Key Email Headers for SOC Analysts and DFIR
Email headers provide critical information for analyzing and investigating email-based threats, making them essential for SOC analysts and Digital Forensics and Incident Response (DFIR) professionals. Below are the most important email headers they should understand, along with their significance.
1. Received
ReceivedPurpose: Shows the path an email took from the sender to the recipient, listing each mail server it passed through.
Use in Investigation
Identifies the origin of the email (IP address of the sending server).
Tracks hops to detect unusual routing or spoofing attempts.
Example:
2. From
FromPurpose: Indicates the sender's email address.
Use in Investigation:
Often spoofed in phishing attacks.
Compare with the
Return-PathandSenderheaders to detect discrepancies.
Example:
3. To
ToPurpose: Displays the intended recipient(s) of the email.
Use in Investigation:
Checks if the recipient was specifically targeted or part of a bulk attack.
Example:
4. Subject
SubjectPurpose: Contains the email's subject line.
Use in Investigation:
Detects common phishing or spam triggers (e.g., "URGENT ACTION REQUIRED").
Analyzes patterns in subject lines for targeted campaigns.
Example:
5. Return-Path
Return-PathPurpose: Indicates the email address where bounces are sent.
Use in Investigation:
Can differ from the
Fromheader in spoofing attacks.
Example:
6. Message-ID
Message-IDPurpose: A unique identifier for the email generated by the sending server.
Use in Investigation:
Helps trace specific emails in a campaign.
Identifies duplicate or altered emails.
Example:
7. Date
DatePurpose: Specifies when the email was sent.
Use in Investigation:
Identifies time discrepancies that may indicate spoofing.
Helps correlate events during an incident.
Example:
8. Reply-To
Reply-ToPurpose: Specifies an alternate email address for replies.
Use in Investigation:
Often abused in phishing attacks to redirect responses to a malicious address.
Example:
9. DKIM-Signature
DKIM-SignaturePurpose: Provides a cryptographic signature to verify the email's integrity and sender authenticity.
Use in Investigation:
Validates whether the email was altered after being sent.
Example:
10. SPF
SPFPurpose: Indicates whether the sending IP address is authorized to send emails on behalf of the domain.
Use in Investigation:
Detects domain spoofing.
Example:
11. Authentication-Results
Authentication-ResultsPurpose: Summarizes the results of email authentication checks like SPF, DKIM, and DMARC.
Use in Investigation:
Quickly identifies authentication failures.
Example:
12. Content-Type
Content-TypePurpose: Specifies the format of the email content (e.g., plain text, HTML, or multipart).
Use in Investigation:
Detects malicious payloads in attachments or embedded scripts.
Example:
Malicious Content Delivery:
Attackers may use specific
Content-Typevalues, such asapplication/javascriptorapplication/x-msdownload, to deliver malicious payloads.HTML Email Risks:
Emails with
Content-Type: text/htmlcan contain phishing links or exploit vulnerabilities in email clients.
MIME Boundary Exploits:
Misconfigured
Content-Typefields inmultipartemails can be leveraged for certain attacks (e.g., bypassing security filters).
13. X-Originating-IP
X-Originating-IPPurpose: Shows the IP address of the sender’s device.
Use in Investigation:
Identifies the sender's geographic location or ISP.
Example:
14. X-Mailer
X-MailerPurpose: Indicates the software or tool used to send the email.
Use in Investigation:
Can provide hints about custom or malicious tools used.
Example:
15. Received-SPF
Received-SPFPurpose: Indicates whether the sending domain passed or failed SPF checks.
Use in Investigation:
A failure might indicate spoofing.
Example:
16. X-Received
X-ReceivedPurpose: Added by mail servers, this header shows additional details about the email's journey.
Use in Investigation:
Often helps trace email paths when
Receivedheaders are incomplete or obfuscated.
Example:
17. X-Spam-Status
X-Spam-StatusPurpose: Indicates whether the email was flagged as spam by an anti-spam filter.
Use in Investigation:
Useful for understanding why an email was classified as spam.
Can detect evasions used by attackers to bypass spam filters.
Example:
18. Thread-Index
Thread-IndexPurpose: Indicates the threading or grouping of related emails.
Use in Investigation:
Useful for reconstructing email chains in phishing or spear-phishing attacks.
Example:
19. List-Unsubscribe
List-UnsubscribePurpose: Provides a mechanism for users to unsubscribe from mailing lists.
Use in Investigation:
Malicious actors might spoof this header in phishing campaigns.
Example:
Email Header Analyzers
Google’s Message Header Analyzer (https://toolbox.googleapps.com/apps/messageheader/):
Analyze email headers for DKIM, SPF, and DMARC results.
Quickly interpret mail relay paths and DKIM results.
Microsoft Message Analyzer:
Used to analyze email headers and DKIM signatures for emails sent to Microsoft-based systems like Office365.
Helps check DKIM, SPF, and DMARC configurations.
Useful for both analysis and ensuring proper outbound email configuration
Email Forensics Tools
MailXaminer:
Email forensic tool that can analyze headers, DKIM signatures, attachments, and embedded links.
Supports various email file formats like PST, MBOX, and EML.
Paraben E3 Email Investigator:
A comprehensive tool for email forensic investigations.
Allows in-depth analysis of email metadata, attachments, and authentication mechanisms.
Command-Line Tools
Parse and validate DKIM signatures.
Useful for automating DKIM checks as part of a forensic workflow.
Dig:
Verify DKIM public keys manually using DNS lookups.
Example Command:
Email Sandbox Platforms
Dynamic analysis of suspicious email attachments.
Observe behaviors like outbound connections that might indicate malicious activity.
Cuckoo Sandbox:
Analyze email attachments or payloads in a controlled environment.
Last updated