Identity and Email Threat Analysis
Identity signals
Sign-in logs give result, source IP and ASN, device compliance, MFA outcome, conditional access result and token issuance. Core attack patterns: password spray (many accounts, few passwords, slow to dodge lockout), MFA push fatigue, adversary-in-the-middle phishing that steals session tokens so MFA is satisfied by replay, OAuth consent phishing that needs no password at all, and token theft from an endpoint. On-premises directory attacks - Kerberoasting, AS-REP roasting, DCSync, golden ticket - show up as anomalous service-ticket volume or replication requests.
Email authentication
SPF authorizes sending IPs for the envelope domain, DKIM signs message content, and DMARC ties the visible From domain to SPF or DKIM through alignment and sets policy. The critical point: SPF passing says the sending IP was authorized for some domain - often the attacker's own lookalike domain. Alignment is what matters.
Business email compromise
BEC frequently carries no malware and no link. Look for a first-contact external sender, display-name spoofing of an executive, homoglyph characters, a newly registered domain, a Reply-To differing from From, or a hijacked reply chain from a genuinely compromised mailbox.
Worked example
A user reports an invoice email from a lookalike domain. SPF, DKIM and DMARC all pass - because the attacker configured them on their own domain. Reasoning: authentication success is irrelevant without alignment to the real domain. The tells are domain age of three days, an internal executive display name, and a mismatched Reply-To. Response: search all mailboxes for the sender, purge, block the domain, and check whether any recipient entered credentials.
Traps that cost marks
- Reading DMARC pass as proof of legitimacy.
- Closing impossible-travel alerts as incidents when mobile carriers and VPNs cause them routinely.
- Resetting a password without revoking refresh tokens - stolen sessions survive a password change.