# Extract authentication results
grep -E "^(Authentication-Results|Received-SPF|ARC-Authentication-Results):" headers.txt

# Check SPF/DKIM/DMARC results
grep "spf=" headers.txt | head -1
grep "dkim=" headers.txt | head -1
grep "dmarc=" headers.txt | head -1

# Compare Return-Path vs From
RETURN_PATH=$(grep "^Return-Path:" headers.txt | grep -oE '[^< ]+@[^> ]+')
FROM=$(grep "^From:" headers.txt | grep -oE '[^< ]+@[^> ]+')
echo "Return-Path: $RETURN_PATH"
echo "From: $FROM"
[ "$RETURN_PATH" != "$FROM" ] && echo "WARNING: Envelope/header mismatch"

# Check Reply-To mismatch
REPLY_TO=$(grep "^Reply-To:" headers.txt | grep -oE '[^< ]+@[^> ]+')
[ -n "$REPLY_TO" ] && [ "$REPLY_TO" != "$FROM" ] && echo "WARNING: Reply-To differs"

import re

EXECUTIVES = ["John Smith", "Jane Doe", "CEO", "CFO"]

def check_display_name(from_header: str, org_domain: str) -> list[str]:
    findings = []
    match = re.match(r'"?([^"<]+)"?\s*<([^>]+)>', from_header)
    if not match:
        return ["Could not parse From header"]
    display_name, email = match.group(1).strip(), match.group(2)
    domain = email.split("@")[1] if "@" in email else ""
    for name in EXECUTIVES:
        if name.lower() in display_name.lower() and domain != org_domain:
            findings.append(f"HIGH: Display name '{display_name}' impersonates executive")
    if "@" in display_name:
        findings.append("MEDIUM: Email address in display name — double-from deception")
    return findings

# Generate lookalike domain permutations
python3 -c "
domain = 'example.com'
name = domain.split('.')[0]
perms = [
    name.replace('l','1')+'.com', name.replace('o','0')+'.com',
    name+'s.com', name[:-1]+'.com', name+'-mail.com',
]
for p in set(perms):
    if p != domain: print(p)
"

# Check if lookalike domains exist
for d in examp1e.com examp1e.com examples.com; do
  dig A "$d" +short && echo "$d REGISTERED"
done

title: External Email with Internal Executive Display Name
id: c3d4e5f6-a7b8-9012-cdef-345678901234
status: experimental
description: Detects external emails using display names of internal executives
logsource:
  category: email
  product: exchange
detection:
  selection:
    FromScope: "External"
    SenderDisplayName|contains:
      - "CEO Name"
      - "CFO Name"
  condition: selection
falsepositives:
  - Personal email accounts of actual executives
level: high
tags:
  - attack.t1534
  - attack.initial_access