Domain Spoofing Security Copilot Agent

• Detect domain spoofing attempts where unauthorized senders impersonate your legitimate domains
• Identify lookalike domain attacks using similarity algorithms against your organization's trusted domains

Remediation:

• Automatically move to junk the emails identified as spoofing attempts with detailed reporting

The Domain Spoofing agent will:

Step 1: Domain Spoofing Detection

• Compare the sender's "Mail From" address against the sender's "From" address
• Detect spoofing when domains don't match or when the sender impersonates organization domains
• If spoofing is detected, the tool will immediately move the email to a junk folder and generate a detailed report

Step 2: Lookalike Domain Detection

• Analyze sender domain against your organization's legitimate domains using KQL Queries
• Calculate domain similarity scores using techniques like Levenshtein distance
• If lookalike is detected, it will automatically generate a detailed report.

Step 3: Triggers for Agent Activation

Scheduled Execution:

• The agent operates on a 60-minute recurring schedule, automatically:
• Collecting email events from the past 60 minutes via Microsoft Defender for Office 365 logs
• Processing all incoming emails through the validation workflow
• Generating real-time threat reports and taking appropriate remediation actionsManual Activation:
• Security analysts can manually trigger the agent for specific time ranges