Red › Module 4 › Lesson 2
Phishing Defender View
Learn how blue detects phishing — SPF/DKIM/DMARC, gateway, user report — NOT how to phish strangers on $LAB_RT or elsewhere.
Visual · rt_phishing_defender_view
Phishing defender view. $LAB_RT only. Original Cyberlium.
Opening
This lesson is blue-side detection literacy — not a phishing tutorial for unauthorized targets.
Defenders detect phishing via email authentication failures (SPF, DKIM, DMARC), gateway rules, URL rewriting and sandbox detonation, attachment analysis, user reporting workflows, and SOC playbooks linking to T1566. Purple teams may simulate benign lab lures on $LAB_RT mail fixtures with written RoE — to validate those controls. Cyberlium explicitly does NOT teach stranger phishing, mass campaigns, or evasion against real mail providers. You learn detection value so emulation plans respect boundaries. Next: No Weapon Kits.
1. Email authentication and gateway signals
SPF publishes authorized senders; DKIM signs messages; DMARC policy tells receivers how to handle failures. Gateways score sender reputation, attachment type, and URL reputation — alerts map to T1566 detections.
On $LAB_RT, blue configures lab mail with intentional misconfigurations to test detection — not to blast strangers.
Command guide
Try these commands — Email authentication and gateway signals
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA Phishing Guidance — https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (defender view) Phishing technique — https://attack.mitre.org/techniques/T1566/ (literacy — no send kits)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks | head -10
curl -sS https://attack.mitre.org/techniques/T1566/ | grep -oE 'T1566(\.[0-9]{3})?' | sort -u | head -5
grep -i 'never.*phish' "$HOME/cyberlium-lab/t21-rt/roe.txt" 2>/dev/null || echo 'refuse: sendmail kits, stranger phishing'Primary tools to practice this lesson: curl, grep. Reference sites: CISA Phishing Guidance (https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks); Phishing technique (https://attack.mitre.org/techniques/T1566/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. User reporting and SOC correlation
Report-phish buttons feed SOAR playbooks: quarantine, hunt for similar messages, block indicators. Metrics: time-to-report, time-to-contain. Red team debrief cites whether lab lure triggered expected workflow on $LAB_RT.
Realistic purple value: measure detection pipeline — not maximize harm on unauthorized inboxes.
3. Explicit boundary: no stranger phishing homework
Forbidden: phishing kits, mass email, targeting classmates, café customers, or employer staff without signed simulation RoE. Allowed: document how blue would detect T1566 and plan lab-safe fixture test on $LAB_RT if RoE permits.
Ship: defender detection checklist for T1566 — five controls blue uses. Next: No Weapon Kits.
4. What you ship: phishing detection checklist (defender view)
Five blue controls for T1566. $LAB_RT lab fixture note if RoE allows. NEVER stranger phishing. chmod 600.
5. What you record before the next lesson
Date. Phishing defender checklist. $LAB_RT fixture note. File t21-m04-l02-phishing-defender-view.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Ask how to bypass DMARC on real providers for 'practice.' Phish classmate for realism.
Right
Write defender detection checklist for T1566. Next: No Weapon Kits.
Mission: document blue phishing detections
1) List five defender controls (SPF/DKIM/DMARC, gateway, sandbox, user report, SOC). 2) Write NEVER stranger phishing line. 3) Note $LAB_RT fixture only if RoE allows. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Purple teams measure detection pipelines — not inbox harm.
Knowledge Check
APPLY: Phishing Defender View on Cyberlium teaches:
Multiple choice
Knowledge Check
APPLY: True or False: DMARC/SPF/DKIM help defenders validate sender authenticity.
True or False
Knowledge Check
APPLY: Lab phishing simulation on $LAB_RT requires:
Multiple choice