name: Email Security
Author: xAmirHamza77

ASecurity

Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.

4 stars
0 votes
0 copies
4 views
Added September 6, 2026

securitysecurity

Works with

Security analysis

A100/100

Pro scans all 2 files and shows the line behind each finding

Scanned September 6, 2026

npx -y skills add xAmirHamza77/ReverseOps-Skill --skill email-security --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Email Security?

Add the live security badge to your README. It updates with every re-scan.

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/xamirhamza77-email-security/badge)](https://www.skillsdirectory.com/skills/xamirhamza77-email-security)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: email-security
description: Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.
---

# Email Security & Phishing Analysis

## ACTION REQUIRED (Execute immediately after reading)

1. `NOW`: Confirm authorization (analyzing sample emails / tenant configuration review)
2. `NOW`: Do not re-deliver malicious samples to real users
3. `ACT`: Header authentication → Content/URL → Attachment sandbox → Tenant control plane recommendations

## Use Cases

- Phishing email disassembly and IOC extraction
- SPF/DKIM/DMARC configuration assessment
- BEC (Business Email Compromise) fraud patterns
- OAuth app phishing / Mailbox token abuse (integrated with LLM/cloud identity)
- Security awareness exercise design (authorized)

## Workflow

```text
[ ] Complete raw header: Received chain, From/Return-Path consistency
[ ] SPF/DKIM/DMARC alignment results
[ ] URL sandbox and static attachment analysis (integrated with malware-analysis)
[ ] Brand impersonation and reply-to address discrepancies
[ ] Tenant: Anti-phishing policy, external tagging, MFA, OAuth app consent
```

## Toolchain

| Tool | Purpose |
|------|------|
| Email client "View Source" | Headers |
| dig/nslookup | SPF/DMARC records |
| urlscan / sandbox | Links and attachments |
| Tenant Admin Center | Policies |

## References

- `references/email-auth-checklist.md`
- `../malware-analysis/` `../attack-chain/` (phishing phase) `../windows-ad/` (token)

## Routing Context

**Upstream**: MASTER R36  
**MUST NOT**: Send test phishing emails in bulk to unauthorized third-party domains

## Task Completion Checklist

- [ ] Are header authentication conclusions complete?
- [ ] Are IOCs detect-ready (integrated with threat-hunting)?
- [ ] Checklist complete?