菜单
Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint,. Use when working with detecting spearphishing with email gateway.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/oyi77/1ai-skills --skill detecting-spearphishing-with-email-gateway命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | detecting-spearphishing-with-email-gateway |
| description | Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint,. Use when working with detecting spearphishing with email gateway. |
| domain | cybersecurity |
| subdomain | phishing-defense |
| tags | ["phishing","email-security","social-engineering","dmarc","awareness","spearphishing","email-gateway"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_csf | ["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"] |
Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint, Mimecast, and Barracuda provide advanced detection capabilities including behavioral analysis, URL detonation, attachment sandboxing, and impersonation detection. This skill covers configuring these gateways to detect and block targeted phishing attacks.
Trigger phrases:
"detecting spearphishing with email gateway"
"Spearphishing targets specific individuals using personalized, researched conten"
When investigating security incidents that require detecting spearphishing with email gateway
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
This section covers key concepts for detecting spearphishing with email gateway.
Microsoft Defender for Office 365:
Security > Anti-phishing policies > Impersonation settings
- Enable user impersonation protection for VIPs
- Enable domain impersonation protection
- Add protected users (CEO, CFO, HR Director)
- Set action: Quarantine message
Proofpoint:
Email Protection > Impostor Classifier
- Enable display name spoofing detection
- Configure lookalike domain detection
- Set Impostor threshold sensitivity
Use the scripts/process.py to analyze email gateway logs, identify spearphishing patterns, and generate custom detection rules.
| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. |
| "Security slows us down" | A breach slows you down 100x more. Build security in from the start. |
| "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |