07 - References & Resources

Protocols & RFCs

• SPF (Sender Policy Framework): RFC 7208 - SPF for Authorizing Use of Domains in Return, Path.
• DKIM (DomainKeys Identified Mail): RFC 6376 - Signatures for Email Authentication.
• DMARC: RFC 7489 - Domain-based Message Authentication, Reporting, and Conformance.

Defense and Mitigation Guidance

• CISA Phishing Guidance: Phishing Guidance: Stopping the Attack Cycle at Phase One
• NIST SP 800-177 Rev. 1: Trustworthy Email
• FIDO Alliance: How FIDO Works (Phishing-Resistant MFA)
• WebAuthn API: W3C Web Authentication Specification

Tools Mentioned

• GoPhish: Open-Source Phishing Toolkit - https://getgophish.com/
• dnstwist: Domain name permutation engine - https://github.com/elceef/dnstwist
• oletools: Python tools to analyze MS OLE2 files (malware analysis) - https://github.com/decalage2/oletools
• YARA: The pattern matching swiss knife for malware researchers - https://virustotal.github.io/yara/