Email Spoofing - P1/P2 Header Mismatch and Executive Impersonation

Ankit Mehta@Secvyn

•updated Jun 26, 2026•2•0•4

This rule detects potential email spoofing attempts by identifying mismatches between P1 (envelope) and P2 (header) sender addresses, identifying discrepancies between sender and reply-to domains, and flagging emails where the display name impersonates common executive or IT support roles.