{ "type": "bundle", "id": "bundle--fd7ff1dc-0dc0-5237-8b48-0ff0b827af64", "objects": [ { "type": "identity", "id": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "name": "Jonathan Brett Crawley", "identity_class": "individual", "contact_information": "https://ostering.com/", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27" ] }, { "type": "marking-definition", "id": "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "name": "Licence: Email Infrastructure Threat Taxonomy, CC BY-NC-ND 4.0 with additional permissions", "definition_type": "statement", "definition": { "statement": "© 2026 Jonathan Brett Crawley. CC BY-NC-ND 4.0, with additional permissions. Licensed under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0): you may share the whole taxonomy, unchanged and with credit, for non-commercial purposes. In addition, whether or not the use is commercial, you may use it to threat model systems, including for paying clients; use it internally and for training inside any organisation; and quote individual entries, with credit, in paid courses, reports and talks. Shipping it in a product, such as a tool's built-in library, a printed deck or a reprint for sale, needs written permission. Licence text: https://creativecommons.org/licenses/by-nc-nd/4.0/. © 2026 Jonathan Brett Crawley. This taxonomy is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International licence (CC BY-NC-ND 4.0), with the additional permissions below. Permission needed, by use: Sharing the whole taxonomy non-commercially (OWASP, universities, conferences, individuals): No; Threat modeling with it, including for paying clients: No; Internal use and training inside any organisation: No; Quoting entries, with credit, in paid courses, reports and talks: No; Shipping the taxonomy in a product: a tool's built-in library, a printed deck, a reprint for sale: Yes, ask me. Additional permissions: In addition to the rights the licence gives, and whether or not the use is commercial, the copyright holder grants you permission to: (1) use the taxonomy to threat model systems you build, operate or assess, including for paying clients; (2) use it internally, and for training, inside any organisation; (3) quote individual entries, with credit, in paid courses, reports, findings and talks. Any other commercial use, including shipping the taxonomy or a substantial part of it in a product (a tool's built-in library, a printed deck, a reprint for sale), needs written permission. Ask me on LinkedIn. These additional permissions are given alongside the licence. They add to what the licence allows and do not take anything away from it." } }, { "type": "extension-definition", "id": "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "name": "ostering.com threat taxonomy properties", "description": "Taxonomy reference, group, STRIDE, CAPEC and CWE fit, and the mitigation principle and measures.", "schema": "https://ostering.com/taxonomies/ostering-taxonomy-stix-extension.schema.json", "version": "1.1.0", "extension_types": [ "property-extension" ], "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ] }, { "type": "attack-pattern", "id": "attack-pattern--42d6e19f-24cd-5953-91d5-07321ca7ac97", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Ingress Bypass", "description": "The platform exposes an endpoint that accepts mail for a recipient without it having passed the upstream controls the design assumes.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·A", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-a" }, { "source_name": "capec", "external_id": "CAPEC-554", "url": "https://capec.mitre.org/data/definitions/554.html", "description": "Functionality Bypass" }, { "source_name": "capec", "external_id": "CAPEC-36", "url": "https://capec.mitre.org/data/definitions/36.html", "description": "Using Unpublished Interfaces or Functionality" }, { "source_name": "cwe", "external_id": "CWE-420", "url": "https://cwe.mitre.org/data/definitions/420.html", "description": "Unprotected Alternate Channel" }, { "source_name": "cwe", "external_id": "CWE-424", "url": "https://cwe.mitre.org/data/definitions/424.html", "description": "Improper Protection of Alternate Path" }, { "source_name": "cwe", "external_id": "CWE-291", "url": "https://cwe.mitre.org/data/definitions/291.html", "description": "Reliance on IP Address for Authentication" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "delivery-pipeline" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·A", "group_code": "DP", "group_name": "Delivery pipeline", "stride": [ "E" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-554", "CAPEC-36" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-420", "CWE-424", "CWE-291" ] } } }, { "type": "course-of-action", "id": "course-of-action--42d6e19f-24cd-5953-91d5-07321ca7ac97", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DP·A Ingress Bypass", "description": "Every ingress path enforces the same controls, bound to a verified identity rather than a network location.\n\n(1) Authenticate hybrid and partner ingress with mutual TLS or a per-connector client certificate, and reject sessions that present neither.\n(2) Route all ingress endpoints through one policy enforcement point, so an endpoint added later cannot skip a control by construction.\n(3) Inventory ingress endpoints from the network and load-balancer configuration, not from documentation, and alert when a listener appears that is not registered with the enforcement point.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·A", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·A", "mitigation_principle": "Every ingress path enforces the same controls, bound to a verified identity rather than a network location.", "design_measures": [ "Authenticate hybrid and partner ingress with mutual TLS or a per-connector client certificate, and reject sessions that present neither.", "Route all ingress endpoints through one policy enforcement point, so an endpoint added later cannot skip a control by construction.", "Inventory ingress endpoints from the network and load-balancer configuration, not from documentation, and alert when a listener appears that is not registered with the enforcement point." ] } } }, { "type": "relationship", "id": "relationship--ff5cf01b-72e2-5e4b-b525-265a7492e654", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--42d6e19f-24cd-5953-91d5-07321ca7ac97", "target_ref": "attack-pattern--42d6e19f-24cd-5953-91d5-07321ca7ac97" }, { "type": "attack-pattern", "id": "attack-pattern--d15405d4-0531-5503-8193-e7556a23a902", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Inherited Verdict", "description": "A hop trusts a verdict, authentication result or classification written upstream that it cannot verify, including headers an external sender can forge.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·K", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-k" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "capec", "external_id": "CAPEC-21", "url": "https://capec.mitre.org/data/definitions/21.html", "description": "Exploitation of Trusted Identifiers" }, { "source_name": "cwe", "external_id": "CWE-807", "url": "https://cwe.mitre.org/data/definitions/807.html", "description": "Reliance on Untrusted Inputs in a Security Decision" }, { "source_name": "cwe", "external_id": "CWE-349", "url": "https://cwe.mitre.org/data/definitions/349.html", "description": "Acceptance of Extraneous Untrusted Data With Trusted Data" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "delivery-pipeline" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·K", "group_code": "DP", "group_name": "Delivery pipeline", "stride": [ "S", "T" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-194", "CAPEC-21" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-807", "CWE-349" ] } } }, { "type": "course-of-action", "id": "course-of-action--d15405d4-0531-5503-8193-e7556a23a902", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DP·K Inherited Verdict", "description": "A hop acts only on verdicts and authentication results it produced or can cryptographically verify.\n\n(1) Strip Authentication-Results, verdict and other platform headers at every ingress boundary before any inbound mail is processed.\n(2) Carry verdicts in out-of-band metadata keyed to the message (a queue envelope or database row), never in headers that travel with the message.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·K", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·K", "mitigation_principle": "A hop acts only on verdicts and authentication results it produced or can cryptographically verify.", "design_measures": [ "Strip Authentication-Results, verdict and other platform headers at every ingress boundary before any inbound mail is processed.", "Carry verdicts in out-of-band metadata keyed to the message (a queue envelope or database row), never in headers that travel with the message." ] } } }, { "type": "relationship", "id": "relationship--a77cb83a-81b2-51b7-9847-582d9b6b81e2", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d15405d4-0531-5503-8193-e7556a23a902", "target_ref": "attack-pattern--d15405d4-0531-5503-8193-e7556a23a902" }, { "type": "attack-pattern", "id": "attack-pattern--27a081f0-b31f-567d-b68f-ad71a4720fa0", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mutating Hop", "description": "A hop rewrites the message (URLs, banners, footers, re-encoding), so downstream hops verify or scan something different from what was sent or what will be displayed.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-q" }, { "source_name": "cwe", "external_id": "CWE-179", "url": "https://cwe.mitre.org/data/definitions/179.html", "description": "Incorrect Behavior Order: Early Validation" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "delivery-pipeline" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·Q", "group_code": "DP", "group_name": "Delivery pipeline", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-179" ] } } }, { "type": "course-of-action", "id": "course-of-action--27a081f0-b31f-567d-b68f-ad71a4720fa0", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DP·Q Mutating Hop", "description": "A control inspects or verifies the exact bytes the recipient will receive, and any mutation is recorded with what it invalidated.\n\n(1) Verify DKIM and S/MIME signatures before any rewriting, and record the result in metadata the later hops and the client read.\n(2) Run content inspection on the post-mutation message, or make the mutating hop the last one before delivery.\n(3) Keep an immutable copy of the message as received, so that any later verification or investigation can be run against the original bytes.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·Q", "mitigation_principle": "A control inspects or verifies the exact bytes the recipient will receive, and any mutation is recorded with what it invalidated.", "design_measures": [ "Verify DKIM and S/MIME signatures before any rewriting, and record the result in metadata the later hops and the client read.", "Run content inspection on the post-mutation message, or make the mutating hop the last one before delivery.", "Keep an immutable copy of the message as received, so that any later verification or investigation can be run against the original bytes." ] } } }, { "type": "relationship", "id": "relationship--470e9cad-4123-5392-8c03-89a60de9181c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--27a081f0-b31f-567d-b68f-ad71a4720fa0", "target_ref": "attack-pattern--27a081f0-b31f-567d-b68f-ad71a4720fa0" }, { "type": "attack-pattern", "id": "attack-pattern--1010ef11-73f6-525e-aff5-36e937057121", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Fail-Open Scanning", "description": "A scanner reaches a size, depth, time or decryption limit and the pipeline delivers the message anyway.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·J", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-j" }, { "source_name": "capec", "external_id": "CAPEC-24", "url": "https://capec.mitre.org/data/definitions/24.html", "description": "Filter Failure through Buffer Overflow" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely ('Failing Open')" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "delivery-pipeline" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·J", "group_code": "DP", "group_name": "Delivery pipeline", "stride": [ "E" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-24" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-636" ] } } }, { "type": "course-of-action", "id": "course-of-action--1010ef11-73f6-525e-aff5-36e937057121", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DP·J Fail-Open Scanning", "description": "\"Could not scan\" is a distinct outcome with its own policy, never silently collapsed into \"clean\".\n\n(1) Return a distinct UNSCANNED verdict for every limit (size, depth, time, decryption) and map it to hold or a visible flag by default.\n(2) Make the fail-open or fail-closed choice a per-tenant policy setting with its default set to fail closed, and log every fail-open event.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·J", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·J", "mitigation_principle": "\"Could not scan\" is a distinct outcome with its own policy, never silently collapsed into \"clean\".", "design_measures": [ "Return a distinct UNSCANNED verdict for every limit (size, depth, time, decryption) and map it to hold or a visible flag by default.", "Make the fail-open or fail-closed choice a per-tenant policy setting with its default set to fail closed, and log every fail-open event." ] } } }, { "type": "relationship", "id": "relationship--ad6d67ca-a6c6-5992-9f95-92a535ecc8c4", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1010ef11-73f6-525e-aff5-36e937057121", "target_ref": "attack-pattern--1010ef11-73f6-525e-aff5-36e937057121" }, { "type": "attack-pattern", "id": "attack-pattern--216ebd0c-037f-5d12-867e-7db2ad38753c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Verdict Decay", "description": "A verdict is computed once on content whose meaning can change later, such as remote URLs and remotely loaded content.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·10", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-10" }, { "source_name": "capec", "external_id": "CAPEC-29", "url": "https://capec.mitre.org/data/definitions/29.html", "description": "Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions" }, { "source_name": "cwe", "external_id": "CWE-367", "url": "https://cwe.mitre.org/data/definitions/367.html", "description": "Time-of-check Time-of-use (TOCTOU) Race Condition" }, { "source_name": "cwe", "external_id": "CWE-638", "url": "https://cwe.mitre.org/data/definitions/638.html", "description": "Not Using Complete Mediation" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "delivery-pipeline" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·10", "group_code": "DP", "group_name": "Delivery pipeline", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-29" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-367", "CWE-638" ] } } }, { "type": "course-of-action", "id": "course-of-action--216ebd0c-037f-5d12-867e-7db2ad38753c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DP·10 Verdict Decay", "description": "Content whose meaning depends on resources outside the message is judged at the moment of use, not only at delivery.\n\n(1) Evaluate rewritten URLs at click time against current intelligence, and block or warn when the destination has changed since delivery.\n(2) Set a verdict lifetime for remote-dependent content and re-scan delivered messages when the lifetime expires or new intelligence arrives.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·10", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·10", "mitigation_principle": "Content whose meaning depends on resources outside the message is judged at the moment of use, not only at delivery.", "design_measures": [ "Evaluate rewritten URLs at click time against current intelligence, and block or warn when the destination has changed since delivery.", "Set a verdict lifetime for remote-dependent content and re-scan delivered messages when the lifetime expires or new intelligence arrives." ] } } }, { "type": "relationship", "id": "relationship--505e926b-1c2d-51b5-a1f7-bbccc3f81989", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--216ebd0c-037f-5d12-867e-7db2ad38753c", "target_ref": "attack-pattern--216ebd0c-037f-5d12-867e-7db2ad38753c" }, { "type": "attack-pattern", "id": "attack-pattern--adb69465-b716-5d0c-a2bf-5ac464b458ca", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unscanned Path", "description": "A write path to the mailbox exists that does not traverse the controls: internal and cross-tenant mail, API or IMAP APPEND injection, calendar items, connectors, migration and import.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·9", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-9" }, { "source_name": "capec", "external_id": "CAPEC-554", "url": "https://capec.mitre.org/data/definitions/554.html", "description": "Functionality Bypass" }, { "source_name": "capec", "external_id": "CAPEC-36", "url": "https://capec.mitre.org/data/definitions/36.html", "description": "Using Unpublished Interfaces or Functionality" }, { "source_name": "cwe", "external_id": "CWE-420", "url": "https://cwe.mitre.org/data/definitions/420.html", "description": "Unprotected Alternate Channel" }, { "source_name": "cwe", "external_id": "CWE-424", "url": "https://cwe.mitre.org/data/definitions/424.html", "description": "Improper Protection of Alternate Path" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "delivery-pipeline" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·9", "group_code": "DP", "group_name": "Delivery pipeline", "stride": [ "E" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-554", "CAPEC-36" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-420", "CWE-424" ] } } }, { "type": "course-of-action", "id": "course-of-action--adb69465-b716-5d0c-a2bf-5ac464b458ca", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DP·9 Unscanned Path", "description": "There is exactly one write path to the mailbox store, and every message takes it.\n\n(1) Route intra-tenant, cross-tenant, API-submitted and IMAP APPEND messages through the same scanning pipeline as internet mail.\n(2) Remove direct write access to the store from every service except the delivery agent, and enforce that with the store's own authorisation.\n(3) Test the single-path property continuously by injecting marked messages through every write interface (API, IMAP APPEND, calendar, import, migration) and asserting that each one appears in the scanner's log.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·9", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·9", "mitigation_principle": "There is exactly one write path to the mailbox store, and every message takes it.", "design_measures": [ "Route intra-tenant, cross-tenant, API-submitted and IMAP APPEND messages through the same scanning pipeline as internet mail.", "Remove direct write access to the store from every service except the delivery agent, and enforce that with the store's own authorisation.", "Test the single-path property continuously by injecting marked messages through every write interface (API, IMAP APPEND, calendar, import, migration) and asserting that each one appears in the scanner's log." ] } } }, { "type": "relationship", "id": "relationship--8ab22831-0eff-5eda-9f71-6af7f8bcc440", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--adb69465-b716-5d0c-a2bf-5ac464b458ca", "target_ref": "attack-pattern--adb69465-b716-5d0c-a2bf-5ac464b458ca" }, { "type": "attack-pattern", "id": "attack-pattern--48b9a2bb-44fa-520f-8ad9-2effcb399897", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Remediation Race", "description": "Post-delivery retraction assumes the platform still controls every copy, but synced devices, forwards, rules and API consumers have already taken one.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·8", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-8" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "delivery-pipeline" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·8", "group_code": "DP", "group_name": "Delivery pipeline", "stride": [ "I" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "None" } } }, { "type": "course-of-action", "id": "course-of-action--48b9a2bb-44fa-520f-8ad9-2effcb399897", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DP·8 Remediation Race", "description": "Remediation reaches every copy the platform created and reports the copies it could not reach.\n\n(1) Track each copy made by sync, forward, rule or API with the message identifier, so remediation can target each one.\n(2) Return a remediation report listing unreachable copies (offline devices, external forwards) so the tenant can act on them.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·8", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·8", "mitigation_principle": "Remediation reaches every copy the platform created and reports the copies it could not reach.", "design_measures": [ "Track each copy made by sync, forward, rule or API with the message identifier, so remediation can target each one.", "Return a remediation report listing unreachable copies (offline devices, external forwards) so the tenant can act on them." ] } } }, { "type": "relationship", "id": "relationship--7dbaf108-ee31-5488-b1d3-0f3e90f69b9e", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--48b9a2bb-44fa-520f-8ad9-2effcb399897", "target_ref": "attack-pattern--48b9a2bb-44fa-520f-8ad9-2effcb399897" }, { "type": "attack-pattern", "id": "attack-pattern--2f4dec21-1c7e-543b-9b06-effb1f9ae294", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Tenant Confusion", "description": "A shared hop attributes a message to a tenant from an attribute the sender controls, or applies one tenant's configuration, trusted status or allow list to another tenant's mail.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·7", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-7" }, { "source_name": "capec", "external_id": "CAPEC-21", "url": "https://capec.mitre.org/data/definitions/21.html", "description": "Exploitation of Trusted Identifiers" }, { "source_name": "cwe", "external_id": "CWE-807", "url": "https://cwe.mitre.org/data/definitions/807.html", "description": "Reliance on Untrusted Inputs in a Security Decision" }, { "source_name": "cwe", "external_id": "CWE-291", "url": "https://cwe.mitre.org/data/definitions/291.html", "description": "Reliance on IP Address for Authentication" }, { "source_name": "cwe", "external_id": "CWE-639", "url": "https://cwe.mitre.org/data/definitions/639.html", "description": "Authorization Bypass Through User-Controlled Key" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "delivery-pipeline" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·7", "group_code": "DP", "group_name": "Delivery pipeline", "stride": [ "S", "E" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-21" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-807", "CWE-291", "CWE-639" ] } } }, { "type": "course-of-action", "id": "course-of-action--2f4dec21-1c7e-543b-9b06-effb1f9ae294", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DP·7 Tenant Confusion", "description": "Tenant identity is resolved from a verified property, bound to the message at ingress, and every later decision is scoped by it.\n\n(1) Attribute a message to a tenant only from a verified property (a per-tenant client certificate for connectors, the verified recipient domain for inbound mail), never from the envelope sender or an IP address that a third party shares.\n(2) Store allow lists, connectors and trusted-sender rules keyed by tenant identifier, reject lookups that supply none, and never let attribution alone confer internal or trusted status.\n(3) Carry the tenant identifier in internal metadata outside the message, and have every service reject a message whose metadata is missing or whose tenant does not match the recipient domain.\n(4) Test tenancy with two tenants on the same shared IP range and the same sender domain, and assert that neither's configuration affects the other's mail.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·7", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·7", "mitigation_principle": "Tenant identity is resolved from a verified property, bound to the message at ingress, and every later decision is scoped by it.", "design_measures": [ "Attribute a message to a tenant only from a verified property (a per-tenant client certificate for connectors, the verified recipient domain for inbound mail), never from the envelope sender or an IP address that a third party shares.", "Store allow lists, connectors and trusted-sender rules keyed by tenant identifier, reject lookups that supply none, and never let attribution alone confer internal or trusted status.", "Carry the tenant identifier in internal metadata outside the message, and have every service reject a message whose metadata is missing or whose tenant does not match the recipient domain.", "Test tenancy with two tenants on the same shared IP range and the same sender domain, and assert that neither's configuration affects the other's mail." ] } } }, { "type": "relationship", "id": "relationship--ea15de72-b61c-5d75-9d56-1e9ca6daf8c9", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2f4dec21-1c7e-543b-9b06-effb1f9ae294", "target_ref": "attack-pattern--2f4dec21-1c7e-543b-9b06-effb1f9ae294" }, { "type": "attack-pattern", "id": "attack-pattern--05238c88-4fce-56c0-ba87-c1f1efd1fe8a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Induced Backpressure", "description": "A sender drives load so that queues, deferrals or timeouts cause controls to be skipped or shortened.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·6", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-6" }, { "source_name": "capec", "external_id": "CAPEC-125", "url": "https://capec.mitre.org/data/definitions/125.html", "description": "Flooding" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely ('Failing Open')" }, { "source_name": "cwe", "external_id": "CWE-770", "url": "https://cwe.mitre.org/data/definitions/770.html", "description": "Allocation of Resources Without Limits or Throttling" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "delivery-pipeline" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·6", "group_code": "DP", "group_name": "Delivery pipeline", "stride": [ "D" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-125" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-636", "CWE-770" ] } } }, { "type": "course-of-action", "id": "course-of-action--05238c88-4fce-56c0-ba87-c1f1efd1fe8a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DP·6 Induced Backpressure", "description": "Controls degrade to hold or defer under load, never to skip.\n\n(1) Reserve per-tenant queue and scanner capacity so one sender cannot consume what others need.\n(2) Defer with a 4xx response when scanner capacity is exhausted, rather than accepting and delivering unscanned.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·6", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·6", "mitigation_principle": "Controls degrade to hold or defer under load, never to skip.", "design_measures": [ "Reserve per-tenant queue and scanner capacity so one sender cannot consume what others need.", "Defer with a 4xx response when scanner capacity is exhausted, rather than accepting and delivering unscanned." ] } } }, { "type": "relationship", "id": "relationship--9e2079ce-45a8-59c0-b224-db5f0498d73d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--05238c88-4fce-56c0-ba87-c1f1efd1fe8a", "target_ref": "attack-pattern--05238c88-4fce-56c0-ba87-c1f1efd1fe8a" }, { "type": "attack-pattern", "id": "attack-pattern--8bb46b54-5b96-59dd-97d6-d2c01010964b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Loop and Amplification", "description": "Forwarding, auto-replies and bounces between hops create loops or multiply mail.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·5", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-5" }, { "source_name": "capec", "external_id": "CAPEC-490", "url": "https://capec.mitre.org/data/definitions/490.html", "description": "Amplification" }, { "source_name": "cwe", "external_id": "CWE-406", "url": "https://cwe.mitre.org/data/definitions/406.html", "description": "Insufficient Control of Network Message Volume (Network Amplification)" }, { "source_name": "cwe", "external_id": "CWE-799", "url": "https://cwe.mitre.org/data/definitions/799.html", "description": "Improper Control of Interaction Frequency" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "delivery-pipeline" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·5", "group_code": "DP", "group_name": "Delivery pipeline", "stride": [ "D" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-490" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-406", "CWE-799" ] } } }, { "type": "course-of-action", "id": "course-of-action--8bb46b54-5b96-59dd-97d6-d2c01010964b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DP·5 Loop and Amplification", "description": "Automatic mail is rate-limited and loop-detected on every path that can generate it.\n\n(1) Count the platform's own trace headers and refuse to forward or reply once a hop limit is reached.\n(2) Rate-limit auto-replies and automatic forwards per recipient and per trigger, and suppress them for mail that failed authentication.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·5", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·5", "mitigation_principle": "Automatic mail is rate-limited and loop-detected on every path that can generate it.", "design_measures": [ "Count the platform's own trace headers and refuse to forward or reply once a hop limit is reached.", "Rate-limit auto-replies and automatic forwards per recipient and per trigger, and suppress them for mail that failed authentication." ] } } }, { "type": "relationship", "id": "relationship--1c2ff425-b62d-58ee-b282-3a915a9c2680", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8bb46b54-5b96-59dd-97d6-d2c01010964b", "target_ref": "attack-pattern--8bb46b54-5b96-59dd-97d6-d2c01010964b" }, { "type": "attack-pattern", "id": "attack-pattern--abca8887-3af2-5013-8184-62734f8b852f", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Verdict Inconsistency", "description": "One message to several recipients is split, scanned or cached differently per recipient, and a cached verdict is reused where it does not apply.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·4", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-4" }, { "source_name": "capec", "external_id": "CAPEC-141", "url": "https://capec.mitre.org/data/definitions/141.html", "description": "Cache Poisoning" }, { "source_name": "cwe", "external_id": "CWE-1023", "url": "https://cwe.mitre.org/data/definitions/1023.html", "description": "Incomplete Comparison with Missing Factors" }, { "source_name": "cwe", "external_id": "CWE-1250", "url": "https://cwe.mitre.org/data/definitions/1250.html", "description": "Improper Preservation of Consistency Between Independent Representations of Shared State" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "delivery-pipeline" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·4", "group_code": "DP", "group_name": "Delivery pipeline", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-141" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-1023", "CWE-1250" ] } } }, { "type": "course-of-action", "id": "course-of-action--abca8887-3af2-5013-8184-62734f8b852f", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DP·4 Verdict Inconsistency", "description": "One message produces one verdict per recipient policy, and cached verdicts are keyed on everything they depend on.\n\n(1) Key the verdict cache on the full content hash plus the sender identity, authentication result and tenant policy version.\n(2) Scan a split message once and attach the single verdict to every recipient copy, then apply per-recipient policy to that verdict.\n(3) Invalidate cached verdicts when the policy, the intelligence feed or the scanner version changes, not only when the content hash does.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·4", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·4", "mitigation_principle": "One message produces one verdict per recipient policy, and cached verdicts are keyed on everything they depend on.", "design_measures": [ "Key the verdict cache on the full content hash plus the sender identity, authentication result and tenant policy version.", "Scan a split message once and attach the single verdict to every recipient copy, then apply per-recipient policy to that verdict.", "Invalidate cached verdicts when the policy, the intelligence feed or the scanner version changes, not only when the content hash does." ] } } }, { "type": "relationship", "id": "relationship--9e9b8bcb-9722-5251-8f66-b1a284c0a71d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--abca8887-3af2-5013-8184-62734f8b852f", "target_ref": "attack-pattern--abca8887-3af2-5013-8184-62734f8b852f" }, { "type": "attack-pattern", "id": "attack-pattern--34742c7d-d956-5fe3-b7ce-8ff67eda105a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Quarantine Release Abuse", "description": "Quarantine, release and allow-list paths return a message to the mailbox without re-evaluating it.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·3", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-3" }, { "source_name": "capec", "external_id": "CAPEC-62", "url": "https://capec.mitre.org/data/definitions/62.html", "description": "Cross Site Request Forgery" }, { "source_name": "cwe", "external_id": "CWE-424", "url": "https://cwe.mitre.org/data/definitions/424.html", "description": "Improper Protection of Alternate Path" }, { "source_name": "cwe", "external_id": "CWE-841", "url": "https://cwe.mitre.org/data/definitions/841.html", "description": "Improper Enforcement of Behavioral Workflow" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "delivery-pipeline" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·3", "group_code": "DP", "group_name": "Delivery pipeline", "stride": [ "E" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-62" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-424", "CWE-841" ] } } }, { "type": "course-of-action", "id": "course-of-action--34742c7d-d956-5fe3-b7ce-8ff67eda105a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DP·3 Quarantine Release Abuse", "description": "A message leaving quarantine is re-evaluated with current intelligence, and release requires authenticated intent.\n\n(1) Re-scan on release and refuse to deliver if the current verdict is worse than at quarantine time.\n(2) Require an authenticated session for release, with single-use tokens for digest links and no release via GET.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·3", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·3", "mitigation_principle": "A message leaving quarantine is re-evaluated with current intelligence, and release requires authenticated intent.", "design_measures": [ "Re-scan on release and refuse to deliver if the current verdict is worse than at quarantine time.", "Require an authenticated session for release, with single-use tokens for digest links and no release via GET." ] } } }, { "type": "relationship", "id": "relationship--99124f05-7bd3-5e52-8a73-03e53451a48c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--34742c7d-d956-5fe3-b7ce-8ff67eda105a", "target_ref": "attack-pattern--34742c7d-d956-5fe3-b7ce-8ff67eda105a" }, { "type": "attack-pattern", "id": "attack-pattern--6cf11b0c-24d9-515f-b188-e4836f9c86ad", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Pipeline Reconfiguration", "description": "Whoever can change routing rules, connectors or transport rules can steer mail around the controls, and the change looks like ordinary administration.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·2", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-2" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "delivery-pipeline" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·2", "group_code": "DP", "group_name": "Delivery pipeline", "stride": [ "T", "E" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-176" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-1220", "CWE-778" ] } } }, { "type": "course-of-action", "id": "course-of-action--6cf11b0c-24d9-515f-b188-e4836f9c86ad", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DP·2 Pipeline Reconfiguration", "description": "Changes to the path a message takes are privileged, approved and traceable to the message.\n\n(1) Require a second approver for any routing, connector or transport rule change that removes a control from the path.\n(2) Record the ordered list of controls each delivered message traversed, and alert when a message's path differs from the tenant's baseline.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP·2", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DP·2", "mitigation_principle": "Changes to the path a message takes are privileged, approved and traceable to the message.", "design_measures": [ "Require a second approver for any routing, connector or transport rule change that removes a control from the path.", "Record the ordered list of controls each delivered message traversed, and alert when a message's path differs from the tenant's baseline." ] } } }, { "type": "relationship", "id": "relationship--d68d4d8d-cd7a-5edf-b827-d6f7175431b1", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6cf11b0c-24d9-515f-b188-e4836f9c86ad", "target_ref": "attack-pattern--6cf11b0c-24d9-515f-b188-e4836f9c86ad" }, { "type": "grouping", "id": "grouping--50e25c22-8e77-5341-b365-5fe1f4b1d763", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Layer 01: Delivery pipeline (DP)", "description": "Every message should pass every control, in the intended order, and each control should see what the recipient will see. These entries cover sequencing, fracture and remediation across the hops between the sending MTA and the mailbox. Scope: The composition of hops between sending MTA and mailbox: sequencing, fracture, remediation.", "context": "unspecified", "object_refs": [ "attack-pattern--42d6e19f-24cd-5953-91d5-07321ca7ac97", "course-of-action--42d6e19f-24cd-5953-91d5-07321ca7ac97", "attack-pattern--d15405d4-0531-5503-8193-e7556a23a902", "course-of-action--d15405d4-0531-5503-8193-e7556a23a902", "attack-pattern--27a081f0-b31f-567d-b68f-ad71a4720fa0", "course-of-action--27a081f0-b31f-567d-b68f-ad71a4720fa0", "attack-pattern--1010ef11-73f6-525e-aff5-36e937057121", "course-of-action--1010ef11-73f6-525e-aff5-36e937057121", "attack-pattern--216ebd0c-037f-5d12-867e-7db2ad38753c", "course-of-action--216ebd0c-037f-5d12-867e-7db2ad38753c", "attack-pattern--adb69465-b716-5d0c-a2bf-5ac464b458ca", "course-of-action--adb69465-b716-5d0c-a2bf-5ac464b458ca", "attack-pattern--48b9a2bb-44fa-520f-8ad9-2effcb399897", "course-of-action--48b9a2bb-44fa-520f-8ad9-2effcb399897", "attack-pattern--2f4dec21-1c7e-543b-9b06-effb1f9ae294", "course-of-action--2f4dec21-1c7e-543b-9b06-effb1f9ae294", "attack-pattern--05238c88-4fce-56c0-ba87-c1f1efd1fe8a", "course-of-action--05238c88-4fce-56c0-ba87-c1f1efd1fe8a", "attack-pattern--8bb46b54-5b96-59dd-97d6-d2c01010964b", "course-of-action--8bb46b54-5b96-59dd-97d6-d2c01010964b", "attack-pattern--abca8887-3af2-5013-8184-62734f8b852f", "course-of-action--abca8887-3af2-5013-8184-62734f8b852f", "attack-pattern--34742c7d-d956-5fe3-b7ce-8ff67eda105a", "course-of-action--34742c7d-d956-5fe3-b7ce-8ff67eda105a", "attack-pattern--6cf11b0c-24d9-515f-b188-e4836f9c86ad", "course-of-action--6cf11b0c-24d9-515f-b188-e4836f9c86ad" ], "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DP", "url": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--65455210-a9e3-5117-a03e-1f6f3bbdafa9", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Pass as Endorsement", "description": "The platform treats an authentication pass as a trust signal (filter bypass, reputation boost, a badge), though any attacker-owned domain can pass.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·A", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-a" }, { "source_name": "cwe", "external_id": "CWE-654", "url": "https://cwe.mitre.org/data/definitions/654.html", "description": "Reliance on a Single Factor in a Security Decision" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "authentication-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·A", "group_code": "AU", "group_name": "Authentication protocols", "stride": [ "S" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-654" ] } } }, { "type": "course-of-action", "id": "course-of-action--65455210-a9e3-5117-a03e-1f6f3bbdafa9", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for AU·A Pass as Endorsement", "description": "An authentication pass asserts the sending domain and nothing else.\n\n(1) Feed authentication results only into DMARC disposition and domain reputation, never into filter bypass, score reduction or trust badges.\n(2) Evaluate domain reputation (age, history, similarity to known domains) as a separate input that an authentication pass cannot raise.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·A", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·A", "mitigation_principle": "An authentication pass asserts the sending domain and nothing else.", "design_measures": [ "Feed authentication results only into DMARC disposition and domain reputation, never into filter bypass, score reduction or trust badges.", "Evaluate domain reputation (age, history, similarity to known domains) as a separate input that an authentication pass cannot raise." ] } } }, { "type": "relationship", "id": "relationship--bc714967-4f0f-567d-9002-a5af34959bb5", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--65455210-a9e3-5117-a03e-1f6f3bbdafa9", "target_ref": "attack-pattern--65455210-a9e3-5117-a03e-1f6f3bbdafa9" }, { "type": "attack-pattern", "id": "attack-pattern--26e00b8c-7286-56c9-ae9f-6fb69a9717a0", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Cross-Tenant Identity", "description": "Shared sending infrastructure lets one tenant emit mail that authenticates as another tenant's domain.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·K", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-k" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-195", "url": "https://capec.mitre.org/data/definitions/195.html", "description": "Principal Spoof" }, { "source_name": "cwe", "external_id": "CWE-283", "url": "https://cwe.mitre.org/data/definitions/283.html", "description": "Unverified Ownership" }, { "source_name": "cwe", "external_id": "CWE-291", "url": "https://cwe.mitre.org/data/definitions/291.html", "description": "Reliance on IP Address for Authentication" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "authentication-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·K", "group_code": "AU", "group_name": "Authentication protocols", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-151", "CAPEC-195" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-283", "CWE-291" ] } } }, { "type": "course-of-action", "id": "course-of-action--26e00b8c-7286-56c9-ae9f-6fb69a9717a0", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for AU·K Cross-Tenant Identity", "description": "Each tenant can authenticate only for domains it has proven it owns, and a shared upstream identifies its customers by something they cannot set.\n\n(1) Reject submission when the envelope sender or From domain is not in the tenant's verified domain list, and when accepting outbound mail from a shared upstream, identify the customer from a property that upstream stamps and the sender cannot forge (a tenant identifier header or a per-tenant certificate), never from the connecting IP.\n(2) Issue DKIM keys per tenant and per domain, and never sign a message with a key belonging to another tenant.\n(3) Audit outbound mail per tenant against that tenant's verified domains, and alert on any signed message whose domain the tenant does not own.\n(4) Give each tenant on a shared upstream its own inbound connector with its own certificate, so a tenant cannot present itself as another even to the upstream.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·K", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·K", "mitigation_principle": "Each tenant can authenticate only for domains it has proven it owns, and a shared upstream identifies its customers by something they cannot set.", "design_measures": [ "Reject submission when the envelope sender or From domain is not in the tenant's verified domain list, and when accepting outbound mail from a shared upstream, identify the customer from a property that upstream stamps and the sender cannot forge (a tenant identifier header or a per-tenant certificate), never from the connecting IP.", "Issue DKIM keys per tenant and per domain, and never sign a message with a key belonging to another tenant.", "Audit outbound mail per tenant against that tenant's verified domains, and alert on any signed message whose domain the tenant does not own.", "Give each tenant on a shared upstream its own inbound connector with its own certificate, so a tenant cannot present itself as another even to the upstream." ] } } }, { "type": "relationship", "id": "relationship--c504fd37-88ad-576b-b0ab-fc753dfd3f02", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--26e00b8c-7286-56c9-ae9f-6fb69a9717a0", "target_ref": "attack-pattern--26e00b8c-7286-56c9-ae9f-6fb69a9717a0" }, { "type": "attack-pattern", "id": "attack-pattern--a14ad96a-6b1e-5ccd-8552-262f960a9f5b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "DKIM Replay", "description": "A message the platform signed is re-sent to arbitrary recipients, because the signature binds neither recipient nor time.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-q" }, { "source_name": "capec", "external_id": "CAPEC-60", "url": "https://capec.mitre.org/data/definitions/60.html", "description": "Reusing Session IDs (aka Session Replay)" }, { "source_name": "cwe", "external_id": "CWE-294", "url": "https://cwe.mitre.org/data/definitions/294.html", "description": "Authentication Bypass by Capture-replay" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "authentication-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·Q", "group_code": "AU", "group_name": "Authentication protocols", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-60" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-294" ] } } }, { "type": "course-of-action", "id": "course-of-action--a14ad96a-6b1e-5ccd-8552-262f960a9f5b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for AU·Q DKIM Replay", "description": "A DKIM signature binds a message to its intended recipients and a time window.\n\n(1) Sign the To, Cc and Date headers, oversign them, and set a short expiry (x= tag) on every signature.\n(2) Limit the signing of mail from new, free or unverified accounts, and detect replay by rate-limiting identical signed messages per signature.\n(3) Monitor for the platform's own signatures appearing on mail that did not pass through its outbound path (a DKIM replay feed or recipient reports), and revoke the selector when replay is detected.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·Q", "mitigation_principle": "A DKIM signature binds a message to its intended recipients and a time window.", "design_measures": [ "Sign the To, Cc and Date headers, oversign them, and set a short expiry (x= tag) on every signature.", "Limit the signing of mail from new, free or unverified accounts, and detect replay by rate-limiting identical signed messages per signature.", "Monitor for the platform's own signatures appearing on mail that did not pass through its outbound path (a DKIM replay feed or recipient reports), and revoke the selector when replay is detected." ] } } }, { "type": "relationship", "id": "relationship--7186271f-a895-5dd6-acbf-5cd4c0b1a13c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a14ad96a-6b1e-5ccd-8552-262f960a9f5b", "target_ref": "attack-pattern--a14ad96a-6b1e-5ccd-8552-262f960a9f5b" }, { "type": "attack-pattern", "id": "attack-pattern--379fb489-eeaf-5382-96b1-5934da978e97", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Partial Signature Coverage", "description": "The signer leaves headers or body unsigned, or the verifier honours l= and tolerates duplicate headers, so content changes under a valid signature.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·J", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-j" }, { "source_name": "capec", "external_id": "CAPEC-477", "url": "https://capec.mitre.org/data/definitions/477.html", "description": "Signature Spoofing by Mixing Signed and Unsigned Content" }, { "source_name": "cwe", "external_id": "CWE-349", "url": "https://cwe.mitre.org/data/definitions/349.html", "description": "Acceptance of Extraneous Untrusted Data With Trusted Data" }, { "source_name": "cwe", "external_id": "CWE-347", "url": "https://cwe.mitre.org/data/definitions/347.html", "description": "Improper Verification of Cryptographic Signature" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "authentication-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·J", "group_code": "AU", "group_name": "Authentication protocols", "stride": [ "S", "T" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-477" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-349", "CWE-347" ] } } }, { "type": "course-of-action", "id": "course-of-action--379fb489-eeaf-5382-96b1-5934da978e97", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for AU·J Partial Signature Coverage", "description": "A signature covers everything the recipient will see, and the verifier treats partial coverage as unsigned.\n\n(1) Sign and oversign From, To, Subject, Date, Reply-To, Content-Type and MIME-Version; do not use the l= tag when signing.\n(2) As a verifier, treat l= signatures and duplicated single-instance headers as a DKIM failure.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·J", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·J", "mitigation_principle": "A signature covers everything the recipient will see, and the verifier treats partial coverage as unsigned.", "design_measures": [ "Sign and oversign From, To, Subject, Date, Reply-To, Content-Type and MIME-Version; do not use the l= tag when signing.", "As a verifier, treat l= signatures and duplicated single-instance headers as a DKIM failure." ] } } }, { "type": "relationship", "id": "relationship--09940851-5b76-5ca0-b0e5-b7d86aa83621", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--379fb489-eeaf-5382-96b1-5934da978e97", "target_ref": "attack-pattern--379fb489-eeaf-5382-96b1-5934da978e97" }, { "type": "attack-pattern", "id": "attack-pattern--b820b5b5-4a4b-5dbb-b0cd-ffb8d593a5ca", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Alignment Confusion", "description": "The identifier that authentication verified is not the one the client displays: a second From header, a Sender or Resent-From standing in for a missing From, or a display name is shown while the evaluator checked something else.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·10", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-10" }, { "source_name": "capec", "external_id": "CAPEC-43", "url": "https://capec.mitre.org/data/definitions/43.html", "description": "Exploiting Multiple Input Interpretation Layers" }, { "source_name": "capec", "external_id": "CAPEC-476", "url": "https://capec.mitre.org/data/definitions/476.html", "description": "Signature Spoofing by Misrepresentation" }, { "source_name": "cwe", "external_id": "CWE-436", "url": "https://cwe.mitre.org/data/definitions/436.html", "description": "Interpretation Conflict" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "authentication-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·10", "group_code": "AU", "group_name": "Authentication protocols", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-43", "CAPEC-476" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-436", "CWE-451" ] } } }, { "type": "course-of-action", "id": "course-of-action--b820b5b5-4a4b-5dbb-b0cd-ffb8d593a5ca", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for AU·10 Alignment Confusion", "description": "One identifier is authenticated, and the client displays only that identifier, parsed the same way.\n\n(1) Reject at SMTP time any message with no From header, more than one, or one that does not parse.\n(2) Share one address-parsing library between the DMARC evaluator and every client, tested against the same corpus of malformed headers, and never show Sender, Resent-From or a display name in place of the authenticated From.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·10", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·10", "mitigation_principle": "One identifier is authenticated, and the client displays only that identifier, parsed the same way.", "design_measures": [ "Reject at SMTP time any message with no From header, more than one, or one that does not parse.", "Share one address-parsing library between the DMARC evaluator and every client, tested against the same corpus of malformed headers, and never show Sender, Resent-From or a display name in place of the authenticated From." ] } } }, { "type": "relationship", "id": "relationship--7de81239-5f66-508a-8180-30065f44a9fe", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b820b5b5-4a4b-5dbb-b0cd-ffb8d593a5ca", "target_ref": "attack-pattern--b820b5b5-4a4b-5dbb-b0cd-ffb8d593a5ca" }, { "type": "attack-pattern", "id": "attack-pattern--d2333a1e-1c91-55a9-8899-562ea5228a0b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Identifier Handoff", "description": "An authentication check silently substitutes one identifier for another: SPF verifies the HELO name because MAIL FROM is empty or does not resolve, and DMARC then aligns that pass against the MAIL FROM it never checked.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·9", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-9" }, { "source_name": "capec", "external_id": "CAPEC-475", "url": "https://capec.mitre.org/data/definitions/475.html", "description": "Signature Spoofing by Improper Validation" }, { "source_name": "cwe", "external_id": "CWE-1390", "url": "https://cwe.mitre.org/data/definitions/1390.html", "description": "Weak Authentication" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "authentication-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·9", "group_code": "AU", "group_name": "Authentication protocols", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-475" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-1390" ] } } }, { "type": "course-of-action", "id": "course-of-action--d2333a1e-1c91-55a9-8899-562ea5228a0b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for AU·9 Identifier Handoff", "description": "Every authentication result names the identifier it verified, and no result is applied to an identifier it did not check.\n\n(1) Record the checked identifier (HELO or MAIL FROM) in the SPF result, and have DMARC treat an SPF pass on HELO as no SPF result for MAIL FROM alignment.\n(2) Handle an empty or unresolvable MAIL FROM as a case of its own with an explicit policy rather than a silent substitution, and test the evaluator with messages engineered to make the preferred identifier fail.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·9", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·9", "mitigation_principle": "Every authentication result names the identifier it verified, and no result is applied to an identifier it did not check.", "design_measures": [ "Record the checked identifier (HELO or MAIL FROM) in the SPF result, and have DMARC treat an SPF pass on HELO as no SPF result for MAIL FROM alignment.", "Handle an empty or unresolvable MAIL FROM as a case of its own with an explicit policy rather than a silent substitution, and test the evaluator with messages engineered to make the preferred identifier fail." ] } } }, { "type": "relationship", "id": "relationship--7ee62139-8ce3-5884-bb18-207be8289112", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d2333a1e-1c91-55a9-8899-562ea5228a0b", "target_ref": "attack-pattern--d2333a1e-1c91-55a9-8899-562ea5228a0b" }, { "type": "attack-pattern", "id": "attack-pattern--55b50a33-acda-5015-b05b-4badf45bfd84", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Laundered Trust", "description": "Forwarders, mailing lists and ARC seals from untrustworthy intermediaries override an authentication failure.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·8", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-8" }, { "source_name": "capec", "external_id": "CAPEC-21", "url": "https://capec.mitre.org/data/definitions/21.html", "description": "Exploitation of Trusted Identifiers" }, { "source_name": "cwe", "external_id": "CWE-807", "url": "https://cwe.mitre.org/data/definitions/807.html", "description": "Reliance on Untrusted Inputs in a Security Decision" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "authentication-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·8", "group_code": "AU", "group_name": "Authentication protocols", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-21" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-807" ] } } }, { "type": "course-of-action", "id": "course-of-action--55b50a33-acda-5015-b05b-4badf45bfd84", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for AU·8 Laundered Trust", "description": "Only sealers the platform has deliberately trusted can override an authentication failure.\n\n(1) Maintain a short, reviewed list of trusted ARC sealers, and ignore ARC results from any sealer not on it.\n(2) Alert when a trusted sealer's override rate changes sharply, and have a procedure to remove a sealer within hours.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·8", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·8", "mitigation_principle": "Only sealers the platform has deliberately trusted can override an authentication failure.", "design_measures": [ "Maintain a short, reviewed list of trusted ARC sealers, and ignore ARC results from any sealer not on it.", "Alert when a trusted sealer's override rate changes sharply, and have a procedure to remove a sealer within hours." ] } } }, { "type": "relationship", "id": "relationship--4368e68d-d129-57c9-834c-e59a6fc33825", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--55b50a33-acda-5015-b05b-4badf45bfd84", "target_ref": "attack-pattern--55b50a33-acda-5015-b05b-4badf45bfd84" }, { "type": "attack-pattern", "id": "attack-pattern--c1328a3a-8ad1-5de5-87d1-84130b2e053d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Weak or Shared Keys", "description": "Signing keys are short, shared across tenants, never rotated, or their selectors are never retired.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·7", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-7" }, { "source_name": "capec", "external_id": "CAPEC-485", "url": "https://capec.mitre.org/data/definitions/485.html", "description": "Signature Spoofing by Key Recreation" }, { "source_name": "capec", "external_id": "CAPEC-474", "url": "https://capec.mitre.org/data/definitions/474.html", "description": "Signature Spoofing by Key Theft" }, { "source_name": "cwe", "external_id": "CWE-326", "url": "https://cwe.mitre.org/data/definitions/326.html", "description": "Inadequate Encryption Strength" }, { "source_name": "cwe", "external_id": "CWE-324", "url": "https://cwe.mitre.org/data/definitions/324.html", "description": "Use of a Key Past its Expiration Date" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "authentication-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·7", "group_code": "AU", "group_name": "Authentication protocols", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-485", "CAPEC-474" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-326", "CWE-324", "CWE-653" ] } } }, { "type": "course-of-action", "id": "course-of-action--c1328a3a-8ad1-5de5-87d1-84130b2e053d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for AU·7 Weak or Shared Keys", "description": "Signing keys are strong, per tenant, rotated, and retired when their selectors are.\n\n(1) Generate 2048-bit RSA or Ed25519 keys per tenant and domain, and store them in an HSM or key management service.\n(2) Rotate keys on a fixed schedule with dual selectors, and remove the retired selector's DNS record after the rotation window.\n(3) Record every signing operation against the tenant and key that performed it, and alert on a key used for a domain it was not issued for.\n(4) Keep an inventory of published selectors per domain and remove any whose key is no longer in the key store.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·7", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·7", "mitigation_principle": "Signing keys are strong, per tenant, rotated, and retired when their selectors are.", "design_measures": [ "Generate 2048-bit RSA or Ed25519 keys per tenant and domain, and store them in an HSM or key management service.", "Rotate keys on a fixed schedule with dual selectors, and remove the retired selector's DNS record after the rotation window.", "Record every signing operation against the tenant and key that performed it, and alert on a key used for a domain it was not issued for.", "Keep an inventory of published selectors per domain and remove any whose key is no longer in the key store." ] } } }, { "type": "relationship", "id": "relationship--636df144-f8e8-5397-91cc-6254f86bb279", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c1328a3a-8ad1-5de5-87d1-84130b2e053d", "target_ref": "attack-pattern--c1328a3a-8ad1-5de5-87d1-84130b2e053d" }, { "type": "attack-pattern", "id": "attack-pattern--6d2f41f6-8016-5da7-bb81-05a0b40a1277", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Error as Pass", "description": "Temporary and permanent evaluation errors (lookup limits, timeouts, malformed records) are treated as neutral or pass, and a sender can induce them.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·6", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-6" }, { "source_name": "capec", "external_id": "CAPEC-115", "url": "https://capec.mitre.org/data/definitions/115.html", "description": "Authentication Bypass" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely ('Failing Open')" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "authentication-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·6", "group_code": "AU", "group_name": "Authentication protocols", "stride": [ "S" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-115" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-636" ] } } }, { "type": "course-of-action", "id": "course-of-action--6d2f41f6-8016-5da7-bb81-05a0b40a1277", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for AU·6 Error as Pass", "description": "An authentication error has its own disposition, never silently mapped to pass or none.\n\n(1) Treat temperror as defer and permerror as fail for domains with a published policy.\n(2) Log the error class in Authentication-Results and expose it as a distinct input to downstream policy and scoring.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·6", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·6", "mitigation_principle": "An authentication error has its own disposition, never silently mapped to pass or none.", "design_measures": [ "Treat temperror as defer and permerror as fail for domains with a published policy.", "Log the error class in Authentication-Results and expose it as a distinct input to downstream policy and scoring." ] } } }, { "type": "relationship", "id": "relationship--48cd6a53-8c4a-52f8-96fb-5ea6cb956849", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6d2f41f6-8016-5da7-bb81-05a0b40a1277", "target_ref": "attack-pattern--6d2f41f6-8016-5da7-bb81-05a0b40a1277" }, { "type": "attack-pattern", "id": "attack-pattern--6d1c4f62-c0fe-58f2-b8e2-53c4ca560f8d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Policy Override", "description": "Local allow lists, exemptions or softened dispositions silently void the domain owner's published policy.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·5", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-5" }, { "source_name": "cwe", "external_id": "CWE-183", "url": "https://cwe.mitre.org/data/definitions/183.html", "description": "Permissive List of Allowed Inputs" }, { "source_name": "cwe", "external_id": "CWE-696", "url": "https://cwe.mitre.org/data/definitions/696.html", "description": "Incorrect Behavior Order" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "authentication-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·5", "group_code": "AU", "group_name": "Authentication protocols", "stride": [ "S", "E" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-183", "CWE-696" ] } } }, { "type": "course-of-action", "id": "course-of-action--6d1c4f62-c0fe-58f2-b8e2-53c4ca560f8d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for AU·5 Policy Override", "description": "The domain owner's published policy is overridden only by an explicit, scoped and visible exception.\n\n(1) Enforce DMARC reject and quarantine before allow lists are consulted, and make any exemption a per-sender, time-limited rule.\n(2) Report overridden dispositions to the domain owner in aggregate reports, and show the tenant admin a list of active overrides.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·5", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·5", "mitigation_principle": "The domain owner's published policy is overridden only by an explicit, scoped and visible exception.", "design_measures": [ "Enforce DMARC reject and quarantine before allow lists are consulted, and make any exemption a per-sender, time-limited rule.", "Report overridden dispositions to the domain owner in aggregate reports, and show the tenant admin a list of active overrides." ] } } }, { "type": "relationship", "id": "relationship--c96b3361-ed81-5e4a-96f4-c96fb89a9917", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6d1c4f62-c0fe-58f2-b8e2-53c4ca560f8d", "target_ref": "attack-pattern--6d1c4f62-c0fe-58f2-b8e2-53c4ca560f8d" }, { "type": "attack-pattern", "id": "attack-pattern--fb2c8631-1c2c-5c26-bf69-4201f43df72c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Signing Oracle", "description": "The platform signs content it did not originate, such as forwards, bounces, auto-replies and notifications carrying attacker-chosen content.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·4", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-4" }, { "source_name": "cwe", "external_id": "CWE-441", "url": "https://cwe.mitre.org/data/definitions/441.html", "description": "Unintended Proxy or Intermediary ('Confused Deputy')" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "authentication-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·4", "group_code": "AU", "group_name": "Authentication protocols", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "None", "cwe_match": "Direct", "cwe_ids": [ "CWE-441" ] } } }, { "type": "course-of-action", "id": "course-of-action--fb2c8631-1c2c-5c26-bf69-4201f43df72c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for AU·4 Signing Oracle", "description": "The platform signs only content that originates from an authenticated sender it is authorised for.\n\n(1) Do not sign auto-forwards, bounces or notifications that carry third-party content with a tenant's domain; use a dedicated subdomain with its own policy instead.\n(2) Strip or quote attacker-controlled content in auto-replies and notifications to what is needed for the recipient to act.\n(3) Rate-limit automatic mail per account and per trigger, and refuse to sign automatic mail whose content exceeds a size or structure budget.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·4", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·4", "mitigation_principle": "The platform signs only content that originates from an authenticated sender it is authorised for.", "design_measures": [ "Do not sign auto-forwards, bounces or notifications that carry third-party content with a tenant's domain; use a dedicated subdomain with its own policy instead.", "Strip or quote attacker-controlled content in auto-replies and notifications to what is needed for the recipient to act.", "Rate-limit automatic mail per account and per trigger, and refuse to sign automatic mail whose content exceeds a size or structure budget." ] } } }, { "type": "relationship", "id": "relationship--07a7f9c2-80cb-55b3-9a50-3d88c30347d1", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fb2c8631-1c2c-5c26-bf69-4201f43df72c", "target_ref": "attack-pattern--fb2c8631-1c2c-5c26-bf69-4201f43df72c" }, { "type": "attack-pattern", "id": "attack-pattern--696f0fae-f161-5501-bd7f-83c8ef686284", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Signal Stripping", "description": "Removing a signature or a record downgrades evaluation to a weaker path instead of raising suspicion.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·3", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-3" }, { "source_name": "capec", "external_id": "CAPEC-620", "url": "https://capec.mitre.org/data/definitions/620.html", "description": "Drop Encryption Level" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely ('Failing Open')" }, { "source_name": "cwe", "external_id": "CWE-757", "url": "https://cwe.mitre.org/data/definitions/757.html", "description": "Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "authentication-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·3", "group_code": "AU", "group_name": "Authentication protocols", "stride": [ "S", "T" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-620" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-636", "CWE-757" ] } } }, { "type": "course-of-action", "id": "course-of-action--696f0fae-f161-5501-bd7f-83c8ef686284", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for AU·3 Signal Stripping", "description": "The absence of an expected signal is a failure, not a downgrade.\n\n(1) Record per sending domain whether it normally signs, and treat an unsigned message from a signing domain as a DKIM failure.\n(2) Require DKIM alignment, not SPF alone, for domains whose history shows consistent signing.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·3", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·3", "mitigation_principle": "The absence of an expected signal is a failure, not a downgrade.", "design_measures": [ "Record per sending domain whether it normally signs, and treat an unsigned message from a signing domain as a DKIM failure.", "Require DKIM alignment, not SPF alone, for domains whose history shows consistent signing." ] } } }, { "type": "relationship", "id": "relationship--04928ca2-ad33-5997-9a79-aac0b3d9a487", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--696f0fae-f161-5501-bd7f-83c8ef686284", "target_ref": "attack-pattern--696f0fae-f161-5501-bd7f-83c8ef686284" }, { "type": "attack-pattern", "id": "attack-pattern--9192cb90-b2d9-510f-8940-f231e7cb6554", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Report Channel Abuse", "description": "Aggregate and failure reports leak message data, go to unverified destinations, or are used for amplification.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·2", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-2" }, { "source_name": "capec", "external_id": "CAPEC-490", "url": "https://capec.mitre.org/data/definitions/490.html", "description": "Amplification" }, { "source_name": "cwe", "external_id": "CWE-201", "url": "https://cwe.mitre.org/data/definitions/201.html", "description": "Insertion of Sensitive Information Into Sent Data" }, { "source_name": "cwe", "external_id": "CWE-406", "url": "https://cwe.mitre.org/data/definitions/406.html", "description": "Insufficient Control of Network Message Volume (Network Amplification)" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "authentication-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·2", "group_code": "AU", "group_name": "Authentication protocols", "stride": [ "I", "D" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-490" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-201", "CWE-406" ] } } }, { "type": "course-of-action", "id": "course-of-action--9192cb90-b2d9-510f-8940-f231e7cb6554", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for AU·2 Report Channel Abuse", "description": "Reports go only to verified destinations, contain only what is needed, and are rate-limited.\n\n(1) Check the external destination verification record before sending any report to a different domain.\n(2) Redact message bodies from failure reports, and cap the number of reports sent per domain per hour.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU·2", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "AU·2", "mitigation_principle": "Reports go only to verified destinations, contain only what is needed, and are rate-limited.", "design_measures": [ "Check the external destination verification record before sending any report to a different domain.", "Redact message bodies from failure reports, and cap the number of reports sent per domain per hour." ] } } }, { "type": "relationship", "id": "relationship--feebf10e-ad67-54c8-aaf1-232cd5e83e5f", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9192cb90-b2d9-510f-8940-f231e7cb6554", "target_ref": "attack-pattern--9192cb90-b2d9-510f-8940-f231e7cb6554" }, { "type": "grouping", "id": "grouping--a9820d13-32e6-54b3-99f4-4a9f3e38f3f1", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Layer 02: Authentication protocols (AU)", "description": "SPF, DKIM, DMARC and ARC prove which domain handled a message, and the danger is that a pass is read as more than it means. These entries treat the protocols as trust signals that can be weaponised, in both the signing and the verifying role. Scope: SPF, DKIM, DMARC and ARC as trust signals that can be weaponised.", "context": "unspecified", "object_refs": [ "attack-pattern--65455210-a9e3-5117-a03e-1f6f3bbdafa9", "course-of-action--65455210-a9e3-5117-a03e-1f6f3bbdafa9", "attack-pattern--26e00b8c-7286-56c9-ae9f-6fb69a9717a0", "course-of-action--26e00b8c-7286-56c9-ae9f-6fb69a9717a0", "attack-pattern--a14ad96a-6b1e-5ccd-8552-262f960a9f5b", "course-of-action--a14ad96a-6b1e-5ccd-8552-262f960a9f5b", "attack-pattern--379fb489-eeaf-5382-96b1-5934da978e97", "course-of-action--379fb489-eeaf-5382-96b1-5934da978e97", "attack-pattern--b820b5b5-4a4b-5dbb-b0cd-ffb8d593a5ca", "course-of-action--b820b5b5-4a4b-5dbb-b0cd-ffb8d593a5ca", "attack-pattern--d2333a1e-1c91-55a9-8899-562ea5228a0b", "course-of-action--d2333a1e-1c91-55a9-8899-562ea5228a0b", "attack-pattern--55b50a33-acda-5015-b05b-4badf45bfd84", "course-of-action--55b50a33-acda-5015-b05b-4badf45bfd84", "attack-pattern--c1328a3a-8ad1-5de5-87d1-84130b2e053d", "course-of-action--c1328a3a-8ad1-5de5-87d1-84130b2e053d", "attack-pattern--6d2f41f6-8016-5da7-bb81-05a0b40a1277", "course-of-action--6d2f41f6-8016-5da7-bb81-05a0b40a1277", "attack-pattern--6d1c4f62-c0fe-58f2-b8e2-53c4ca560f8d", "course-of-action--6d1c4f62-c0fe-58f2-b8e2-53c4ca560f8d", "attack-pattern--fb2c8631-1c2c-5c26-bf69-4201f43df72c", "course-of-action--fb2c8631-1c2c-5c26-bf69-4201f43df72c", "attack-pattern--696f0fae-f161-5501-bd7f-83c8ef686284", "course-of-action--696f0fae-f161-5501-bd7f-83c8ef686284", "attack-pattern--9192cb90-b2d9-510f-8940-f231e7cb6554", "course-of-action--9192cb90-b2d9-510f-8940-f231e7cb6554" ], "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "AU", "url": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--eb218fb7-199e-5358-887b-142bf400bacf", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Legacy Authentication", "description": "Protocol endpoints accept password-only authentication that bypasses MFA and access policy.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·A", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-a" }, { "source_name": "capec", "external_id": "CAPEC-115", "url": "https://capec.mitre.org/data/definitions/115.html", "description": "Authentication Bypass" }, { "source_name": "capec", "external_id": "CAPEC-565", "url": "https://capec.mitre.org/data/definitions/565.html", "description": "Password Spraying" }, { "source_name": "cwe", "external_id": "CWE-420", "url": "https://cwe.mitre.org/data/definitions/420.html", "description": "Unprotected Alternate Channel" }, { "source_name": "cwe", "external_id": "CWE-308", "url": "https://cwe.mitre.org/data/definitions/308.html", "description": "Use of Single-factor Authentication" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "client-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·A", "group_code": "CP", "group_name": "Client protocols", "stride": [ "S", "E" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-115", "CAPEC-565" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-420", "CWE-308" ] } } }, { "type": "course-of-action", "id": "course-of-action--eb218fb7-199e-5358-887b-142bf400bacf", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CP·A Legacy Authentication", "description": "Every protocol endpoint enforces the same authentication and access policy as the web login.\n\n(1) Disable password-only and app-password authentication by default, and require OAuth or a device-bound credential on IMAP, POP and submission.\n(2) Evaluate conditional access (MFA, device, location) at the protocol gateway, not only at the web login.\n(3) Report per tenant which accounts still use legacy authentication and give the tenant a date-driven path to retire it, with telemetry on what would break.\n(4) Treat an authentication through a legacy protocol as a lower-assurance session with reduced rights (read-only, no rule changes, no export).", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·A", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·A", "mitigation_principle": "Every protocol endpoint enforces the same authentication and access policy as the web login.", "design_measures": [ "Disable password-only and app-password authentication by default, and require OAuth or a device-bound credential on IMAP, POP and submission.", "Evaluate conditional access (MFA, device, location) at the protocol gateway, not only at the web login.", "Report per tenant which accounts still use legacy authentication and give the tenant a date-driven path to retire it, with telemetry on what would break.", "Treat an authentication through a legacy protocol as a lower-assurance session with reduced rights (read-only, no rule changes, no export)." ] } } }, { "type": "relationship", "id": "relationship--d5091d26-6c23-5876-8caf-74bf53f515a1", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--eb218fb7-199e-5358-887b-142bf400bacf", "target_ref": "attack-pattern--eb218fb7-199e-5358-887b-142bf400bacf" }, { "type": "attack-pattern", "id": "attack-pattern--93e6580d-2550-5622-b2fa-91759c6e230c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Credential Exposure in Transit", "description": "STARTTLS stripping, commands injected before the TLS upgrade, or cleartext fallback expose credentials.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·K", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-k" }, { "source_name": "capec", "external_id": "CAPEC-620", "url": "https://capec.mitre.org/data/definitions/620.html", "description": "Drop Encryption Level" }, { "source_name": "capec", "external_id": "CAPEC-157", "url": "https://capec.mitre.org/data/definitions/157.html", "description": "Sniffing Attacks" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "cwe", "external_id": "CWE-523", "url": "https://cwe.mitre.org/data/definitions/523.html", "description": "Unprotected Transport of Credentials" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "client-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·K", "group_code": "CP", "group_name": "Client protocols", "stride": [ "I" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-620", "CAPEC-157" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-319", "CWE-523" ] } } }, { "type": "course-of-action", "id": "course-of-action--93e6580d-2550-5622-b2fa-91759c6e230c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CP·K Credential Exposure in Transit", "description": "Credentials are never accepted on a connection that is not already encrypted.\n\n(1) Offer implicit TLS ports only (993, 995, 465) and remove STARTTLS listeners for authentication.\n(2) If STARTTLS must be kept, discard any input buffered before the TLS handshake and reject AUTH before the upgrade.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·K", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·K", "mitigation_principle": "Credentials are never accepted on a connection that is not already encrypted.", "design_measures": [ "Offer implicit TLS ports only (993, 995, 465) and remove STARTTLS listeners for authentication.", "If STARTTLS must be kept, discard any input buffered before the TLS handshake and reject AUTH before the upgrade." ] } } }, { "type": "relationship", "id": "relationship--0393f1f6-19e6-58e7-8189-e9655cda9bf6", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--93e6580d-2550-5622-b2fa-91759c6e230c", "target_ref": "attack-pattern--93e6580d-2550-5622-b2fa-91759c6e230c" }, { "type": "attack-pattern", "id": "attack-pattern--2a9e73c0-039f-50f8-b655-4917c9415621", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Token and Session Persistence", "description": "Tokens and sessions are over-scoped, unbound to a device, or survive a password reset.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-q" }, { "source_name": "capec", "external_id": "CAPEC-60", "url": "https://capec.mitre.org/data/definitions/60.html", "description": "Reusing Session IDs (aka Session Replay)" }, { "source_name": "capec", "external_id": "CAPEC-593", "url": "https://capec.mitre.org/data/definitions/593.html", "description": "Session Hijacking" }, { "source_name": "cwe", "external_id": "CWE-613", "url": "https://cwe.mitre.org/data/definitions/613.html", "description": "Insufficient Session Expiration" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "client-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·Q", "group_code": "CP", "group_name": "Client protocols", "stride": [ "S", "E" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-60", "CAPEC-593" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-613", "CWE-1220" ] } } }, { "type": "course-of-action", "id": "course-of-action--2a9e73c0-039f-50f8-b655-4917c9415621", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CP·Q Token and Session Persistence", "description": "A credential change revokes every token and session, and tokens are bound to what they were issued to.\n\n(1) Revoke refresh tokens and active sessions on password reset, account disable and MFA change, propagating within minutes.\n(2) Bind tokens to the client (DPoP or mTLS) and scope them to the narrowest mail permission the client needs.\n(3) Expire sessions and tokens on an absolute lifetime as well as an idle one, and re-check account state (disabled, held, reset) on every token refresh.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·Q", "mitigation_principle": "A credential change revokes every token and session, and tokens are bound to what they were issued to.", "design_measures": [ "Revoke refresh tokens and active sessions on password reset, account disable and MFA change, propagating within minutes.", "Bind tokens to the client (DPoP or mTLS) and scope them to the narrowest mail permission the client needs.", "Expire sessions and tokens on an absolute lifetime as well as an idle one, and re-check account state (disabled, held, reset) on every token refresh." ] } } }, { "type": "relationship", "id": "relationship--af393912-7a95-5be6-b52a-0b5af15aadfe", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2a9e73c0-039f-50f8-b655-4917c9415621", "target_ref": "attack-pattern--2a9e73c0-039f-50f8-b655-4917c9415621" }, { "type": "attack-pattern", "id": "attack-pattern--5bb7c363-8728-5f21-9845-43a5a8748a67", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Sync as Exfiltration", "description": "Full mailbox replication by a new client is indistinguishable from normal use.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·J", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-j" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "client-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·J", "group_code": "CP", "group_name": "Client protocols", "stride": [ "I" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-778" ] } } }, { "type": "course-of-action", "id": "course-of-action--5bb7c363-8728-5f21-9845-43a5a8748a67", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CP·J Sync as Exfiltration", "description": "A new client's first full sync is visible and can be limited.\n\n(1) Notify the mailbox owner and tenant admin when a new client authenticates, and show its first-sync volume in the audit log.\n(2) Allow tenants to limit unmanaged clients to recent mail and to require approval for full-mailbox sync.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·J", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·J", "mitigation_principle": "A new client's first full sync is visible and can be limited.", "design_measures": [ "Notify the mailbox owner and tenant admin when a new client authenticates, and show its first-sync volume in the audit log.", "Allow tenants to limit unmanaged clients to recent mail and to require approval for full-mailbox sync." ] } } }, { "type": "relationship", "id": "relationship--7ba8ce59-a69b-522d-9797-67606bf6eba4", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5bb7c363-8728-5f21-9845-43a5a8748a67", "target_ref": "attack-pattern--5bb7c363-8728-5f21-9845-43a5a8748a67" }, { "type": "attack-pattern", "id": "attack-pattern--2ac50a45-d212-565c-94a4-2490d38cf6eb", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mailbox State Manipulation", "description": "Rules, forwarding, delegation or appended messages are set through the protocol without any signal to the owner.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·10", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-10" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "cwe", "external_id": "CWE-223", "url": "https://cwe.mitre.org/data/definitions/223.html", "description": "Omission of Security-relevant Information" }, { "source_name": "cwe", "external_id": "CWE-1188", "url": "https://cwe.mitre.org/data/definitions/1188.html", "description": "Initialization of a Resource with an Insecure Default" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "client-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·10", "group_code": "CP", "group_name": "Client protocols", "stride": [ "T", "R" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-176" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-223", "CWE-1188" ] } } }, { "type": "course-of-action", "id": "course-of-action--2ac50a45-d212-565c-94a4-2490d38cf6eb", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CP·10 Mailbox State Manipulation", "description": "Any change to how a mailbox routes or shares mail is notified to its owner.\n\n(1) Send an out-of-band notification (push or SMS) when a rule, forward or delegate is created through any protocol.\n(2) Block external auto-forwarding rules by default and require admin approval per rule.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·10", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·10", "mitigation_principle": "Any change to how a mailbox routes or shares mail is notified to its owner.", "design_measures": [ "Send an out-of-band notification (push or SMS) when a rule, forward or delegate is created through any protocol.", "Block external auto-forwarding rules by default and require admin approval per rule." ] } } }, { "type": "relationship", "id": "relationship--57f2bbc8-df96-5873-a2a9-f36a59f902dd", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2ac50a45-d212-565c-94a4-2490d38cf6eb", "target_ref": "attack-pattern--2ac50a45-d212-565c-94a4-2490d38cf6eb" }, { "type": "attack-pattern", "id": "attack-pattern--fbf0e469-6907-5b3c-81b1-de75ca601617", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Credentials and Caches at Rest", "description": "Clients and intermediary services store credentials and mailbox copies outside the platform's control.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·9", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-9" }, { "source_name": "capec", "external_id": "CAPEC-37", "url": "https://capec.mitre.org/data/definitions/37.html", "description": "Retrieve Embedded Sensitive Data" }, { "source_name": "capec", "external_id": "CAPEC-204", "url": "https://capec.mitre.org/data/definitions/204.html", "description": "Lifting Sensitive Data Embedded in Cache" }, { "source_name": "cwe", "external_id": "CWE-522", "url": "https://cwe.mitre.org/data/definitions/522.html", "description": "Insufficiently Protected Credentials" }, { "source_name": "cwe", "external_id": "CWE-524", "url": "https://cwe.mitre.org/data/definitions/524.html", "description": "Use of Cache Containing Sensitive Information" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "client-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·9", "group_code": "CP", "group_name": "Client protocols", "stride": [ "I" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-37", "CAPEC-204" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-522", "CWE-524" ] } } }, { "type": "course-of-action", "id": "course-of-action--fbf0e469-6907-5b3c-81b1-de75ca601617", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CP·9 Credentials and Caches at Rest", "description": "The platform controls where its credentials and mail copies end up.\n\n(1) Issue short-lived tokens so no client holds a long-lived secret, and refuse third-party intermediaries that store user credentials.\n(2) Support remote wipe of client caches and enforce it through device-management APIs for managed clients.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·9", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·9", "mitigation_principle": "The platform controls where its credentials and mail copies end up.", "design_measures": [ "Issue short-lived tokens so no client holds a long-lived secret, and refuse third-party intermediaries that store user credentials.", "Support remote wipe of client caches and enforce it through device-management APIs for managed clients." ] } } }, { "type": "relationship", "id": "relationship--4051abc0-37a7-50c9-a6af-c0b4600a9a0c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fbf0e469-6907-5b3c-81b1-de75ca601617", "target_ref": "attack-pattern--fbf0e469-6907-5b3c-81b1-de75ca601617" }, { "type": "attack-pattern", "id": "attack-pattern--0f60770b-6d9c-5f4c-88bc-f3f7453ae5e7", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Autodiscovery Hijack", "description": "Client configuration discovery sends credentials to an unintended or attacker-controlled host.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·8", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-8" }, { "source_name": "capec", "external_id": "CAPEC-154", "url": "https://capec.mitre.org/data/definitions/154.html", "description": "Resource Location Spoofing" }, { "source_name": "cwe", "external_id": "CWE-923", "url": "https://cwe.mitre.org/data/definitions/923.html", "description": "Improper Restriction of Communication Channel to Intended Endpoints" }, { "source_name": "cwe", "external_id": "CWE-941", "url": "https://cwe.mitre.org/data/definitions/941.html", "description": "Incorrectly Specified Destination in a Communication Channel" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "client-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·8", "group_code": "CP", "group_name": "Client protocols", "stride": [ "S", "I" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-154" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-923", "CWE-941" ] } } }, { "type": "course-of-action", "id": "course-of-action--0f60770b-6d9c-5f4c-88bc-f3f7453ae5e7", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CP·8 Autodiscovery Hijack", "description": "A client sends credentials only to a host it has verified belongs to the mailbox provider.\n\n(1) Publish autodiscovery over HTTPS only, and have clients verify the certificate and domain match before sending any credential.\n(2) Fail closed: when the expected discovery host does not resolve, prompt the user rather than trying alternative hostnames.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·8", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·8", "mitigation_principle": "A client sends credentials only to a host it has verified belongs to the mailbox provider.", "design_measures": [ "Publish autodiscovery over HTTPS only, and have clients verify the certificate and domain match before sending any credential.", "Fail closed: when the expected discovery host does not resolve, prompt the user rather than trying alternative hostnames." ] } } }, { "type": "relationship", "id": "relationship--83be2099-852a-5bec-88a1-a2317b4a96da", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0f60770b-6d9c-5f4c-88bc-f3f7453ae5e7", "target_ref": "attack-pattern--0f60770b-6d9c-5f4c-88bc-f3f7453ae5e7" }, { "type": "attack-pattern", "id": "attack-pattern--78d9383b-5781-593f-90be-bbdd472d1cbb", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Authentication Oracle", "description": "Differing responses or timing allow account enumeration and password spraying, with throttling inconsistent across protocols.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·7", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-7" }, { "source_name": "capec", "external_id": "CAPEC-575", "url": "https://capec.mitre.org/data/definitions/575.html", "description": "Account Footprinting" }, { "source_name": "capec", "external_id": "CAPEC-565", "url": "https://capec.mitre.org/data/definitions/565.html", "description": "Password Spraying" }, { "source_name": "capec", "external_id": "CAPEC-49", "url": "https://capec.mitre.org/data/definitions/49.html", "description": "Password Brute Forcing" }, { "source_name": "cwe", "external_id": "CWE-204", "url": "https://cwe.mitre.org/data/definitions/204.html", "description": "Observable Response Discrepancy" }, { "source_name": "cwe", "external_id": "CWE-208", "url": "https://cwe.mitre.org/data/definitions/208.html", "description": "Observable Timing Discrepancy" }, { "source_name": "cwe", "external_id": "CWE-307", "url": "https://cwe.mitre.org/data/definitions/307.html", "description": "Improper Restriction of Excessive Authentication Attempts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "client-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·7", "group_code": "CP", "group_name": "Client protocols", "stride": [ "I", "S" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-575", "CAPEC-565", "CAPEC-49" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-204", "CWE-208", "CWE-307" ] } } }, { "type": "course-of-action", "id": "course-of-action--78d9383b-5781-593f-90be-bbdd472d1cbb", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CP·7 Authentication Oracle", "description": "Authentication responses and limits are uniform across users, errors and protocols.\n\n(1) Return an identical response and timing for unknown user, wrong password and locked account.\n(2) Share the throttling and lockout counters across IMAP, POP, submission, API and web login.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·7", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·7", "mitigation_principle": "Authentication responses and limits are uniform across users, errors and protocols.", "design_measures": [ "Return an identical response and timing for unknown user, wrong password and locked account.", "Share the throttling and lockout counters across IMAP, POP, submission, API and web login." ] } } }, { "type": "relationship", "id": "relationship--4a858c07-d65e-59be-9186-7a88553d845c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--78d9383b-5781-593f-90be-bbdd472d1cbb", "target_ref": "attack-pattern--78d9383b-5781-593f-90be-bbdd472d1cbb" }, { "type": "attack-pattern", "id": "attack-pattern--1118e208-3590-5d96-99ce-d0fe4a5609f6", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Third-Party Delegation", "description": "App consent grants broad, durable mailbox access that the owner cannot easily see or revoke.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·6", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-6" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "client-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·6", "group_code": "CP", "group_name": "Client protocols", "stride": [ "E" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-122" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-1220" ] } } }, { "type": "course-of-action", "id": "course-of-action--1118e208-3590-5d96-99ce-d0fe4a5609f6", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CP·6 Third-Party Delegation", "description": "Third-party access is narrowly scoped, visible to the owner and revocable in one place.\n\n(1) Offer granular mail scopes (read recent, send only, folder-limited) and require admin consent for full-mailbox scopes.\n(2) Give users and admins a single page listing every app with mailbox access, with one-click revocation.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·6", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·6", "mitigation_principle": "Third-party access is narrowly scoped, visible to the owner and revocable in one place.", "design_measures": [ "Offer granular mail scopes (read recent, send only, folder-limited) and require admin consent for full-mailbox scopes.", "Give users and admins a single page listing every app with mailbox access, with one-click revocation." ] } } }, { "type": "relationship", "id": "relationship--e70d36e9-eb33-559a-9db8-eeba23bea61d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1118e208-3590-5d96-99ce-d0fe4a5609f6", "target_ref": "attack-pattern--1118e208-3590-5d96-99ce-d0fe4a5609f6" }, { "type": "attack-pattern", "id": "attack-pattern--aec79129-9f8d-5058-89b1-18868f705c0a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Cross-Mailbox Access", "description": "Shared folders, delegation or impersonation features allow access beyond the authenticated identity.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·5", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-5" }, { "source_name": "capec", "external_id": "CAPEC-1", "url": "https://capec.mitre.org/data/definitions/1.html", "description": "Accessing Functionality Not Properly Constrained by ACLs" }, { "source_name": "capec", "external_id": "CAPEC-180", "url": "https://capec.mitre.org/data/definitions/180.html", "description": "Exploiting Incorrectly Configured Access Control Security Levels" }, { "source_name": "cwe", "external_id": "CWE-863", "url": "https://cwe.mitre.org/data/definitions/863.html", "description": "Incorrect Authorization" }, { "source_name": "cwe", "external_id": "CWE-639", "url": "https://cwe.mitre.org/data/definitions/639.html", "description": "Authorization Bypass Through User-Controlled Key" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "client-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·5", "group_code": "CP", "group_name": "Client protocols", "stride": [ "E", "I" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-1", "CAPEC-180" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-863", "CWE-639" ] } } }, { "type": "course-of-action", "id": "course-of-action--aec79129-9f8d-5058-89b1-18868f705c0a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CP·5 Cross-Mailbox Access", "description": "Authorisation is checked on every object, on every request, against the authenticated identity.\n\n(1) Use per-mailbox, unguessable object identifiers and check ownership on every fetch, not only when listing.\n(2) Restrict impersonation rights to specific service accounts, log every impersonated request, and alert on impersonation of privileged users.\n(3) Test authorisation with an automated suite that requests every object type as a different user, a different tenant and a delegate, and fails the build on any success.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·5", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·5", "mitigation_principle": "Authorisation is checked on every object, on every request, against the authenticated identity.", "design_measures": [ "Use per-mailbox, unguessable object identifiers and check ownership on every fetch, not only when listing.", "Restrict impersonation rights to specific service accounts, log every impersonated request, and alert on impersonation of privileged users.", "Test authorisation with an automated suite that requests every object type as a different user, a different tenant and a delegate, and fails the build on any success." ] } } }, { "type": "relationship", "id": "relationship--ee9aefde-857e-5894-a7f5-78f5d26cffba", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--aec79129-9f8d-5058-89b1-18868f705c0a", "target_ref": "attack-pattern--aec79129-9f8d-5058-89b1-18868f705c0a" }, { "type": "attack-pattern", "id": "attack-pattern--0f6285d8-20c0-5c48-b10d-7df63fc9c657", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Protocol Command Abuse", "description": "Malformed or expensive commands (literals, searches, large fetches) cause injection or resource exhaustion on the server.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·4", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-4" }, { "source_name": "capec", "external_id": "CAPEC-183", "url": "https://capec.mitre.org/data/definitions/183.html", "description": "IMAP/SMTP Command Injection" }, { "source_name": "capec", "external_id": "CAPEC-130", "url": "https://capec.mitre.org/data/definitions/130.html", "description": "Excessive Allocation" }, { "source_name": "cwe", "external_id": "CWE-770", "url": "https://cwe.mitre.org/data/definitions/770.html", "description": "Allocation of Resources Without Limits or Throttling" }, { "source_name": "cwe", "external_id": "CWE-943", "url": "https://cwe.mitre.org/data/definitions/943.html", "description": "Improper Neutralization of Special Elements in Data Query Logic" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "client-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·4", "group_code": "CP", "group_name": "Client protocols", "stride": [ "T", "D" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-183", "CAPEC-130" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-770", "CWE-943" ] } } }, { "type": "course-of-action", "id": "course-of-action--0f6285d8-20c0-5c48-b10d-7df63fc9c657", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CP·4 Protocol Command Abuse", "description": "Every command is bounded, isolated per user and never interpolated into a backend query.\n\n(1) Cap command length, literal size, search complexity and concurrent connections per session and per user.\n(2) Pass search terms as parameters to the index, never by string concatenation, and run searches with a per-tenant resource budget.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·4", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·4", "mitigation_principle": "Every command is bounded, isolated per user and never interpolated into a backend query.", "design_measures": [ "Cap command length, literal size, search complexity and concurrent connections per session and per user.", "Pass search terms as parameters to the index, never by string concatenation, and run searches with a per-tenant resource budget." ] } } }, { "type": "relationship", "id": "relationship--ecdb15ab-38f5-5184-bcf0-93ae87d9cdb8", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0f6285d8-20c0-5c48-b10d-7df63fc9c657", "target_ref": "attack-pattern--0f6285d8-20c0-5c48-b10d-7df63fc9c657" }, { "type": "attack-pattern", "id": "attack-pattern--6ff81457-3ad6-5e0b-a471-3a4c92b4a66b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Lockout as Denial of Service", "description": "An attacker who knows a username can lock the account on demand by failing authentication deliberately, cutting the target off from mail at a moment of the attacker's choosing.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·3", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-3" }, { "source_name": "capec", "external_id": "CAPEC-2", "url": "https://capec.mitre.org/data/definitions/2.html", "description": "Inducing Account Lockout" }, { "source_name": "cwe", "external_id": "CWE-645", "url": "https://cwe.mitre.org/data/definitions/645.html", "description": "Overly Restrictive Account Lockout Mechanism" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "client-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·3", "group_code": "CP", "group_name": "Client protocols", "stride": [ "D" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-2" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-645" ] } } }, { "type": "course-of-action", "id": "course-of-action--6ff81457-3ad6-5e0b-a471-3a4c92b4a66b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CP·3 Lockout as Denial of Service", "description": "Lockout protects the account without handing an attacker an off switch.\n\n(1) Lock out the source (address, device, session) rather than the account, and escalate to a risk-based challenge for the account itself.\n(2) Keep already-authenticated sessions alive through a lockout and give the mailbox owner a trusted recovery path that does not depend on the locked credential.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·3", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·3", "mitigation_principle": "Lockout protects the account without handing an attacker an off switch.", "design_measures": [ "Lock out the source (address, device, session) rather than the account, and escalate to a risk-based challenge for the account itself.", "Keep already-authenticated sessions alive through a lockout and give the mailbox owner a trusted recovery path that does not depend on the locked credential." ] } } }, { "type": "relationship", "id": "relationship--3c8112b9-d5e8-534c-9ea8-b16f6e7b9d78", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6ff81457-3ad6-5e0b-a471-3a4c92b4a66b", "target_ref": "attack-pattern--6ff81457-3ad6-5e0b-a471-3a4c92b4a66b" }, { "type": "attack-pattern", "id": "attack-pattern--dd1b7c77-d3b3-5e9a-9476-a7a8ccbd4dd4", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Notification Leakage", "description": "Push notifications and previews expose message content to third-party services and lock screens.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·2", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-2" }, { "source_name": "cwe", "external_id": "CWE-201", "url": "https://cwe.mitre.org/data/definitions/201.html", "description": "Insertion of Sensitive Information Into Sent Data" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "client-protocols" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·2", "group_code": "CP", "group_name": "Client protocols", "stride": [ "I" ], "stride_fit": "Clean", "capec_match": "None", "cwe_match": "Direct", "cwe_ids": [ "CWE-201", "CWE-359" ] } } }, { "type": "course-of-action", "id": "course-of-action--dd1b7c77-d3b3-5e9a-9476-a7a8ccbd4dd4", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CP·2 Notification Leakage", "description": "Notification payloads contain nothing the recipient would not want on a lock screen or a third-party server.\n\n(1) Send content-free push alerts and have the client fetch the preview over an authenticated channel.\n(2) Let tenants disable previews and sender names in notifications for sensitive mailboxes.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP·2", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CP·2", "mitigation_principle": "Notification payloads contain nothing the recipient would not want on a lock screen or a third-party server.", "design_measures": [ "Send content-free push alerts and have the client fetch the preview over an authenticated channel.", "Let tenants disable previews and sender names in notifications for sensitive mailboxes." ] } } }, { "type": "relationship", "id": "relationship--c5bbb75b-cdc5-5361-b301-95aefc48549a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--dd1b7c77-d3b3-5e9a-9476-a7a8ccbd4dd4", "target_ref": "attack-pattern--dd1b7c77-d3b3-5e9a-9476-a7a8ccbd4dd4" }, { "type": "grouping", "id": "grouping--dbfcba8d-23f2-5b53-ba15-1a42e8b07e9a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Layer 03: Client protocols (CP)", "description": "Client access is where a mailbox is read, copied and reconfigured, so a weakness here exposes everything the rest of the platform protected. These entries cover IMAP, POP and SMTP submission, plus EWS, ActiveSync, JMAP and vendor APIs. Scope: IMAP, POP, submission, and the API protocols clients use to reach the mailbox.", "context": "unspecified", "object_refs": [ "attack-pattern--eb218fb7-199e-5358-887b-142bf400bacf", "course-of-action--eb218fb7-199e-5358-887b-142bf400bacf", "attack-pattern--93e6580d-2550-5622-b2fa-91759c6e230c", "course-of-action--93e6580d-2550-5622-b2fa-91759c6e230c", "attack-pattern--2a9e73c0-039f-50f8-b655-4917c9415621", "course-of-action--2a9e73c0-039f-50f8-b655-4917c9415621", "attack-pattern--5bb7c363-8728-5f21-9845-43a5a8748a67", "course-of-action--5bb7c363-8728-5f21-9845-43a5a8748a67", "attack-pattern--2ac50a45-d212-565c-94a4-2490d38cf6eb", "course-of-action--2ac50a45-d212-565c-94a4-2490d38cf6eb", "attack-pattern--fbf0e469-6907-5b3c-81b1-de75ca601617", "course-of-action--fbf0e469-6907-5b3c-81b1-de75ca601617", "attack-pattern--0f60770b-6d9c-5f4c-88bc-f3f7453ae5e7", "course-of-action--0f60770b-6d9c-5f4c-88bc-f3f7453ae5e7", "attack-pattern--78d9383b-5781-593f-90be-bbdd472d1cbb", "course-of-action--78d9383b-5781-593f-90be-bbdd472d1cbb", "attack-pattern--1118e208-3590-5d96-99ce-d0fe4a5609f6", "course-of-action--1118e208-3590-5d96-99ce-d0fe4a5609f6", "attack-pattern--aec79129-9f8d-5058-89b1-18868f705c0a", "course-of-action--aec79129-9f8d-5058-89b1-18868f705c0a", "attack-pattern--0f6285d8-20c0-5c48-b10d-7df63fc9c657", "course-of-action--0f6285d8-20c0-5c48-b10d-7df63fc9c657", "attack-pattern--6ff81457-3ad6-5e0b-a471-3a4c92b4a66b", "course-of-action--6ff81457-3ad6-5e0b-a471-3a4c92b4a66b", "attack-pattern--dd1b7c77-d3b3-5e9a-9476-a7a8ccbd4dd4", "course-of-action--dd1b7c77-d3b3-5e9a-9476-a7a8ccbd4dd4" ], "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CP", "url": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--95ca91b5-f655-5c5b-91e8-cd3d43b9e6fe", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unauthenticated Identity Assertion", "description": "The server accepts any claimed envelope sender, header From and HELO identity.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·A", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-a" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "cwe", "external_id": "CWE-346", "url": "https://cwe.mitre.org/data/definitions/346.html", "description": "Origin Validation Error" }, { "source_name": "cwe", "external_id": "CWE-807", "url": "https://cwe.mitre.org/data/definitions/807.html", "description": "Reliance on Untrusted Inputs in a Security Decision" }, { "source_name": "cwe", "external_id": "CWE-350", "url": "https://cwe.mitre.org/data/definitions/350.html", "description": "Reliance on Reverse DNS Resolution for a Security-Critical Action" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "smtp" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·A", "group_code": "SM", "group_name": "SMTP", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-194", "CAPEC-151" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-346", "CWE-807", "CWE-350" ] } } }, { "type": "course-of-action", "id": "course-of-action--95ca91b5-f655-5c5b-91e8-cd3d43b9e6fe", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for SM·A Unauthenticated Identity Assertion", "description": "Asserted identities are recorded but never acted on until something verifiable confirms them.\n\n(1) Base connector, routing and trust decisions on a verified property (authenticated session, client certificate, DKIM-aligned domain), never on HELO, PTR or envelope sender alone.\n(2) Treat a mismatch between HELO, PTR and connecting IP as a risk signal rather than an identity.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·A", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·A", "mitigation_principle": "Asserted identities are recorded but never acted on until something verifiable confirms them.", "design_measures": [ "Base connector, routing and trust decisions on a verified property (authenticated session, client certificate, DKIM-aligned domain), never on HELO, PTR or envelope sender alone.", "Treat a mismatch between HELO, PTR and connecting IP as a risk signal rather than an identity." ] } } }, { "type": "relationship", "id": "relationship--c1249542-5489-5d45-86af-a876d3f3b4dd", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--95ca91b5-f655-5c5b-91e8-cd3d43b9e6fe", "target_ref": "attack-pattern--95ca91b5-f655-5c5b-91e8-cd3d43b9e6fe" }, { "type": "attack-pattern", "id": "attack-pattern--26d81274-531e-57d1-b4fc-112053b3cce7", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Relay Abuse", "description": "Open relays, permissive connectors or trusted-IP rules let others send through the platform.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·K", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-k" }, { "source_name": "capec", "external_id": "CAPEC-212", "url": "https://capec.mitre.org/data/definitions/212.html", "description": "Functionality Misuse" }, { "source_name": "cwe", "external_id": "CWE-441", "url": "https://cwe.mitre.org/data/definitions/441.html", "description": "Unintended Proxy or Intermediary ('Confused Deputy')" }, { "source_name": "cwe", "external_id": "CWE-291", "url": "https://cwe.mitre.org/data/definitions/291.html", "description": "Reliance on IP Address for Authentication" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "smtp" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·K", "group_code": "SM", "group_name": "SMTP", "stride": [ "S", "E" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-212" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-441", "CWE-291" ] } } }, { "type": "course-of-action", "id": "course-of-action--26d81274-531e-57d1-b4fc-112053b3cce7", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for SM·K Relay Abuse", "description": "Relay is granted to authenticated identities, never to network locations.\n\n(1) Require SMTP AUTH or a client certificate for any relay to a domain the platform does not host.\n(2) Review relay rules automatically and alert when a rule covers a shared cloud range or more than a small number of addresses.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·K", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·K", "mitigation_principle": "Relay is granted to authenticated identities, never to network locations.", "design_measures": [ "Require SMTP AUTH or a client certificate for any relay to a domain the platform does not host.", "Review relay rules automatically and alert when a rule covers a shared cloud range or more than a small number of addresses." ] } } }, { "type": "relationship", "id": "relationship--e6ebb3b4-487f-565f-a535-b794587e2575", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--26d81274-531e-57d1-b4fc-112053b3cce7", "target_ref": "attack-pattern--26d81274-531e-57d1-b4fc-112053b3cce7" }, { "type": "attack-pattern", "id": "attack-pattern--1b566b63-b337-5b9e-893e-2f73ef30b236", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "TLS Downgrade", "description": "STARTTLS is stripped or certificates go unvalidated, exposing mail in transit.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-q" }, { "source_name": "capec", "external_id": "CAPEC-620", "url": "https://capec.mitre.org/data/definitions/620.html", "description": "Drop Encryption Level" }, { "source_name": "capec", "external_id": "CAPEC-94", "url": "https://capec.mitre.org/data/definitions/94.html", "description": "Adversary in the Middle (AiTM)" }, { "source_name": "capec", "external_id": "CAPEC-217", "url": "https://capec.mitre.org/data/definitions/217.html", "description": "Exploiting Incorrectly Configured SSL/TLS" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "cwe", "external_id": "CWE-295", "url": "https://cwe.mitre.org/data/definitions/295.html", "description": "Improper Certificate Validation" }, { "source_name": "cwe", "external_id": "CWE-757", "url": "https://cwe.mitre.org/data/definitions/757.html", "description": "Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "smtp" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·Q", "group_code": "SM", "group_name": "SMTP", "stride": [ "I", "T" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-620", "CAPEC-94", "CAPEC-217" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-319", "CWE-295", "CWE-757" ] } } }, { "type": "course-of-action", "id": "course-of-action--1b566b63-b337-5b9e-893e-2f73ef30b236", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for SM·Q TLS Downgrade", "description": "Transport security is enforced where the peer demands it and verified where the platform can.\n\n(1) Honour MTA-STS and DANE on outbound delivery, deferring rather than falling back to cleartext when the policy requires TLS.\n(2) Publish an MTA-STS policy in enforce mode and TLS-RPT for the platform's own domains.\n(3) Verify the peer's certificate chain and hostname for every outbound session, and report the result in TLS-RPT and in a per-domain delivery dashboard.\n(4) Require TLS 1.2 or later with a modern cipher list on both inbound and outbound, and record the negotiated version per session for audit.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·Q", "mitigation_principle": "Transport security is enforced where the peer demands it and verified where the platform can.", "design_measures": [ "Honour MTA-STS and DANE on outbound delivery, deferring rather than falling back to cleartext when the policy requires TLS.", "Publish an MTA-STS policy in enforce mode and TLS-RPT for the platform's own domains.", "Verify the peer's certificate chain and hostname for every outbound session, and report the result in TLS-RPT and in a per-domain delivery dashboard.", "Require TLS 1.2 or later with a modern cipher list on both inbound and outbound, and record the negotiated version per session for audit." ] } } }, { "type": "relationship", "id": "relationship--e9d9cd54-1906-596c-bf32-88e11a9752b5", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1b566b63-b337-5b9e-893e-2f73ef30b236", "target_ref": "attack-pattern--1b566b63-b337-5b9e-893e-2f73ef30b236" }, { "type": "attack-pattern", "id": "attack-pattern--e567537c-9c40-5c54-8eb1-5de41bbe6439", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "SMTP Smuggling", "description": "Two MTAs disagree on the end-of-data sequence, letting a sender inject a second message with a forged envelope.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·J", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-j" }, { "source_name": "capec", "external_id": "CAPEC-33", "url": "https://capec.mitre.org/data/definitions/33.html", "description": "HTTP Request Smuggling" }, { "source_name": "cwe", "external_id": "CWE-436", "url": "https://cwe.mitre.org/data/definitions/436.html", "description": "Interpretation Conflict" }, { "source_name": "cwe", "external_id": "CWE-147", "url": "https://cwe.mitre.org/data/definitions/147.html", "description": "Improper Neutralization of Input Terminators" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "smtp" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·J", "group_code": "SM", "group_name": "SMTP", "stride": [ "S", "T" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-33" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-436", "CWE-147" ] } } }, { "type": "course-of-action", "id": "course-of-action--e567537c-9c40-5c54-8eb1-5de41bbe6439", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for SM·J SMTP Smuggling", "description": "Both ends of every SMTP hop agree on where a message ends.\n\n(1) Accept only CRLF.CRLF as end of data, and reject or normalise bare CR and bare LF on input and output.\n(2) Test every MTA pair in the path against each other's handling of non-standard line endings and include the test in release checks.\n(3) Close the session, rather than accepting the data, when the end-of-data sequence is ambiguous, and log the peer for follow-up.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·J", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·J", "mitigation_principle": "Both ends of every SMTP hop agree on where a message ends.", "design_measures": [ "Accept only CRLF.CRLF as end of data, and reject or normalise bare CR and bare LF on input and output.", "Test every MTA pair in the path against each other's handling of non-standard line endings and include the test in release checks.", "Close the session, rather than accepting the data, when the end-of-data sequence is ambiguous, and log the peer for follow-up." ] } } }, { "type": "relationship", "id": "relationship--46138bbd-c3be-5639-95b8-2712864095a1", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e567537c-9c40-5c54-8eb1-5de41bbe6439", "target_ref": "attack-pattern--e567537c-9c40-5c54-8eb1-5de41bbe6439" }, { "type": "attack-pattern", "id": "attack-pattern--c3f74fbd-a087-5ebe-a3ff-f96e2730f810", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Recipient Enumeration", "description": "Recipient responses, their timing or later bounces reveal which addresses exist, so an attacker can harvest a tenant's directory.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·10", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-10" }, { "source_name": "capec", "external_id": "CAPEC-575", "url": "https://capec.mitre.org/data/definitions/575.html", "description": "Account Footprinting" }, { "source_name": "cwe", "external_id": "CWE-204", "url": "https://cwe.mitre.org/data/definitions/204.html", "description": "Observable Response Discrepancy" }, { "source_name": "cwe", "external_id": "CWE-208", "url": "https://cwe.mitre.org/data/definitions/208.html", "description": "Observable Timing Discrepancy" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "smtp" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·10", "group_code": "SM", "group_name": "SMTP", "stride": [ "I" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-575" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-204", "CWE-208" ] } } }, { "type": "course-of-action", "id": "course-of-action--c3f74fbd-a087-5ebe-a3ff-f96e2730f810", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for SM·10 Recipient Enumeration", "description": "Invalid recipients are refused in session, uniformly, and probing is rate-limited.\n\n(1) Reject unknown recipients at RCPT TO with the same response and timing as valid-but-throttled ones.\n(2) Disable VRFY and EXPN and rate-limit RCPT failures per connecting IP and per sender.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·10", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·10", "mitigation_principle": "Invalid recipients are refused in session, uniformly, and probing is rate-limited.", "design_measures": [ "Reject unknown recipients at RCPT TO with the same response and timing as valid-but-throttled ones.", "Disable VRFY and EXPN and rate-limit RCPT failures per connecting IP and per sender." ] } } }, { "type": "relationship", "id": "relationship--40c6e06d-637f-5a83-9993-3dac6050244e", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c3f74fbd-a087-5ebe-a3ff-f96e2730f810", "target_ref": "attack-pattern--c3f74fbd-a087-5ebe-a3ff-f96e2730f810" }, { "type": "attack-pattern", "id": "attack-pattern--9316c996-b21b-54bf-ba59-baa563cf4ccb", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Command and Header Injection", "description": "A metacharacter in an address, domain or field reaches a component that composes SMTP commands, message headers or the platform's own Authentication-Results, and is read as structure rather than data.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·9", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-9" }, { "source_name": "capec", "external_id": "CAPEC-134", "url": "https://capec.mitre.org/data/definitions/134.html", "description": "Email Injection" }, { "source_name": "capec", "external_id": "CAPEC-41", "url": "https://capec.mitre.org/data/definitions/41.html", "description": "Using Meta-characters in E-mail Headers to Inject Malicious Payloads" }, { "source_name": "capec", "external_id": "CAPEC-183", "url": "https://capec.mitre.org/data/definitions/183.html", "description": "IMAP/SMTP Command Injection" }, { "source_name": "cwe", "external_id": "CWE-93", "url": "https://cwe.mitre.org/data/definitions/93.html", "description": "Improper Neutralization of CRLF Sequences ('CRLF Injection')" }, { "source_name": "cwe", "external_id": "CWE-116", "url": "https://cwe.mitre.org/data/definitions/116.html", "description": "Improper Encoding or Escaping of Output" }, { "source_name": "cwe", "external_id": "CWE-77", "url": "https://cwe.mitre.org/data/definitions/77.html", "description": "Improper Neutralization of Special Elements used in a Command ('Command Injection')" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "smtp" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·9", "group_code": "SM", "group_name": "SMTP", "stride": [ "T" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-134", "CAPEC-41", "CAPEC-183" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-93", "CWE-116", "CWE-77" ] } } }, { "type": "course-of-action", "id": "course-of-action--9316c996-b21b-54bf-ba59-baa563cf4ccb", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for SM·9 Command and Header Injection", "description": "No input can change the structure of a command, header or result the platform composes.\n\n(1) Reject CR, LF, parentheses, quotes and other delimiter characters in every address, domain, subject and custom header value at the boundary where it enters the platform.\n(2) Compose messages, commands and Authentication-Results with a library that encodes values as data, forbid string concatenation in code review and linting, and have the DMARC evaluator read results from a typed internal record rather than by re-parsing the header.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·9", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·9", "mitigation_principle": "No input can change the structure of a command, header or result the platform composes.", "design_measures": [ "Reject CR, LF, parentheses, quotes and other delimiter characters in every address, domain, subject and custom header value at the boundary where it enters the platform.", "Compose messages, commands and Authentication-Results with a library that encodes values as data, forbid string concatenation in code review and linting, and have the DMARC evaluator read results from a typed internal record rather than by re-parsing the header." ] } } }, { "type": "relationship", "id": "relationship--14cd716d-ae7c-568d-bc5d-30490b335e1b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9316c996-b21b-54bf-ba59-baa563cf4ccb", "target_ref": "attack-pattern--9316c996-b21b-54bf-ba59-baa563cf4ccb" }, { "type": "attack-pattern", "id": "attack-pattern--a47fc492-398f-5fc4-a655-3da83049fd9a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Shared Reputation Poisoning", "description": "One tenant's abuse burns the shared IP addresses and domains every tenant sends from.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·8", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-8" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "smtp" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·8", "group_code": "SM", "group_name": "SMTP", "stride": [ "D" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-653" ] } } }, { "type": "course-of-action", "id": "course-of-action--a47fc492-398f-5fc4-a655-3da83049fd9a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for SM·8 Shared Reputation Poisoning", "description": "Outbound reputation is segmented so one tenant's abuse cannot burn another's.\n\n(1) Start new and unverified tenants on a separate IP pool, and promote them to shared pools only after a clean sending history.\n(2) Detect abusive sending within minutes (bounce rate, complaint rate, volume spikes) and move the tenant to an isolated pool automatically.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·8", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·8", "mitigation_principle": "Outbound reputation is segmented so one tenant's abuse cannot burn another's.", "design_measures": [ "Start new and unverified tenants on a separate IP pool, and promote them to shared pools only after a clean sending history.", "Detect abusive sending within minutes (bounce rate, complaint rate, volume spikes) and move the tenant to an isolated pool automatically." ] } } }, { "type": "relationship", "id": "relationship--c8b4610c-74f8-5474-a4a0-0bcea4797d6b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a47fc492-398f-5fc4-a655-3da83049fd9a", "target_ref": "attack-pattern--a47fc492-398f-5fc4-a655-3da83049fd9a" }, { "type": "attack-pattern", "id": "attack-pattern--dfe15c7d-7051-5162-a768-7267cb7af76e", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Submission Identity Mismatch", "description": "An authenticated submitter can send with a From or envelope sender that is not theirs.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·7", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-7" }, { "source_name": "capec", "external_id": "CAPEC-195", "url": "https://capec.mitre.org/data/definitions/195.html", "description": "Principal Spoof" }, { "source_name": "cwe", "external_id": "CWE-862", "url": "https://cwe.mitre.org/data/definitions/862.html", "description": "Missing Authorization" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "smtp" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·7", "group_code": "SM", "group_name": "SMTP", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-195" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-862" ] } } }, { "type": "course-of-action", "id": "course-of-action--dfe15c7d-7051-5162-a768-7267cb7af76e", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for SM·7 Submission Identity Mismatch", "description": "A submitted identity is checked against what the authenticated user may use.\n\n(1) Verify that From and envelope sender match the authenticated user's own addresses or an explicitly granted send-as right.\n(2) Record send-as and send-on-behalf grants as auditable permissions and show them to the mailbox owner.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·7", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·7", "mitigation_principle": "A submitted identity is checked against what the authenticated user may use.", "design_measures": [ "Verify that From and envelope sender match the authenticated user's own addresses or an explicitly granted send-as right.", "Record send-as and send-on-behalf grants as auditable permissions and show them to the mailbox owner." ] } } }, { "type": "relationship", "id": "relationship--e6efb83d-2424-53f5-b71f-2db7cc52de7b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--dfe15c7d-7051-5162-a768-7267cb7af76e", "target_ref": "attack-pattern--dfe15c7d-7051-5162-a768-7267cb7af76e" }, { "type": "attack-pattern", "id": "attack-pattern--d22f4ad3-121d-5ac1-9581-e38b1f4d782d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Resource Exhaustion", "description": "Connection floods, slow senders, queue filling and mail bombing degrade or stop delivery.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·6", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-6" }, { "source_name": "capec", "external_id": "CAPEC-125", "url": "https://capec.mitre.org/data/definitions/125.html", "description": "Flooding" }, { "source_name": "capec", "external_id": "CAPEC-227", "url": "https://capec.mitre.org/data/definitions/227.html", "description": "Sustained Client Engagement" }, { "source_name": "capec", "external_id": "CAPEC-130", "url": "https://capec.mitre.org/data/definitions/130.html", "description": "Excessive Allocation" }, { "source_name": "cwe", "external_id": "CWE-770", "url": "https://cwe.mitre.org/data/definitions/770.html", "description": "Allocation of Resources Without Limits or Throttling" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "smtp" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·6", "group_code": "SM", "group_name": "SMTP", "stride": [ "D" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-125", "CAPEC-227", "CAPEC-130" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-770" ] } } }, { "type": "course-of-action", "id": "course-of-action--d22f4ad3-121d-5ac1-9581-e38b1f4d782d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for SM·6 Resource Exhaustion", "description": "Resources are limited per peer, per sender and per tenant so that volume against one cannot stop delivery for all.\n\n(1) Set connection, rate and queue limits per connecting IP, per sender domain and per recipient, with separate tenant queue capacity.\n(2) Detect mail bombing by recipient-level volume anomalies and divert the excess to a holding queue rather than the inbox.\n(3) Keep a separate, protected ingress path for mail from known-good senders and for tenant-critical flows (authentication codes, alerts) so that a flood cannot delay them.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·6", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·6", "mitigation_principle": "Resources are limited per peer, per sender and per tenant so that volume against one cannot stop delivery for all.", "design_measures": [ "Set connection, rate and queue limits per connecting IP, per sender domain and per recipient, with separate tenant queue capacity.", "Detect mail bombing by recipient-level volume anomalies and divert the excess to a holding queue rather than the inbox.", "Keep a separate, protected ingress path for mail from known-good senders and for tenant-critical flows (authentication codes, alerts) so that a flood cannot delay them." ] } } }, { "type": "relationship", "id": "relationship--ca7c16ee-ad79-5557-910b-ff49ae3a6230", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d22f4ad3-121d-5ac1-9581-e38b1f4d782d", "target_ref": "attack-pattern--d22f4ad3-121d-5ac1-9581-e38b1f4d782d" }, { "type": "attack-pattern", "id": "attack-pattern--904f3a82-6d74-5a8d-a8d7-f03483612385", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Trace Forgery", "description": "Received headers are forged or stripped while platform decisions or forensics rely on them.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·5", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-5" }, { "source_name": "capec", "external_id": "CAPEC-93", "url": "https://capec.mitre.org/data/definitions/93.html", "description": "Log Injection-Tampering-Forging" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-349", "url": "https://cwe.mitre.org/data/definitions/349.html", "description": "Acceptance of Extraneous Untrusted Data With Trusted Data" }, { "source_name": "cwe", "external_id": "CWE-807", "url": "https://cwe.mitre.org/data/definitions/807.html", "description": "Reliance on Untrusted Inputs in a Security Decision" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "smtp" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·5", "group_code": "SM", "group_name": "SMTP", "stride": [ "R", "T" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-93", "CAPEC-194" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-349", "CWE-807" ] } } }, { "type": "course-of-action", "id": "course-of-action--904f3a82-6d74-5a8d-a8d7-f03483612385", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for SM·5 Trace Forgery", "description": "Only trace records the platform wrote are used for decisions, and the boundary is unambiguous.\n\n(1) Mark the platform's own Received headers with a verifiable token and ignore any trace header below the first one the platform wrote.\n(2) Keep the platform's routing and forensic records in its own logs, keyed to the message, not in the message.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·5", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·5", "mitigation_principle": "Only trace records the platform wrote are used for decisions, and the boundary is unambiguous.", "design_measures": [ "Mark the platform's own Received headers with a verifiable token and ignore any trace header below the first one the platform wrote.", "Keep the platform's routing and forensic records in its own logs, keyed to the message, not in the message." ] } } }, { "type": "relationship", "id": "relationship--8d6fca35-7fd8-570a-924b-e6eb58756e6d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--904f3a82-6d74-5a8d-a8d7-f03483612385", "target_ref": "attack-pattern--904f3a82-6d74-5a8d-a8d7-f03483612385" }, { "type": "attack-pattern", "id": "attack-pattern--d86e9f26-a89e-55cf-bc98-8179f2e37f85", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Extension Differential", "description": "Hops handle extensions (pipelining, chunking, SMTPUTF8, 8BITMIME) inconsistently, creating exploitable disagreement.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·4", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-4" }, { "source_name": "capec", "external_id": "CAPEC-43", "url": "https://capec.mitre.org/data/definitions/43.html", "description": "Exploiting Multiple Input Interpretation Layers" }, { "source_name": "cwe", "external_id": "CWE-437", "url": "https://cwe.mitre.org/data/definitions/437.html", "description": "Incomplete Model of Endpoint Features" }, { "source_name": "cwe", "external_id": "CWE-436", "url": "https://cwe.mitre.org/data/definitions/436.html", "description": "Interpretation Conflict" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "smtp" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·4", "group_code": "SM", "group_name": "SMTP", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-43" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-437", "CWE-436" ] } } }, { "type": "course-of-action", "id": "course-of-action--d86e9f26-a89e-55cf-bc98-8179f2e37f85", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for SM·4 Extension Differential", "description": "Every control handles every advertised extension, or the extension is not advertised.\n\n(1) Apply the same content hooks to BDAT (CHUNKING) as to DATA, and test each scanner against both paths.\n(2) Convert or reject messages that use an extension the next hop does not support rather than passing them through unchanged.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·4", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·4", "mitigation_principle": "Every control handles every advertised extension, or the extension is not advertised.", "design_measures": [ "Apply the same content hooks to BDAT (CHUNKING) as to DATA, and test each scanner against both paths.", "Convert or reject messages that use an extension the next hop does not support rather than passing them through unchanged." ] } } }, { "type": "relationship", "id": "relationship--f59cfbd1-a61a-5e2a-9ee7-4ef871ba4708", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d86e9f26-a89e-55cf-bc98-8179f2e37f85", "target_ref": "attack-pattern--d86e9f26-a89e-55cf-bc98-8179f2e37f85" }, { "type": "attack-pattern", "id": "attack-pattern--d9cd1a79-40a1-53e1-aa13-28d708204798", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Address Parsing Differential", "description": "Quoted local parts, comments, aliases and rewriting make an address route differently from how it was validated.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·3", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-3" }, { "source_name": "capec", "external_id": "CAPEC-43", "url": "https://capec.mitre.org/data/definitions/43.html", "description": "Exploiting Multiple Input Interpretation Layers" }, { "source_name": "cwe", "external_id": "CWE-436", "url": "https://cwe.mitre.org/data/definitions/436.html", "description": "Interpretation Conflict" }, { "source_name": "cwe", "external_id": "CWE-179", "url": "https://cwe.mitre.org/data/definitions/179.html", "description": "Incorrect Behavior Order: Early Validation" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "smtp" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·3", "group_code": "SM", "group_name": "SMTP", "stride": [ "T", "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-43" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-436", "CWE-179" ] } } }, { "type": "course-of-action", "id": "course-of-action--d9cd1a79-40a1-53e1-aa13-28d708204798", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for SM·3 Address Parsing Differential", "description": "One parser validates, routes and displays addresses, and rewriting is re-checked.\n\n(1) Use a single address-parsing library across validation, routing and display, with a shared test corpus of quoted local parts, comments and non-ASCII addresses.\n(2) Re-apply recipient policy after alias expansion, sub-address stripping and rewriting, using the final mailbox identity.\n(3) Reject addresses that use syntax the platform has no business accepting (comments, quoted local parts with control characters, source routes) at the first hop.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·3", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·3", "mitigation_principle": "One parser validates, routes and displays addresses, and rewriting is re-checked.", "design_measures": [ "Use a single address-parsing library across validation, routing and display, with a shared test corpus of quoted local parts, comments and non-ASCII addresses.", "Re-apply recipient policy after alias expansion, sub-address stripping and rewriting, using the final mailbox identity.", "Reject addresses that use syntax the platform has no business accepting (comments, quoted local parts with control characters, source routes) at the first hop." ] } } }, { "type": "relationship", "id": "relationship--ebac7568-d08c-5c9d-9421-6bcce05032c9", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d9cd1a79-40a1-53e1-aa13-28d708204798", "target_ref": "attack-pattern--d9cd1a79-40a1-53e1-aa13-28d708204798" }, { "type": "attack-pattern", "id": "attack-pattern--599a0bfd-654d-5c6e-86ab-4f425421c222", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Backscatter Reflection", "description": "A bounce or auto-reply for a message with a forged envelope sender goes to the victim named in it, so the platform delivers attacker content under its own good reputation.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·2", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-2" }, { "source_name": "capec", "external_id": "CAPEC-490", "url": "https://capec.mitre.org/data/definitions/490.html", "description": "Amplification" }, { "source_name": "cwe", "external_id": "CWE-441", "url": "https://cwe.mitre.org/data/definitions/441.html", "description": "Unintended Proxy or Intermediary ('Confused Deputy')" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "smtp" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·2", "group_code": "SM", "group_name": "SMTP", "stride": [ "D", "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-490" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-441" ] } } }, { "type": "course-of-action", "id": "course-of-action--599a0bfd-654d-5c6e-86ab-4f425421c222", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for SM·2 Backscatter Reflection", "description": "The platform never sends mail to an identity it has not verified, and bounces are mail.\n\n(1) Reject in session so that no bounce is needed; where a later bounce is unavoidable, send it only when the envelope sender passed SPF or DKIM, and omit the original content.\n(2) Cap bounces and auto-replies per destination domain and suppress them entirely for mail that failed authentication.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM·2", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "SM·2", "mitigation_principle": "The platform never sends mail to an identity it has not verified, and bounces are mail.", "design_measures": [ "Reject in session so that no bounce is needed; where a later bounce is unavoidable, send it only when the envelope sender passed SPF or DKIM, and omit the original content.", "Cap bounces and auto-replies per destination domain and suppress them entirely for mail that failed authentication." ] } } }, { "type": "relationship", "id": "relationship--87c478d2-1cba-580c-8d4e-230a95c99ae9", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--599a0bfd-654d-5c6e-86ab-4f425421c222", "target_ref": "attack-pattern--599a0bfd-654d-5c6e-86ab-4f425421c222" }, { "type": "grouping", "id": "grouping--90249931-ac6e-5f3e-a370-618500fe4eab", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Layer 04: SMTP (SM)", "description": "SMTP accepts whatever identity a peer asserts and secures each hop only if both ends insist. These entries cover the MTA-to-MTA conversation: identity, relay, transport security and parsing. Scope: The MTA-to-MTA conversation: identity, relay, transport security, parsing.", "context": "unspecified", "object_refs": [ "attack-pattern--95ca91b5-f655-5c5b-91e8-cd3d43b9e6fe", "course-of-action--95ca91b5-f655-5c5b-91e8-cd3d43b9e6fe", "attack-pattern--26d81274-531e-57d1-b4fc-112053b3cce7", "course-of-action--26d81274-531e-57d1-b4fc-112053b3cce7", "attack-pattern--1b566b63-b337-5b9e-893e-2f73ef30b236", "course-of-action--1b566b63-b337-5b9e-893e-2f73ef30b236", "attack-pattern--e567537c-9c40-5c54-8eb1-5de41bbe6439", "course-of-action--e567537c-9c40-5c54-8eb1-5de41bbe6439", "attack-pattern--c3f74fbd-a087-5ebe-a3ff-f96e2730f810", "course-of-action--c3f74fbd-a087-5ebe-a3ff-f96e2730f810", "attack-pattern--9316c996-b21b-54bf-ba59-baa563cf4ccb", "course-of-action--9316c996-b21b-54bf-ba59-baa563cf4ccb", "attack-pattern--a47fc492-398f-5fc4-a655-3da83049fd9a", "course-of-action--a47fc492-398f-5fc4-a655-3da83049fd9a", "attack-pattern--dfe15c7d-7051-5162-a768-7267cb7af76e", "course-of-action--dfe15c7d-7051-5162-a768-7267cb7af76e", "attack-pattern--d22f4ad3-121d-5ac1-9581-e38b1f4d782d", "course-of-action--d22f4ad3-121d-5ac1-9581-e38b1f4d782d", "attack-pattern--904f3a82-6d74-5a8d-a8d7-f03483612385", "course-of-action--904f3a82-6d74-5a8d-a8d7-f03483612385", "attack-pattern--d86e9f26-a89e-55cf-bc98-8179f2e37f85", "course-of-action--d86e9f26-a89e-55cf-bc98-8179f2e37f85", "attack-pattern--d9cd1a79-40a1-53e1-aa13-28d708204798", "course-of-action--d9cd1a79-40a1-53e1-aa13-28d708204798", "attack-pattern--599a0bfd-654d-5c6e-86ab-4f425421c222", "course-of-action--599a0bfd-654d-5c6e-86ab-4f425421c222" ], "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "SM", "url": "https://ostering.com/taxonomies/email-infrastructure/smtp/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--3078614a-d470-5c95-a3c8-ab108fb4d7c2", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Structure Differential", "description": "Malformed boundaries or nesting make the scanner and the client see different body structures.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·A", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-a" }, { "source_name": "capec", "external_id": "CAPEC-43", "url": "https://capec.mitre.org/data/definitions/43.html", "description": "Exploiting Multiple Input Interpretation Layers" }, { "source_name": "cwe", "external_id": "CWE-436", "url": "https://cwe.mitre.org/data/definitions/436.html", "description": "Interpretation Conflict" }, { "source_name": "cwe", "external_id": "CWE-437", "url": "https://cwe.mitre.org/data/definitions/437.html", "description": "Incomplete Model of Endpoint Features" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "mime-and-s-mime" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·A", "group_code": "MI", "group_name": "MIME and S/MIME", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-43" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-436", "CWE-437" ] } } }, { "type": "course-of-action", "id": "course-of-action--3078614a-d470-5c95-a3c8-ab108fb4d7c2", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for MI·A Structure Differential", "description": "The structure the scanner inspects is the structure the client renders.\n\n(1) Parse once at ingress into a canonical MIME tree, reject messages that parse ambiguously, and deliver the canonical form.\n(2) Run differential tests between the scanner's parser and each supported client's parser on a corpus of malformed messages.\n(3) Deliver to the client a message the platform has re-serialised from its canonical tree, so the client never sees the bytes the scanner did not.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·A", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·A", "mitigation_principle": "The structure the scanner inspects is the structure the client renders.", "design_measures": [ "Parse once at ingress into a canonical MIME tree, reject messages that parse ambiguously, and deliver the canonical form.", "Run differential tests between the scanner's parser and each supported client's parser on a corpus of malformed messages.", "Deliver to the client a message the platform has re-serialised from its canonical tree, so the client never sees the bytes the scanner did not." ] } } }, { "type": "relationship", "id": "relationship--cf83dbba-2135-52ec-a2d3-7c4763482ed3", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3078614a-d470-5c95-a3c8-ab108fb4d7c2", "target_ref": "attack-pattern--3078614a-d470-5c95-a3c8-ab108fb4d7c2" }, { "type": "attack-pattern", "id": "attack-pattern--a281bdfa-5da6-5857-9c5b-fc93ec68360c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Encoding Abuse", "description": "Encoded-words, charset tricks and transfer-encoding quirks disguise content from inspection.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·K", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-k" }, { "source_name": "capec", "external_id": "CAPEC-267", "url": "https://capec.mitre.org/data/definitions/267.html", "description": "Leverage Alternate Encoding" }, { "source_name": "capec", "external_id": "CAPEC-120", "url": "https://capec.mitre.org/data/definitions/120.html", "description": "Double Encoding" }, { "source_name": "capec", "external_id": "CAPEC-71", "url": "https://capec.mitre.org/data/definitions/71.html", "description": "Using Unicode Encoding to Bypass Validation Logic" }, { "source_name": "capec", "external_id": "CAPEC-80", "url": "https://capec.mitre.org/data/definitions/80.html", "description": "Using UTF-8 Encoding to Bypass Validation Logic" }, { "source_name": "cwe", "external_id": "CWE-173", "url": "https://cwe.mitre.org/data/definitions/173.html", "description": "Improper Handling of Alternate Encoding" }, { "source_name": "cwe", "external_id": "CWE-180", "url": "https://cwe.mitre.org/data/definitions/180.html", "description": "Incorrect Behavior Order: Validate Before Canonicalize" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "mime-and-s-mime" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·K", "group_code": "MI", "group_name": "MIME and S/MIME", "stride": [ "T" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-267", "CAPEC-120", "CAPEC-71", "CAPEC-80" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-173", "CWE-180" ] } } }, { "type": "course-of-action", "id": "course-of-action--a281bdfa-5da6-5857-9c5b-fc93ec68360c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for MI·K Encoding Abuse", "description": "Content is decoded to a canonical form before inspection, in the same way the client decodes it.\n\n(1) Fully decode transfer encodings and encoded-words before every inspection, and treat undecodable content as unscanned.\n(2) Normalise charsets to UTF-8 and reject or flag nested, invalid or conflicting encodings.\n(3) Decode in a sandboxed worker with limits on size, depth and time, and treat hitting a limit as a verdict in its own right (see Nesting and Decompression Exhaustion).", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·K", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·K", "mitigation_principle": "Content is decoded to a canonical form before inspection, in the same way the client decodes it.", "design_measures": [ "Fully decode transfer encodings and encoded-words before every inspection, and treat undecodable content as unscanned.", "Normalise charsets to UTF-8 and reject or flag nested, invalid or conflicting encodings.", "Decode in a sandboxed worker with limits on size, depth and time, and treat hitting a limit as a verdict in its own right (see Nesting and Decompression Exhaustion)." ] } } }, { "type": "relationship", "id": "relationship--7376b44a-5ca6-5218-98f2-d3e57cffb26e", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a281bdfa-5da6-5857-9c5b-fc93ec68360c", "target_ref": "attack-pattern--a281bdfa-5da6-5857-9c5b-fc93ec68360c" }, { "type": "attack-pattern", "id": "attack-pattern--e9c282aa-9f03-55b9-8ad3-20c3c8f3fd95", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Content-Type Confusion", "description": "The declared type differs from the actual type, or a file is valid as several types at once.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-q" }, { "source_name": "capec", "external_id": "CAPEC-209", "url": "https://capec.mitre.org/data/definitions/209.html", "description": "XSS Using MIME Type Mismatch" }, { "source_name": "capec", "external_id": "CAPEC-636", "url": "https://capec.mitre.org/data/definitions/636.html", "description": "Hiding Malicious Data or Code within Files" }, { "source_name": "cwe", "external_id": "CWE-430", "url": "https://cwe.mitre.org/data/definitions/430.html", "description": "Deployment of Wrong Handler" }, { "source_name": "cwe", "external_id": "CWE-646", "url": "https://cwe.mitre.org/data/definitions/646.html", "description": "Reliance on File Name or Extension of Externally-Supplied File" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "mime-and-s-mime" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·Q", "group_code": "MI", "group_name": "MIME and S/MIME", "stride": [ "T" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-209", "CAPEC-636" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-430", "CWE-646" ] } } }, { "type": "course-of-action", "id": "course-of-action--e9c282aa-9f03-55b9-8ad3-20c3c8f3fd95", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for MI·Q Content-Type Confusion", "description": "A file's type is determined by its content, and all components agree on it.\n\n(1) Sniff the actual type of every attachment and scan by that type regardless of declaration or extension.\n(2) Block or rename attachments whose declared, extension and sniffed types disagree, and render previews only by sniffed type.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·Q", "mitigation_principle": "A file's type is determined by its content, and all components agree on it.", "design_measures": [ "Sniff the actual type of every attachment and scan by that type regardless of declaration or extension.", "Block or rename attachments whose declared, extension and sniffed types disagree, and render previews only by sniffed type." ] } } }, { "type": "relationship", "id": "relationship--c8f616b5-9647-5034-9fdb-8d49e85583d7", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e9c282aa-9f03-55b9-8ad3-20c3c8f3fd95", "target_ref": "attack-pattern--e9c282aa-9f03-55b9-8ad3-20c3c8f3fd95" }, { "type": "attack-pattern", "id": "attack-pattern--b6dd6509-37fb-5e16-bb49-4ce2b573f188", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Active and Remote Content", "description": "HTML and CSS track, exfiltrate or fetch content the platform never inspected.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·J", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-j" }, { "source_name": "cwe", "external_id": "CWE-79", "url": "https://cwe.mitre.org/data/definitions/79.html", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, { "source_name": "cwe", "external_id": "CWE-829", "url": "https://cwe.mitre.org/data/definitions/829.html", "description": "Inclusion of Functionality from Untrusted Control Sphere" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "mime-and-s-mime" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·J", "group_code": "MI", "group_name": "MIME and S/MIME", "stride": [ "I", "E" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-79", "CWE-829" ] } } }, { "type": "course-of-action", "id": "course-of-action--b6dd6509-37fb-5e16-bb49-4ce2b573f188", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for MI·J Active and Remote Content", "description": "No content in a message can cause a fetch or execute code without the recipient's decision.\n\n(1) Sanitise HTML with an allow list that removes scripts, forms, external CSS and conditional comments.\n(2) Block remote content by default and, when loaded, fetch it through a proxy that re-scans it and strips tracking parameters.\n(3) Render HTML in the client inside an isolated frame with no script, no form submission and a content security policy that permits only proxied images.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·J", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·J", "mitigation_principle": "No content in a message can cause a fetch or execute code without the recipient's decision.", "design_measures": [ "Sanitise HTML with an allow list that removes scripts, forms, external CSS and conditional comments.", "Block remote content by default and, when loaded, fetch it through a proxy that re-scans it and strips tracking parameters.", "Render HTML in the client inside an isolated frame with no script, no form submission and a content security policy that permits only proxied images." ] } } }, { "type": "relationship", "id": "relationship--21e85ce7-4cc1-520f-a583-577568a92238", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b6dd6509-37fb-5e16-bb49-4ce2b573f188", "target_ref": "attack-pattern--b6dd6509-37fb-5e16-bb49-4ce2b573f188" }, { "type": "attack-pattern", "id": "attack-pattern--917ec9ab-727d-5721-9ad9-15e4b54e74e5", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Signature Stripping and Wrapping", "description": "A signature is removed, or made to appear to cover content it does not.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·10", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-10" }, { "source_name": "capec", "external_id": "CAPEC-477", "url": "https://capec.mitre.org/data/definitions/477.html", "description": "Signature Spoofing by Mixing Signed and Unsigned Content" }, { "source_name": "cwe", "external_id": "CWE-349", "url": "https://cwe.mitre.org/data/definitions/349.html", "description": "Acceptance of Extraneous Untrusted Data With Trusted Data" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "mime-and-s-mime" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·10", "group_code": "MI", "group_name": "MIME and S/MIME", "stride": [ "S", "T" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-477" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-349", "CWE-451" ] } } }, { "type": "course-of-action", "id": "course-of-action--917ec9ab-727d-5721-9ad9-15e4b54e74e5", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for MI·10 Signature Stripping and Wrapping", "description": "The interface shows exactly what a signature covers and nothing more.\n\n(1) Display a signature indicator per signed part, never for the whole message, and mark unsigned parts visibly.\n(2) Refuse to render signed and unsigned parts as one continuous body.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·10", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·10", "mitigation_principle": "The interface shows exactly what a signature covers and nothing more.", "design_measures": [ "Display a signature indicator per signed part, never for the whole message, and mark unsigned parts visibly.", "Refuse to render signed and unsigned parts as one continuous body." ] } } }, { "type": "relationship", "id": "relationship--ce358796-4ea5-5947-9dc7-34ea68e99c7f", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--917ec9ab-727d-5721-9ad9-15e4b54e74e5", "target_ref": "attack-pattern--917ec9ab-727d-5721-9ad9-15e4b54e74e5" }, { "type": "attack-pattern", "id": "attack-pattern--0427756d-bc33-5606-9d82-5fd5f87a5ebe", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Encryption as Blindfold and Oracle", "description": "Encrypted content blinds the scanner, and malleable ciphertext leaks plaintext through the client.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·9", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-9" }, { "source_name": "capec", "external_id": "CAPEC-463", "url": "https://capec.mitre.org/data/definitions/463.html", "description": "Padding Oracle Crypto Attack" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely ('Failing Open')" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "mime-and-s-mime" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·9", "group_code": "MI", "group_name": "MIME and S/MIME", "stride": [ "I" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-463" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-353", "CWE-636" ] } } }, { "type": "course-of-action", "id": "course-of-action--0427756d-bc33-5606-9d82-5fd5f87a5ebe", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for MI·9 Encryption as Blindfold and Oracle", "description": "Content the platform cannot inspect is handled by explicit policy, and clients reject malleable ciphertext.\n\n(1) Hold or flag encrypted mail the platform cannot decrypt, with the choice set per tenant and defaulting to a visible warning.\n(2) Require authenticated encryption, refuse to render modified ciphertext, and never load remote content from decrypted parts.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·9", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·9", "mitigation_principle": "Content the platform cannot inspect is handled by explicit policy, and clients reject malleable ciphertext.", "design_measures": [ "Hold or flag encrypted mail the platform cannot decrypt, with the choice set per tenant and defaulting to a visible warning.", "Require authenticated encryption, refuse to render modified ciphertext, and never load remote content from decrypted parts." ] } } }, { "type": "relationship", "id": "relationship--c6dff3bd-b631-5c98-bbd8-9643866e600d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0427756d-bc33-5606-9d82-5fd5f87a5ebe", "target_ref": "attack-pattern--0427756d-bc33-5606-9d82-5fd5f87a5ebe" }, { "type": "attack-pattern", "id": "attack-pattern--a90923fb-3356-58b5-a707-25373b87da7f", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Header Differential", "description": "Duplicate, folded or malformed headers are read differently by different components.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·8", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-8" }, { "source_name": "capec", "external_id": "CAPEC-43", "url": "https://capec.mitre.org/data/definitions/43.html", "description": "Exploiting Multiple Input Interpretation Layers" }, { "source_name": "cwe", "external_id": "CWE-436", "url": "https://cwe.mitre.org/data/definitions/436.html", "description": "Interpretation Conflict" }, { "source_name": "cwe", "external_id": "CWE-235", "url": "https://cwe.mitre.org/data/definitions/235.html", "description": "Improper Handling of Extra Parameters" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "mime-and-s-mime" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·8", "group_code": "MI", "group_name": "MIME and S/MIME", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-43" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-436", "CWE-235" ] } } }, { "type": "course-of-action", "id": "course-of-action--a90923fb-3356-58b5-a707-25373b87da7f", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for MI·8 Header Differential", "description": "Every component reads the same header occurrence, and ambiguity is rejected.\n\n(1) Reject at ingress any message with duplicate single-instance headers (From, Subject, Date, Message-ID).\n(2) Normalise header folding and whitespace once at ingress and pass the normalised message to every later component.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·8", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·8", "mitigation_principle": "Every component reads the same header occurrence, and ambiguity is rejected.", "design_measures": [ "Reject at ingress any message with duplicate single-instance headers (From, Subject, Date, Message-ID).", "Normalise header folding and whitespace once at ingress and pass the normalised message to every later component." ] } } }, { "type": "relationship", "id": "relationship--f231128a-3a33-5999-ad3b-e932c1577ec8", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a90923fb-3356-58b5-a707-25373b87da7f", "target_ref": "attack-pattern--a90923fb-3356-58b5-a707-25373b87da7f" }, { "type": "attack-pattern", "id": "attack-pattern--458ff059-a783-5386-a77e-0c6b99ff2ba4", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Attachment Identity Deception", "description": "Filename continuations, right-to-left overrides and double extensions misrepresent what an attachment is.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·7", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-7" }, { "source_name": "capec", "external_id": "CAPEC-635", "url": "https://capec.mitre.org/data/definitions/635.html", "description": "Alternative Execution Due to Deceptive Filenames" }, { "source_name": "capec", "external_id": "CAPEC-649", "url": "https://capec.mitre.org/data/definitions/649.html", "description": "Adding a Space to a File Extension" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" }, { "source_name": "cwe", "external_id": "CWE-436", "url": "https://cwe.mitre.org/data/definitions/436.html", "description": "Interpretation Conflict" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "mime-and-s-mime" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·7", "group_code": "MI", "group_name": "MIME and S/MIME", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-635", "CAPEC-649" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-451", "CWE-436" ] } } }, { "type": "course-of-action", "id": "course-of-action--458ff059-a783-5386-a77e-0c6b99ff2ba4", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for MI·7 Attachment Identity Deception", "description": "The attachment name a user sees is the name every component used, and it cannot misrepresent the type.\n\n(1) Strip or visibly render bidirectional control characters and zero-width characters in filenames.\n(2) Use one filename resolution across scanner and client when parameters disagree, and show the sniffed type next to the name.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·7", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·7", "mitigation_principle": "The attachment name a user sees is the name every component used, and it cannot misrepresent the type.", "design_measures": [ "Strip or visibly render bidirectional control characters and zero-width characters in filenames.", "Use one filename resolution across scanner and client when parameters disagree, and show the sniffed type next to the name." ] } } }, { "type": "relationship", "id": "relationship--1397d602-7f42-5df8-a6ea-c7dc2a75217f", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--458ff059-a783-5386-a77e-0c6b99ff2ba4", "target_ref": "attack-pattern--458ff059-a783-5386-a77e-0c6b99ff2ba4" }, { "type": "attack-pattern", "id": "attack-pattern--3a075880-9cef-5094-81ec-b60185e96ba6", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Nesting and Decompression Exhaustion", "description": "Archive bombs and deeply nested messages exhaust the parser or push it past its limits.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·6", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-6" }, { "source_name": "capec", "external_id": "CAPEC-197", "url": "https://capec.mitre.org/data/definitions/197.html", "description": "Exponential Data Expansion" }, { "source_name": "capec", "external_id": "CAPEC-230", "url": "https://capec.mitre.org/data/definitions/230.html", "description": "Serialized Data with Nested Payloads" }, { "source_name": "cwe", "external_id": "CWE-409", "url": "https://cwe.mitre.org/data/definitions/409.html", "description": "Improper Handling of Highly Compressed Data (Data Amplification)" }, { "source_name": "cwe", "external_id": "CWE-674", "url": "https://cwe.mitre.org/data/definitions/674.html", "description": "Uncontrolled Recursion" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "mime-and-s-mime" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·6", "group_code": "MI", "group_name": "MIME and S/MIME", "stride": [ "D" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-197", "CAPEC-230" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-409", "CWE-674" ] } } }, { "type": "course-of-action", "id": "course-of-action--3a075880-9cef-5094-81ec-b60185e96ba6", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for MI·6 Nesting and Decompression Exhaustion", "description": "Decompression and nesting limits are enforced while expanding, and reaching one is a verdict.\n\n(1) Enforce depth, ratio and total-size limits during expansion, aborting the moment a limit is hit.\n(2) Treat a hit limit as UNSCANNED (see Fail-Open Scanning) and expand archives in an isolated, time-bounded process.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·6", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·6", "mitigation_principle": "Decompression and nesting limits are enforced while expanding, and reaching one is a verdict.", "design_measures": [ "Enforce depth, ratio and total-size limits during expansion, aborting the moment a limit is hit.", "Treat a hit limit as UNSCANNED (see Fail-Open Scanning) and expand archives in an isolated, time-bounded process." ] } } }, { "type": "relationship", "id": "relationship--86317eac-35b7-5589-9a49-3dff25e00b67", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3a075880-9cef-5094-81ec-b60185e96ba6", "target_ref": "attack-pattern--3a075880-9cef-5094-81ec-b60185e96ba6" }, { "type": "attack-pattern", "id": "attack-pattern--4bdd2720-1991-57ab-959a-cd10bd1c236e", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Embedded Format Blind Spots", "description": "Attached messages, TNEF, calendar items, partial and external-body parts carry content the scanner does not unpack.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·5", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-5" }, { "source_name": "capec", "external_id": "CAPEC-636", "url": "https://capec.mitre.org/data/definitions/636.html", "description": "Hiding Malicious Data or Code within Files" }, { "source_name": "cwe", "external_id": "CWE-437", "url": "https://cwe.mitre.org/data/definitions/437.html", "description": "Incomplete Model of Endpoint Features" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "mime-and-s-mime" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·5", "group_code": "MI", "group_name": "MIME and S/MIME", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-636" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-437" ] } } }, { "type": "course-of-action", "id": "course-of-action--4bdd2720-1991-57ab-959a-cd10bd1c236e", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for MI·5 Embedded Format Blind Spots", "description": "Every container format the client opens is a format the scanner unpacks.\n\n(1) Maintain one list of container formats (message/rfc822, TNEF, calendar, archives) shared by the scanners and the client, and test coverage against it.\n(2) Refuse message/partial and message/external-body, and inspect calendar fields (location, description, URL) as body content.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·5", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·5", "mitigation_principle": "Every container format the client opens is a format the scanner unpacks.", "design_measures": [ "Maintain one list of container formats (message/rfc822, TNEF, calendar, archives) shared by the scanners and the client, and test coverage against it.", "Refuse message/partial and message/external-body, and inspect calendar fields (location, description, URL) as body content." ] } } }, { "type": "relationship", "id": "relationship--d18b4321-9d68-568b-97ad-2b059c5575f9", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4bdd2720-1991-57ab-959a-cd10bd1c236e", "target_ref": "attack-pattern--4bdd2720-1991-57ab-959a-cd10bd1c236e" }, { "type": "attack-pattern", "id": "attack-pattern--eb4be419-72ab-52a8-a754-03e323bcc0d4", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Display Divergence", "description": "Text and HTML alternatives differ, or conditional styling changes what is shown in another client or after forwarding.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·4", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-4" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-437", "url": "https://cwe.mitre.org/data/definitions/437.html", "description": "Incomplete Model of Endpoint Features" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "mime-and-s-mime" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·4", "group_code": "MI", "group_name": "MIME and S/MIME", "stride": [ "S", "T" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-148" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-437", "CWE-451" ] } } }, { "type": "course-of-action", "id": "course-of-action--eb4be419-72ab-52a8-a754-03e323bcc0d4", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for MI·4 Display Divergence", "description": "Every alternative and every rendering variant is inspected.\n\n(1) Scan all MIME alternatives, not only the preferred one, and flag messages whose alternatives differ materially.\n(2) Strip CSS and markup that hides or reveals content conditionally (display:none, media queries, mso conditionals).", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·4", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·4", "mitigation_principle": "Every alternative and every rendering variant is inspected.", "design_measures": [ "Scan all MIME alternatives, not only the preferred one, and flag messages whose alternatives differ materially.", "Strip CSS and markup that hides or reveals content conditionally (display:none, media queries, mso conditionals)." ] } } }, { "type": "relationship", "id": "relationship--bda50f54-1ad2-5d47-82ac-f7325036aed9", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--eb4be419-72ab-52a8-a754-03e323bcc0d4", "target_ref": "attack-pattern--eb4be419-72ab-52a8-a754-03e323bcc0d4" }, { "type": "attack-pattern", "id": "attack-pattern--7b2793b2-84ea-591c-ab4e-fa7b2dd05b8f", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Parser Memory Safety", "description": "Complex untrusted formats are parsed in privileged processes such as scanners, converters and preview generators.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·3", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-3" }, { "source_name": "capec", "external_id": "CAPEC-100", "url": "https://capec.mitre.org/data/definitions/100.html", "description": "Overflow Buffers" }, { "source_name": "capec", "external_id": "CAPEC-28", "url": "https://capec.mitre.org/data/definitions/28.html", "description": "Fuzzing" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "cwe", "external_id": "CWE-250", "url": "https://cwe.mitre.org/data/definitions/250.html", "description": "Execution with Unnecessary Privileges" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "mime-and-s-mime" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·3", "group_code": "MI", "group_name": "MIME and S/MIME", "stride": [ "E", "T" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-100", "CAPEC-28" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-653", "CWE-250" ] } } }, { "type": "course-of-action", "id": "course-of-action--7b2793b2-84ea-591c-ab4e-fa7b2dd05b8f", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for MI·3 Parser Memory Safety", "description": "Untrusted content is parsed in an isolated process with no access to anything else.\n\n(1) Run parsers, converters and preview generators in sandboxed, network-less workers with no credentials and no access to other messages.\n(2) Prefer memory-safe parser implementations and automate parser library updates with a short deployment deadline.\n(3) Apply resource limits (CPU, memory, time, file descriptors) per parse and treat a limit hit as a verdict, not as a crash to retry.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·3", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·3", "mitigation_principle": "Untrusted content is parsed in an isolated process with no access to anything else.", "design_measures": [ "Run parsers, converters and preview generators in sandboxed, network-less workers with no credentials and no access to other messages.", "Prefer memory-safe parser implementations and automate parser library updates with a short deployment deadline.", "Apply resource limits (CPU, memory, time, file descriptors) per parse and treat a limit hit as a verdict, not as a crash to retry." ] } } }, { "type": "relationship", "id": "relationship--3341f322-2b1f-5b49-aa13-aa29d3b47296", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--7b2793b2-84ea-591c-ab4e-fa7b2dd05b8f", "target_ref": "attack-pattern--7b2793b2-84ea-591c-ab4e-fa7b2dd05b8f" }, { "type": "attack-pattern", "id": "attack-pattern--a14642b2-6faf-5f1b-a950-6b5b3cab1344", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Certificate and Key Handling", "description": "Certificates are accepted with mismatched addresses or unchecked revocation, or private keys are escrowed where a compromise exposes all mail.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·2", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-2" }, { "source_name": "capec", "external_id": "CAPEC-475", "url": "https://capec.mitre.org/data/definitions/475.html", "description": "Signature Spoofing by Improper Validation" }, { "source_name": "capec", "external_id": "CAPEC-474", "url": "https://capec.mitre.org/data/definitions/474.html", "description": "Signature Spoofing by Key Theft" }, { "source_name": "cwe", "external_id": "CWE-295", "url": "https://cwe.mitre.org/data/definitions/295.html", "description": "Improper Certificate Validation" }, { "source_name": "cwe", "external_id": "CWE-299", "url": "https://cwe.mitre.org/data/definitions/299.html", "description": "Improper Check for Certificate Revocation" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "mime-and-s-mime" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·2", "group_code": "MI", "group_name": "MIME and S/MIME", "stride": [ "S", "I" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-475", "CAPEC-474" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-295", "CWE-299", "CWE-653" ] } } }, { "type": "course-of-action", "id": "course-of-action--a14642b2-6faf-5f1b-a950-6b5b3cab1344", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for MI·2 Certificate and Key Handling", "description": "Certificates are validated against the sender shown, revocation is checked, and private keys are compartmentalised.\n\n(1) Match the certificate's email address to the displayed From, check revocation, and treat an unavailable revocation check as failure.\n(2) Hold private keys per tenant in an HSM or KMS with per-operation access control, never in a shared store beside the scanner.\n(3) Separate signature verification from decryption so that a verification failure is reported even when the message decrypts, and never show a verified mark for a message whose signature covers only part of it.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI·2", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "MI·2", "mitigation_principle": "Certificates are validated against the sender shown, revocation is checked, and private keys are compartmentalised.", "design_measures": [ "Match the certificate's email address to the displayed From, check revocation, and treat an unavailable revocation check as failure.", "Hold private keys per tenant in an HSM or KMS with per-operation access control, never in a shared store beside the scanner.", "Separate signature verification from decryption so that a verification failure is reported even when the message decrypts, and never show a verified mark for a message whose signature covers only part of it." ] } } }, { "type": "relationship", "id": "relationship--845ba9e0-ed6e-5b8e-9f3a-4fda6edf62cd", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a14642b2-6faf-5f1b-a950-6b5b3cab1344", "target_ref": "attack-pattern--a14642b2-6faf-5f1b-a950-6b5b3cab1344" }, { "type": "grouping", "id": "grouping--1a543e15-cc81-5677-b0c6-df64841ddad5", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Layer 05: MIME and S/MIME (MI)", "description": "Every component that handles a message should interpret it the same way, and most content attacks live where they do not. These entries cover how content is parsed, decoded, rendered, signed and encrypted. Scope: How content is parsed, decoded, rendered, signed and encrypted.", "context": "unspecified", "object_refs": [ "attack-pattern--3078614a-d470-5c95-a3c8-ab108fb4d7c2", "course-of-action--3078614a-d470-5c95-a3c8-ab108fb4d7c2", "attack-pattern--a281bdfa-5da6-5857-9c5b-fc93ec68360c", "course-of-action--a281bdfa-5da6-5857-9c5b-fc93ec68360c", "attack-pattern--e9c282aa-9f03-55b9-8ad3-20c3c8f3fd95", "course-of-action--e9c282aa-9f03-55b9-8ad3-20c3c8f3fd95", "attack-pattern--b6dd6509-37fb-5e16-bb49-4ce2b573f188", "course-of-action--b6dd6509-37fb-5e16-bb49-4ce2b573f188", "attack-pattern--917ec9ab-727d-5721-9ad9-15e4b54e74e5", "course-of-action--917ec9ab-727d-5721-9ad9-15e4b54e74e5", "attack-pattern--0427756d-bc33-5606-9d82-5fd5f87a5ebe", "course-of-action--0427756d-bc33-5606-9d82-5fd5f87a5ebe", "attack-pattern--a90923fb-3356-58b5-a707-25373b87da7f", "course-of-action--a90923fb-3356-58b5-a707-25373b87da7f", "attack-pattern--458ff059-a783-5386-a77e-0c6b99ff2ba4", "course-of-action--458ff059-a783-5386-a77e-0c6b99ff2ba4", "attack-pattern--3a075880-9cef-5094-81ec-b60185e96ba6", "course-of-action--3a075880-9cef-5094-81ec-b60185e96ba6", "attack-pattern--4bdd2720-1991-57ab-959a-cd10bd1c236e", "course-of-action--4bdd2720-1991-57ab-959a-cd10bd1c236e", "attack-pattern--eb4be419-72ab-52a8-a754-03e323bcc0d4", "course-of-action--eb4be419-72ab-52a8-a754-03e323bcc0d4", "attack-pattern--7b2793b2-84ea-591c-ab4e-fa7b2dd05b8f", "course-of-action--7b2793b2-84ea-591c-ab4e-fa7b2dd05b8f", "attack-pattern--a14642b2-6faf-5f1b-a950-6b5b3cab1344", "course-of-action--a14642b2-6faf-5f1b-a950-6b5b3cab1344" ], "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "MI", "url": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--5334007b-8e36-5f79-bf10-3ed78e88674b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "MX Redirection", "description": "Cache poisoning, DNS account hijack or route hijack sends mail for a domain to an attacker.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·A", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-a" }, { "source_name": "capec", "external_id": "CAPEC-142", "url": "https://capec.mitre.org/data/definitions/142.html", "description": "DNS Cache Poisoning" }, { "source_name": "capec", "external_id": "CAPEC-585", "url": "https://capec.mitre.org/data/definitions/585.html", "description": "DNS Domain Seizure" }, { "source_name": "capec", "external_id": "CAPEC-598", "url": "https://capec.mitre.org/data/definitions/598.html", "description": "DNS Spoofing" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "dns-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·A", "group_code": "DN", "group_name": "DNS layer", "stride": [ "S", "T" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-142", "CAPEC-585", "CAPEC-598" ], "cwe_match": "None" } } }, { "type": "course-of-action", "id": "course-of-action--5334007b-8e36-5f79-bf10-3ed78e88674b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DN·A MX Redirection", "description": "The platform notices when mail for a domain stops arriving at it, and protects its own records.\n\n(1) Monitor inbound volume per hosted domain and alert on an unexpected drop or an MX that no longer points at the platform.\n(2) Protect the platform's registrar and DNS accounts with hardware MFA, change alerts and registry lock.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·A", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·A", "mitigation_principle": "The platform notices when mail for a domain stops arriving at it, and protects its own records.", "design_measures": [ "Monitor inbound volume per hosted domain and alert on an unexpected drop or an MX that no longer points at the platform.", "Protect the platform's registrar and DNS accounts with hardware MFA, change alerts and registry lock." ] } } }, { "type": "relationship", "id": "relationship--a589c01f-34cb-5593-8995-44d7a3e06cb6", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5334007b-8e36-5f79-bf10-3ed78e88674b", "target_ref": "attack-pattern--5334007b-8e36-5f79-bf10-3ed78e88674b" }, { "type": "attack-pattern", "id": "attack-pattern--0efcb7eb-1002-586a-8a6a-a2248d706f42", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Dangling Mail Records", "description": "MX, delegated DKIM selectors or SPF includes point at deprovisioned resources someone else can claim.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·K", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-k" }, { "source_name": "cwe", "external_id": "CWE-672", "url": "https://cwe.mitre.org/data/definitions/672.html", "description": "Operation on a Resource after Expiration or Release" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "dns-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·K", "group_code": "DN", "group_name": "DNS layer", "stride": [ "S", "E" ], "stride_fit": "Clean", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-672" ] } } }, { "type": "course-of-action", "id": "course-of-action--0efcb7eb-1002-586a-8a6a-a2248d706f42", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DN·K Dangling Mail Records", "description": "Deprovisioning removes or neutralises every record that pointed at the resource.\n\n(1) Generate per-tenant, unguessable hostnames and selectors so a departed tenant's records cannot be claimed by a new one.\n(2) Run a deprovisioning checklist that revokes keys, retires selectors and reserves the tenant's hostnames for a cooling-off period.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·K", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·K", "mitigation_principle": "Deprovisioning removes or neutralises every record that pointed at the resource.", "design_measures": [ "Generate per-tenant, unguessable hostnames and selectors so a departed tenant's records cannot be claimed by a new one.", "Run a deprovisioning checklist that revokes keys, retires selectors and reserves the tenant's hostnames for a cooling-off period." ] } } }, { "type": "relationship", "id": "relationship--1d080373-3b1a-5511-bd16-f17df98842ac", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0efcb7eb-1002-586a-8a6a-a2248d706f42", "target_ref": "attack-pattern--0efcb7eb-1002-586a-8a6a-a2248d706f42" }, { "type": "attack-pattern", "id": "attack-pattern--328a86fb-b929-5222-8f29-cd71a4c048f2", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unauthenticated Answers", "description": "Without DNSSEC validation, every lookup the platform relies on (MX, SPF, DKIM, DMARC, MTA-STS, block lists) can be answered by whoever reaches the resolver first.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-q" }, { "source_name": "capec", "external_id": "CAPEC-598", "url": "https://capec.mitre.org/data/definitions/598.html", "description": "DNS Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-142", "url": "https://capec.mitre.org/data/definitions/142.html", "description": "DNS Cache Poisoning" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-346", "url": "https://cwe.mitre.org/data/definitions/346.html", "description": "Origin Validation Error" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "dns-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·Q", "group_code": "DN", "group_name": "DNS layer", "stride": [ "S", "T" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-598", "CAPEC-142" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-353", "CWE-346" ] } } }, { "type": "course-of-action", "id": "course-of-action--328a86fb-b929-5222-8f29-cd71a4c048f2", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DN·Q Unauthenticated Answers", "description": "Lookups the platform relies on are authenticated, and validation failure is handled deliberately.\n\n(1) Use DNSSEC-validating resolvers and treat validation failure as a temporary error (defer), not as \"no record\".\n(2) Sign the platform's own mail zones so that recipients and senders can validate the records they look up.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·Q", "mitigation_principle": "Lookups the platform relies on are authenticated, and validation failure is handled deliberately.", "design_measures": [ "Use DNSSEC-validating resolvers and treat validation failure as a temporary error (defer), not as \"no record\".", "Sign the platform's own mail zones so that recipients and senders can validate the records they look up." ] } } }, { "type": "relationship", "id": "relationship--88c4d6d5-634c-5ae5-b1a0-e77a1c7e3eca", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--328a86fb-b929-5222-8f29-cd71a4c048f2", "target_ref": "attack-pattern--328a86fb-b929-5222-8f29-cd71a4c048f2" }, { "type": "attack-pattern", "id": "attack-pattern--fd4528b3-488c-5bc5-a8d6-bdd831afcd21", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Transport Policy Downgrade", "description": "MTA-STS policy or TLSA records are stripped, stale or taken over.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·J", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-j" }, { "source_name": "capec", "external_id": "CAPEC-620", "url": "https://capec.mitre.org/data/definitions/620.html", "description": "Drop Encryption Level" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely ('Failing Open')" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "dns-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·J", "group_code": "DN", "group_name": "DNS layer", "stride": [ "T", "I" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-620" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-636" ] } } }, { "type": "course-of-action", "id": "course-of-action--fd4528b3-488c-5bc5-a8d6-bdd831afcd21", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DN·J Transport Policy Downgrade", "description": "A transport policy that disappears or breaks raises suspicion rather than silently relaxing security.\n\n(1) Keep the MTA-STS policy host under the platform's own certificate automation with expiry alerts well in advance.\n(2) Cache sender-side policies and treat a previously seen policy that vanishes as a downgrade attempt to be deferred.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·J", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·J", "mitigation_principle": "A transport policy that disappears or breaks raises suspicion rather than silently relaxing security.", "design_measures": [ "Keep the MTA-STS policy host under the platform's own certificate automation with expiry alerts well in advance.", "Cache sender-side policies and treat a previously seen policy that vanishes as a downgrade attempt to be deferred." ] } } }, { "type": "relationship", "id": "relationship--8f78c666-01d1-5df7-9b49-abd1ad6dbcf9", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fd4528b3-488c-5bc5-a8d6-bdd831afcd21", "target_ref": "attack-pattern--fd4528b3-488c-5bc5-a8d6-bdd831afcd21" }, { "type": "attack-pattern", "id": "attack-pattern--1d769c4f-be00-56c9-9d01-0bfba0ec2a7c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Domain Lifecycle Gap", "description": "The platform keeps trusting, or holding mailboxes for, a tenant domain whose ownership has lapsed or changed.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·10", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-10" }, { "source_name": "cwe", "external_id": "CWE-283", "url": "https://cwe.mitre.org/data/definitions/283.html", "description": "Unverified Ownership" }, { "source_name": "cwe", "external_id": "CWE-672", "url": "https://cwe.mitre.org/data/definitions/672.html", "description": "Operation on a Resource after Expiration or Release" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "dns-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·10", "group_code": "DN", "group_name": "DNS layer", "stride": [ "S" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Direct", "cwe_ids": [ "CWE-283", "CWE-672" ] } } }, { "type": "course-of-action", "id": "course-of-action--1d769c4f-be00-56c9-9d01-0bfba0ec2a7c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DN·10 Domain Lifecycle Gap", "description": "Domain ownership is a continuing condition, re-verified over the life of the tenant.\n\n(1) Re-verify domain ownership on a schedule and on registrar change events, and suspend sending rights when verification fails.\n(2) Expire mailboxes, keys and sending rights for a domain whose ownership has lapsed, with a notified grace period.\n(3) Monitor registrar WHOIS and NS changes for every verified domain and treat a change of registrant or nameserver as a re-verification event.\n(4) Give the tenant admin a page listing every domain, its verification state and the date it was last proven.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·10", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·10", "mitigation_principle": "Domain ownership is a continuing condition, re-verified over the life of the tenant.", "design_measures": [ "Re-verify domain ownership on a schedule and on registrar change events, and suspend sending rights when verification fails.", "Expire mailboxes, keys and sending rights for a domain whose ownership has lapsed, with a notified grace period.", "Monitor registrar WHOIS and NS changes for every verified domain and treat a change of registrant or nameserver as a re-verification event.", "Give the tenant admin a page listing every domain, its verification state and the date it was last proven." ] } } }, { "type": "relationship", "id": "relationship--cd1f8bea-cec2-59ab-a837-6acc3b9f2955", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1d769c4f-be00-56c9-9d01-0bfba0ec2a7c", "target_ref": "attack-pattern--1d769c4f-be00-56c9-9d01-0bfba0ec2a7c" }, { "type": "attack-pattern", "id": "attack-pattern--691205c2-b2d5-5e81-9ef1-283574b7ac49", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Weak Ownership Verification", "description": "Tenant onboarding verifies a domain with a weak, replayable or never-rechecked proof.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·9", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-9" }, { "source_name": "cwe", "external_id": "CWE-283", "url": "https://cwe.mitre.org/data/definitions/283.html", "description": "Unverified Ownership" }, { "source_name": "cwe", "external_id": "CWE-340", "url": "https://cwe.mitre.org/data/definitions/340.html", "description": "Generation of Predictable Numbers or Identifiers" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "dns-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·9", "group_code": "DN", "group_name": "DNS layer", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "None", "cwe_match": "Direct", "cwe_ids": [ "CWE-283", "CWE-340" ] } } }, { "type": "course-of-action", "id": "course-of-action--691205c2-b2d5-5e81-9ef1-283574b7ac49", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DN·9 Weak Ownership Verification", "description": "Ownership proof is unique, single-use and specific to the claim being made.\n\n(1) Issue a random, single-use verification token per tenant per domain, and never derive it from the domain name.\n(2) Reject a claim to a domain or overlapping subdomain already verified by another tenant, and separate subdomain rights from parent rights.\n(3) Require the proof record to be present and correct at every re-verification, not only at onboarding, and remove the tenant's rights when the record disappears.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·9", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·9", "mitigation_principle": "Ownership proof is unique, single-use and specific to the claim being made.", "design_measures": [ "Issue a random, single-use verification token per tenant per domain, and never derive it from the domain name.", "Reject a claim to a domain or overlapping subdomain already verified by another tenant, and separate subdomain rights from parent rights.", "Require the proof record to be present and correct at every re-verification, not only at onboarding, and remove the tenant's rights when the record disappears." ] } } }, { "type": "relationship", "id": "relationship--4826be0a-dfc3-5b13-91b6-a904267c0629", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--691205c2-b2d5-5e81-9ef1-283574b7ac49", "target_ref": "attack-pattern--691205c2-b2d5-5e81-9ef1-283574b7ac49" }, { "type": "attack-pattern", "id": "attack-pattern--64612ddd-7430-5f54-9f13-bd2c56bb75ff", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Resolver Trust", "description": "The platform's resolvers are poisonable, shared across tenants, or treat attacker-controlled answers as safe input.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·8", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-8" }, { "source_name": "capec", "external_id": "CAPEC-142", "url": "https://capec.mitre.org/data/definitions/142.html", "description": "DNS Cache Poisoning" }, { "source_name": "cwe", "external_id": "CWE-331", "url": "https://cwe.mitre.org/data/definitions/331.html", "description": "Insufficient Entropy" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "dns-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·8", "group_code": "DN", "group_name": "DNS layer", "stride": [ "S", "T" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-142" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-331", "CWE-653" ] } } }, { "type": "course-of-action", "id": "course-of-action--64612ddd-7430-5f54-9f13-bd2c56bb75ff", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DN·8 Resolver Trust", "description": "Resolvers are dedicated, validating and bound what they accept from the network.\n\n(1) Run dedicated, DNSSEC-validating resolvers on private addresses with source-port and transaction-ID randomisation.\n(2) Bound answer size, record count and TTL before passing any answer to an authentication or routing component.\n(3) Rate-limit queries per sending domain and per message so that one sender cannot use the resolver to amplify work against third parties (see Lookup Amplification).\n(4) Keep an independent second resolver path for critical lookups and compare answers when they disagree.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·8", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·8", "mitigation_principle": "Resolvers are dedicated, validating and bound what they accept from the network.", "design_measures": [ "Run dedicated, DNSSEC-validating resolvers on private addresses with source-port and transaction-ID randomisation.", "Bound answer size, record count and TTL before passing any answer to an authentication or routing component.", "Rate-limit queries per sending domain and per message so that one sender cannot use the resolver to amplify work against third parties (see Lookup Amplification).", "Keep an independent second resolver path for critical lookups and compare answers when they disagree." ] } } }, { "type": "relationship", "id": "relationship--233762e2-dee0-5aac-9cbc-6c0560353835", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--64612ddd-7430-5f54-9f13-bd2c56bb75ff", "target_ref": "attack-pattern--64612ddd-7430-5f54-9f13-bd2c56bb75ff" }, { "type": "attack-pattern", "id": "attack-pattern--40d26e8f-313c-5493-8850-285d1b227794", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Lookup Amplification", "description": "Authentication checks trigger sender-directed DNS queries that exhaust the resolver or reflect onto a victim.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·7", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-7" }, { "source_name": "capec", "external_id": "CAPEC-490", "url": "https://capec.mitre.org/data/definitions/490.html", "description": "Amplification" }, { "source_name": "cwe", "external_id": "CWE-405", "url": "https://cwe.mitre.org/data/definitions/405.html", "description": "Asymmetric Resource Consumption (Amplification)" }, { "source_name": "cwe", "external_id": "CWE-406", "url": "https://cwe.mitre.org/data/definitions/406.html", "description": "Insufficient Control of Network Message Volume (Network Amplification)" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "dns-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·7", "group_code": "DN", "group_name": "DNS layer", "stride": [ "D" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-490" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-405", "CWE-406" ] } } }, { "type": "course-of-action", "id": "course-of-action--40d26e8f-313c-5493-8850-285d1b227794", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DN·7 Lookup Amplification", "description": "Sender-controlled records cannot make the platform do unbounded work.\n\n(1) Enforce the SPF limit of ten DNS-querying mechanisms and void lookups, and treat exceeding it as permerror.\n(2) Cap total DNS queries per inbound message and per sender domain per minute, and cache negative results.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·7", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·7", "mitigation_principle": "Sender-controlled records cannot make the platform do unbounded work.", "design_measures": [ "Enforce the SPF limit of ten DNS-querying mechanisms and void lookups, and treat exceeding it as permerror.", "Cap total DNS queries per inbound message and per sender domain per minute, and cache negative results." ] } } }, { "type": "relationship", "id": "relationship--72e28d53-ba6a-5434-9e53-f5f5cfe5449b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--40d26e8f-313c-5493-8850-285d1b227794", "target_ref": "attack-pattern--40d26e8f-313c-5493-8850-285d1b227794" }, { "type": "attack-pattern", "id": "attack-pattern--754b61f4-49d7-5f62-9ce6-009bfa2c5537", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "DNS Failure Semantics", "description": "Lookup failures are treated as \"no policy\", and fallbacks such as implicit MX are followed unsafely.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·6", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-6" }, { "source_name": "capec", "external_id": "CAPEC-589", "url": "https://capec.mitre.org/data/definitions/589.html", "description": "DNS Blocking" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely ('Failing Open')" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "dns-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·6", "group_code": "DN", "group_name": "DNS layer", "stride": [ "D", "S" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-589" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-636", "CWE-754" ] } } }, { "type": "course-of-action", "id": "course-of-action--754b61f4-49d7-5f62-9ce6-009bfa2c5537", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DN·6 DNS Failure Semantics", "description": "Each DNS failure mode has a defined, deliberate meaning.\n\n(1) Distinguish timeout, SERVFAIL and NXDOMAIN in every lookup, and map temporary failures to defer rather than \"no policy\".\n(2) Honour null MX and never fall back to an A or AAAA record for a domain that publishes one.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·6", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·6", "mitigation_principle": "Each DNS failure mode has a defined, deliberate meaning.", "design_measures": [ "Distinguish timeout, SERVFAIL and NXDOMAIN in every lookup, and map temporary failures to defer rather than \"no policy\".", "Honour null MX and never fall back to an A or AAAA record for a domain that publishes one." ] } } }, { "type": "relationship", "id": "relationship--e083898d-56ae-5f48-be83-bc2c67966416", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--754b61f4-49d7-5f62-9ce6-009bfa2c5537", "target_ref": "attack-pattern--754b61f4-49d7-5f62-9ce6-009bfa2c5537" }, { "type": "attack-pattern", "id": "attack-pattern--afd3274a-bd31-5bd2-82c1-354df0497678", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Reputation Feed Dependency", "description": "DNS-based blocklists are an integrity and availability dependency that can fail, lapse or be poisoned.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·5", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-5" }, { "source_name": "capec", "external_id": "CAPEC-589", "url": "https://capec.mitre.org/data/definitions/589.html", "description": "DNS Blocking" }, { "source_name": "cwe", "external_id": "CWE-654", "url": "https://cwe.mitre.org/data/definitions/654.html", "description": "Reliance on a Single Factor in a Security Decision" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "dns-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·5", "group_code": "DN", "group_name": "DNS layer", "stride": [ "D", "T" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-589" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-654", "CWE-1357" ] } } }, { "type": "course-of-action", "id": "course-of-action--afd3274a-bd31-5bd2-82c1-354df0497678", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DN·5 Reputation Feed Dependency", "description": "No single external feed can stop or open the mail flow on its own.\n\n(1) Require agreement between at least two reputation sources for a reject, and treat a list answering \"listed\" for a known-good test address as broken.\n(2) Monitor each list's responsiveness and domain registration, and fail to neutral when a list is unreachable.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·5", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·5", "mitigation_principle": "No single external feed can stop or open the mail flow on its own.", "design_measures": [ "Require agreement between at least two reputation sources for a reject, and treat a list answering \"listed\" for a known-good test address as broken.", "Monitor each list's responsiveness and domain registration, and fail to neutral when a list is unreachable." ] } } }, { "type": "relationship", "id": "relationship--ea7ba9e7-defa-51d4-a0b3-f3366f63912c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--afd3274a-bd31-5bd2-82c1-354df0497678", "target_ref": "attack-pattern--afd3274a-bd31-5bd2-82c1-354df0497678" }, { "type": "attack-pattern", "id": "attack-pattern--a321780f-0bd5-5393-82d2-da414ccf7bb1", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Cached Policy Poisoning", "description": "A bad policy or record, once cached, outlives the attack that planted it.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·4", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-4" }, { "source_name": "capec", "external_id": "CAPEC-141", "url": "https://capec.mitre.org/data/definitions/141.html", "description": "Cache Poisoning" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "dns-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·4", "group_code": "DN", "group_name": "DNS layer", "stride": [ "T" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-141" ], "cwe_match": "None" } } }, { "type": "course-of-action", "id": "course-of-action--a321780f-0bd5-5393-82d2-da414ccf7bb1", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DN·4 Cached Policy Poisoning", "description": "Cached policy cannot outlive the trust it was based on.\n\n(1) Cap the lifetime honoured for cached policies and records regardless of the published TTL.\n(2) Provide an operator control to flush cached entries for one domain, and alert on sudden changes to long-lived policies.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·4", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·4", "mitigation_principle": "Cached policy cannot outlive the trust it was based on.", "design_measures": [ "Cap the lifetime honoured for cached policies and records regardless of the published TTL.", "Provide an operator control to flush cached entries for one domain, and alert on sudden changes to long-lived policies." ] } } }, { "type": "relationship", "id": "relationship--30ec07f4-4465-5f97-bfc4-b257f9d54cc7", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a321780f-0bd5-5393-82d2-da414ccf7bb1", "target_ref": "attack-pattern--a321780f-0bd5-5393-82d2-da414ccf7bb1" }, { "type": "attack-pattern", "id": "attack-pattern--9da7f9d9-7f88-5aaf-8416-c1d54eb8ddeb", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Signing Failure Outage", "description": "The platform's own signed zones or validating resolvers go dark: an expired signature, a failed key rollover or a validation bug makes every record the platform publishes or depends on unresolvable, and all mail stops.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·3", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-3" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "dns-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·3", "group_code": "DN", "group_name": "DNS layer", "stride": [ "D" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "None" } } }, { "type": "course-of-action", "id": "course-of-action--9da7f9d9-7f88-5aaf-8416-c1d54eb8ddeb", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DN·3 Signing Failure Outage", "description": "The platform's own DNS cannot silently expire, and its failure is detected before the mail stops.\n\n(1) Automate key rollover and signature refresh, and monitor signature expiry and validation from an external validating resolver.\n(2) Rehearse rollover and recovery in a staging zone, and keep an emergency procedure to republish or unsign the zone.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·3", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·3", "mitigation_principle": "The platform's own DNS cannot silently expire, and its failure is detected before the mail stops.", "design_measures": [ "Automate key rollover and signature refresh, and monitor signature expiry and validation from an external validating resolver.", "Rehearse rollover and recovery in a staging zone, and keep an emergency procedure to republish or unsign the zone." ] } } }, { "type": "relationship", "id": "relationship--1b7bc0b8-0dad-57ea-857e-2b78e25901be", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9da7f9d9-7f88-5aaf-8416-c1d54eb8ddeb", "target_ref": "attack-pattern--9da7f9d9-7f88-5aaf-8416-c1d54eb8ddeb" }, { "type": "attack-pattern", "id": "attack-pattern--eb6ae0bd-0f4c-5693-b376-bf24651eaa50", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Internationalised Domain Confusion", "description": "Punycode, homoglyph and malformed domains (NUL, invisible characters, a trailing period) are compared, resolved or displayed inconsistently across components.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·2", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-2" }, { "source_name": "capec", "external_id": "CAPEC-632", "url": "https://capec.mitre.org/data/definitions/632.html", "description": "Homograph Attack via Homoglyphs" }, { "source_name": "capec", "external_id": "CAPEC-52", "url": "https://capec.mitre.org/data/definitions/52.html", "description": "Embedding NULL Bytes" }, { "source_name": "cwe", "external_id": "CWE-1289", "url": "https://cwe.mitre.org/data/definitions/1289.html", "description": "Improper Validation of Unsafe Equivalence in Input" }, { "source_name": "cwe", "external_id": "CWE-1007", "url": "https://cwe.mitre.org/data/definitions/1007.html", "description": "Insufficient Visual Distinction of Homoglyphs Presented to User" }, { "source_name": "cwe", "external_id": "CWE-158", "url": "https://cwe.mitre.org/data/definitions/158.html", "description": "Improper Neutralization of Null Byte or NUL Character" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "dns-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·2", "group_code": "DN", "group_name": "DNS layer", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-632", "CAPEC-52" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-1289", "CWE-1007", "CWE-158" ] } } }, { "type": "course-of-action", "id": "course-of-action--eb6ae0bd-0f4c-5693-b376-bf24651eaa50", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for DN·2 Internationalised Domain Confusion", "description": "Domains are normalised to one canonical form before any component compares, resolves or displays them.\n\n(1) Normalise every domain to its A-label form at ingress, rejecting labels with control characters, NUL or invisible code points, and apply the same normalisation to allow lists, block lists, DNS lookups and authentication.\n(2) Flag mixed-script labels and labels confusable with a known contact's domain, and display them in a visibly distinct form.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN·2", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "DN·2", "mitigation_principle": "Domains are normalised to one canonical form before any component compares, resolves or displays them.", "design_measures": [ "Normalise every domain to its A-label form at ingress, rejecting labels with control characters, NUL or invisible code points, and apply the same normalisation to allow lists, block lists, DNS lookups and authentication.", "Flag mixed-script labels and labels confusable with a known contact's domain, and display them in a visibly distinct form." ] } } }, { "type": "relationship", "id": "relationship--f7959f05-3350-5288-948c-70562b8ab13b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--eb6ae0bd-0f4c-5693-b376-bf24651eaa50", "target_ref": "attack-pattern--eb6ae0bd-0f4c-5693-b376-bf24651eaa50" }, { "type": "grouping", "id": "grouping--e6513b7b-b948-581d-b256-335bf2bc55a8", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Layer 06: DNS layer (DN)", "description": "DNS decides where mail goes and who may send it, so whoever controls or falsifies an answer controls the mail. These entries cover the records the platform publishes, hosts for tenants and resolves. Scope: The records and resolvers that say where mail goes and who may send it.", "context": "unspecified", "object_refs": [ "attack-pattern--5334007b-8e36-5f79-bf10-3ed78e88674b", "course-of-action--5334007b-8e36-5f79-bf10-3ed78e88674b", "attack-pattern--0efcb7eb-1002-586a-8a6a-a2248d706f42", "course-of-action--0efcb7eb-1002-586a-8a6a-a2248d706f42", "attack-pattern--328a86fb-b929-5222-8f29-cd71a4c048f2", "course-of-action--328a86fb-b929-5222-8f29-cd71a4c048f2", "attack-pattern--fd4528b3-488c-5bc5-a8d6-bdd831afcd21", "course-of-action--fd4528b3-488c-5bc5-a8d6-bdd831afcd21", "attack-pattern--1d769c4f-be00-56c9-9d01-0bfba0ec2a7c", "course-of-action--1d769c4f-be00-56c9-9d01-0bfba0ec2a7c", "attack-pattern--691205c2-b2d5-5e81-9ef1-283574b7ac49", "course-of-action--691205c2-b2d5-5e81-9ef1-283574b7ac49", "attack-pattern--64612ddd-7430-5f54-9f13-bd2c56bb75ff", "course-of-action--64612ddd-7430-5f54-9f13-bd2c56bb75ff", "attack-pattern--40d26e8f-313c-5493-8850-285d1b227794", "course-of-action--40d26e8f-313c-5493-8850-285d1b227794", "attack-pattern--754b61f4-49d7-5f62-9ce6-009bfa2c5537", "course-of-action--754b61f4-49d7-5f62-9ce6-009bfa2c5537", "attack-pattern--afd3274a-bd31-5bd2-82c1-354df0497678", "course-of-action--afd3274a-bd31-5bd2-82c1-354df0497678", "attack-pattern--a321780f-0bd5-5393-82d2-da414ccf7bb1", "course-of-action--a321780f-0bd5-5393-82d2-da414ccf7bb1", "attack-pattern--9da7f9d9-7f88-5aaf-8416-c1d54eb8ddeb", "course-of-action--9da7f9d9-7f88-5aaf-8416-c1d54eb8ddeb", "attack-pattern--eb6ae0bd-0f4c-5693-b376-bf24651eaa50", "course-of-action--eb6ae0bd-0f4c-5693-b376-bf24651eaa50" ], "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "DN", "url": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--fef27589-a7f3-56d1-9e3b-62b9dca4bd0a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Analysis-Aware Content", "description": "Content or a URL detects the scanner (IP range, user agent, sandbox artefacts, timing) and behaves benignly for it.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·A", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-a" }, { "source_name": "capec", "external_id": "CAPEC-224", "url": "https://capec.mitre.org/data/definitions/224.html", "description": "Fingerprinting" }, { "source_name": "cwe", "external_id": "CWE-205", "url": "https://cwe.mitre.org/data/definitions/205.html", "description": "Observable Behavioral Discrepancy" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "content-scanners" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·A", "group_code": "CS", "group_name": "Content scanners", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-224" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-205" ] } } }, { "type": "course-of-action", "id": "course-of-action--fef27589-a7f3-56d1-9e3b-62b9dca4bd0a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CS·A Analysis-Aware Content", "description": "The scanner's view of content is indistinguishable from a user's.\n\n(1) Fetch URLs from residential-like, rotating egress with realistic browser fingerprints, and detonate samples in sandboxes that resemble real endpoints.\n(2) Treat \"nothing happened\" as inconclusive rather than clean, and combine it with destination reputation before deciding.\n(3) Rotate and measure the detonation environment's fingerprints against real user traffic, and rebuild it when attackers begin to distinguish it.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·A", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·A", "mitigation_principle": "The scanner's view of content is indistinguishable from a user's.", "design_measures": [ "Fetch URLs from residential-like, rotating egress with realistic browser fingerprints, and detonate samples in sandboxes that resemble real endpoints.", "Treat \"nothing happened\" as inconclusive rather than clean, and combine it with destination reputation before deciding.", "Rotate and measure the detonation environment's fingerprints against real user traffic, and rebuild it when attackers begin to distinguish it." ] } } }, { "type": "relationship", "id": "relationship--25e649cf-10c1-5fb1-bd12-3b5d56307f93", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fef27589-a7f3-56d1-9e3b-62b9dca4bd0a", "target_ref": "attack-pattern--fef27589-a7f3-56d1-9e3b-62b9dca4bd0a" }, { "type": "attack-pattern", "id": "attack-pattern--3508ede9-fbf5-5ea4-9ee9-8c024d37b4e3", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Scanner Prompt Injection", "description": "Message content is interpreted as instructions by an LLM-based classifier, summariser or assistant.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·K", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-k" }, { "source_name": "cwe", "external_id": "CWE-1427", "url": "https://cwe.mitre.org/data/definitions/1427.html", "description": "Improper Neutralization of Input Used for LLM Prompting" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "content-scanners" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·K", "group_code": "CS", "group_name": "Content scanners", "stride": [ "T", "E" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Direct", "cwe_ids": [ "CWE-1427" ] } } }, { "type": "course-of-action", "id": "course-of-action--3508ede9-fbf5-5ea4-9ee9-8c024d37b4e3", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CS·K Scanner Prompt Injection", "description": "Message content is data to a model, never instructions, and no security decision depends on the model resisting it.\n\n(1) Pass message content to the classifier as a delimited, typed input with no tool access and a fixed output schema.\n(2) Back every model verdict with deterministic rules so that a manipulated model score cannot release a message on its own.\n(3) Audit the model's behaviour on a corpus of injection attempts as part of every model or prompt change, with a release gate on the detection rate.\n(4) Log model inputs and outputs for sampled traffic so that a manipulation campaign can be reconstructed afterwards.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·K", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·K", "mitigation_principle": "Message content is data to a model, never instructions, and no security decision depends on the model resisting it.", "design_measures": [ "Pass message content to the classifier as a delimited, typed input with no tool access and a fixed output schema.", "Back every model verdict with deterministic rules so that a manipulated model score cannot release a message on its own.", "Audit the model's behaviour on a corpus of injection attempts as part of every model or prompt change, with a release gate on the detection rate.", "Log model inputs and outputs for sampled traffic so that a manipulation campaign can be reconstructed afterwards." ] } } }, { "type": "relationship", "id": "relationship--6072eaf7-fde0-5d12-a1fb-5d6bb3c72cbf", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3508ede9-fbf5-5ea4-9ee9-8c024d37b4e3", "target_ref": "attack-pattern--3508ede9-fbf5-5ea4-9ee9-8c024d37b4e3" }, { "type": "attack-pattern", "id": "attack-pattern--cb54e364-147f-587d-a782-fa1ae76babed", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Gated Content", "description": "The payload sits behind a CAPTCHA, login, password or QR code that the scanner cannot pass.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-q" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely ('Failing Open')" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "content-scanners" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·Q", "group_code": "CS", "group_name": "Content scanners", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-636" ] } } }, { "type": "course-of-action", "id": "course-of-action--cb54e364-147f-587d-a782-fa1ae76babed", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CS·Q Gated Content", "description": "Content the scanner cannot reach gets its own verdict and gating counts against the message.\n\n(1) Return UNREACHABLE for gated content and apply a hold-or-flag policy to it rather than \"clean\".\n(2) Try passwords found in the message body or subject against protected archives, and score CAPTCHA and login gates as risk signals.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·Q", "mitigation_principle": "Content the scanner cannot reach gets its own verdict and gating counts against the message.", "design_measures": [ "Return UNREACHABLE for gated content and apply a hold-or-flag policy to it rather than \"clean\".", "Try passwords found in the message body or subject against protected archives, and score CAPTCHA and login gates as risk signals." ] } } }, { "type": "relationship", "id": "relationship--433b99c1-d3fc-52bf-97c0-0bf9c644d15d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--cb54e364-147f-587d-a782-fa1ae76babed", "target_ref": "attack-pattern--cb54e364-147f-587d-a782-fa1ae76babed" }, { "type": "attack-pattern", "id": "attack-pattern--3247e411-3a4c-5024-99ef-a0d83728c8fc", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Reputation Laundering", "description": "A URL routes through trusted domains, open redirects or the platform's own rewritten links, so only the first hop is judged.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·J", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-j" }, { "source_name": "cwe", "external_id": "CWE-601", "url": "https://cwe.mitre.org/data/definitions/601.html", "description": "URL Redirection to Untrusted Site ('Open Redirect')" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "content-scanners" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·J", "group_code": "CS", "group_name": "Content scanners", "stride": [ "S" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-601" ] } } }, { "type": "course-of-action", "id": "course-of-action--3247e411-3a4c-5024-99ef-a0d83728c8fc", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CS·J Reputation Laundering", "description": "A URL is judged by where it ends up, not where it starts.\n\n(1) Follow the complete redirect chain, including the platform's own rewrites, and judge the final destination.\n(2) Bind rewritten links to the recipient and message so a link cannot be lifted and reused elsewhere.\n(3) Re-evaluate the destination at the moment of click, and block or warn when it differs from what was judged at delivery (see Check Once, Use Later).", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·J", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·J", "mitigation_principle": "A URL is judged by where it ends up, not where it starts.", "design_measures": [ "Follow the complete redirect chain, including the platform's own rewrites, and judge the final destination.", "Bind rewritten links to the recipient and message so a link cannot be lifted and reused elsewhere.", "Re-evaluate the destination at the moment of click, and block or warn when it differs from what was judged at delivery (see Check Once, Use Later)." ] } } }, { "type": "relationship", "id": "relationship--61f5ee2c-0133-5bd8-a736-4dcd9cfa2f0b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3247e411-3a4c-5024-99ef-a0d83728c8fc", "target_ref": "attack-pattern--3247e411-3a4c-5024-99ef-a0d83728c8fc" }, { "type": "attack-pattern", "id": "attack-pattern--4b66952d-8017-55ee-b3be-2a29a0dbcd74", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Classifier Evasion", "description": "Adversarial perturbation (padding, homoglyphs, text in images) moves content across an ML detector's decision boundary.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·10", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-10" }, { "source_name": "cwe", "external_id": "CWE-1039", "url": "https://cwe.mitre.org/data/definitions/1039.html", "description": "Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism" }, { "source_name": "cwe", "external_id": "CWE-654", "url": "https://cwe.mitre.org/data/definitions/654.html", "description": "Reliance on a Single Factor in a Security Decision" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "content-scanners" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·10", "group_code": "CS", "group_name": "Content scanners", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Direct", "cwe_ids": [ "CWE-1039", "CWE-654" ] } } }, { "type": "course-of-action", "id": "course-of-action--4b66952d-8017-55ee-b3be-2a29a0dbcd74", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CS·10 Classifier Evasion", "description": "No decision rests on a single statistical score.\n\n(1) Normalise input (strip hidden text, decode homoglyphs, OCR images) before classification.\n(2) Pair each ML classifier with a deterministic control (signature, policy, reputation) that can block regardless of score.\n(3) Watch the score distribution per tenant and per feature for shifts that indicate adversarial probing, and raise the threshold for sources that are probing.\n(4) Keep the model's features and thresholds out of anything the sender can observe (see Verdict Oracle).", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·10", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·10", "mitigation_principle": "No decision rests on a single statistical score.", "design_measures": [ "Normalise input (strip hidden text, decode homoglyphs, OCR images) before classification.", "Pair each ML classifier with a deterministic control (signature, policy, reputation) that can block regardless of score.", "Watch the score distribution per tenant and per feature for shifts that indicate adversarial probing, and raise the threshold for sources that are probing.", "Keep the model's features and thresholds out of anything the sender can observe (see Verdict Oracle)." ] } } }, { "type": "relationship", "id": "relationship--c9ce90d2-f646-5ddd-9ff6-d4fb6debd33c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4b66952d-8017-55ee-b3be-2a29a0dbcd74", "target_ref": "attack-pattern--4b66952d-8017-55ee-b3be-2a29a0dbcd74" }, { "type": "attack-pattern", "id": "attack-pattern--a1bc919c-3e95-5a13-a297-7ffc1e8c9a1d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Classifier Poisoning", "description": "Feedback loops such as user reports and quarantine releases let an attacker shape what the model learns.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·9", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-9" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "content-scanners" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·9", "group_code": "CS", "group_name": "Content scanners", "stride": [ "T" ], "stride_fit": "Clean", "capec_match": "None", "cwe_match": "None" } } }, { "type": "course-of-action", "id": "course-of-action--a1bc919c-3e95-5a13-a297-7ffc1e8c9a1d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CS·9 Classifier Poisoning", "description": "Training signal is weighted by who provides it and watched for drift.\n\n(1) Weight feedback by account age, tenant reputation and corroboration, and exclude trial and new accounts from training.\n(2) Monitor label distributions per tenant and per source, and hold back model updates when a shift exceeds a threshold.\n(3) Review the training set for a sample of each update against ground truth, and keep a rollback to the last trusted model.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·9", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·9", "mitigation_principle": "Training signal is weighted by who provides it and watched for drift.", "design_measures": [ "Weight feedback by account age, tenant reputation and corroboration, and exclude trial and new accounts from training.", "Monitor label distributions per tenant and per source, and hold back model updates when a shift exceeds a threshold.", "Review the training set for a sample of each update against ground truth, and keep a rollback to the last trusted model." ] } } }, { "type": "relationship", "id": "relationship--e17937ca-e897-59c1-bc64-fc4a40492037", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a1bc919c-3e95-5a13-a297-7ffc1e8c9a1d", "target_ref": "attack-pattern--a1bc919c-3e95-5a13-a297-7ffc1e8c9a1d" }, { "type": "attack-pattern", "id": "attack-pattern--0c110976-0d65-5936-9d2a-282f6942e2bc", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Scanner as Attack Surface", "description": "Parsing, detonating or fetching untrusted content leads to code execution, sandbox escape or server-side request forgery inside the platform.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·8", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-8" }, { "source_name": "capec", "external_id": "CAPEC-664", "url": "https://capec.mitre.org/data/definitions/664.html", "description": "Server Side Request Forgery" }, { "source_name": "capec", "external_id": "CAPEC-100", "url": "https://capec.mitre.org/data/definitions/100.html", "description": "Overflow Buffers" }, { "source_name": "capec", "external_id": "CAPEC-237", "url": "https://capec.mitre.org/data/definitions/237.html", "description": "Escaping a Sandbox by Calling Code in Another Language" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "cwe", "external_id": "CWE-918", "url": "https://cwe.mitre.org/data/definitions/918.html", "description": "Server-Side Request Forgery (SSRF)" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "content-scanners" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·8", "group_code": "CS", "group_name": "Content scanners", "stride": [ "E" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-664", "CAPEC-100", "CAPEC-237" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-653", "CWE-918" ] } } }, { "type": "course-of-action", "id": "course-of-action--0c110976-0d65-5936-9d2a-282f6942e2bc", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CS·8 Scanner as Attack Surface", "description": "A compromised scanner can reach nothing but the sample in front of it.\n\n(1) Run detonation and URL fetching in ephemeral, network-isolated environments with no route to internal services and no credentials.\n(2) Destroy the environment after each sample and treat any outbound connection attempt as a finding.\n(3) Hold the scanner's own credentials (feed subscriptions, API keys) in a broker outside the detonation environment, so that a compromised sample cannot read them.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·8", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·8", "mitigation_principle": "A compromised scanner can reach nothing but the sample in front of it.", "design_measures": [ "Run detonation and URL fetching in ephemeral, network-isolated environments with no route to internal services and no credentials.", "Destroy the environment after each sample and treat any outbound connection attempt as a finding.", "Hold the scanner's own credentials (feed subscriptions, API keys) in a broker outside the detonation environment, so that a compromised sample cannot read them." ] } } }, { "type": "relationship", "id": "relationship--8eabf028-6550-5c69-acd3-90a07480fc16", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0c110976-0d65-5936-9d2a-282f6942e2bc", "target_ref": "attack-pattern--0c110976-0d65-5936-9d2a-282f6942e2bc" }, { "type": "attack-pattern", "id": "attack-pattern--c8d32865-4486-5d04-b5e8-ab70d8149493", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Scanner Side Effects", "description": "Fetching URLs consumes one-time links, triggers actions on the recipient's behalf, or confirms the address to the sender.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·7", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-7" }, { "source_name": "cwe", "external_id": "CWE-441", "url": "https://cwe.mitre.org/data/definitions/441.html", "description": "Unintended Proxy or Intermediary ('Confused Deputy')" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "content-scanners" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·7", "group_code": "CS", "group_name": "Content scanners", "stride": [ "I" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-441" ] } } }, { "type": "course-of-action", "id": "course-of-action--c8d32865-4486-5d04-b5e8-ab70d8149493", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CS·7 Scanner Side Effects", "description": "The scanner observes without acting on the recipient's behalf.\n\n(1) Fetch with HEAD or a safe GET that follows no one-time or state-changing links, and skip links matching unsubscribe, confirm or approve patterns.\n(2) Fetch from egress that does not identify the product or tenant, and delay fetches randomly so timing does not confirm delivery.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·7", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·7", "mitigation_principle": "The scanner observes without acting on the recipient's behalf.", "design_measures": [ "Fetch with HEAD or a safe GET that follows no one-time or state-changing links, and skip links matching unsubscribe, confirm or approve patterns.", "Fetch from egress that does not identify the product or tenant, and delay fetches randomly so timing does not confirm delivery." ] } } }, { "type": "relationship", "id": "relationship--dae9a948-e8b0-54ac-9f27-1883c5a48a2f", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c8d32865-4486-5d04-b5e8-ab70d8149493", "target_ref": "attack-pattern--c8d32865-4486-5d04-b5e8-ab70d8149493" }, { "type": "attack-pattern", "id": "attack-pattern--a188e5cc-d45c-51e2-91c6-bcde2e69687a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Verdict Oracle", "description": "An attacker can test content against the scanner and iterate until it passes, or read its verdicts, scores and rule names in the headers delivered with the message.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·6", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-6" }, { "source_name": "capec", "external_id": "CAPEC-54", "url": "https://capec.mitre.org/data/definitions/54.html", "description": "Query System for Information" }, { "source_name": "cwe", "external_id": "CWE-201", "url": "https://cwe.mitre.org/data/definitions/201.html", "description": "Insertion of Sensitive Information Into Sent Data" }, { "source_name": "cwe", "external_id": "CWE-203", "url": "https://cwe.mitre.org/data/definitions/203.html", "description": "Observable Discrepancy" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "content-scanners" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·6", "group_code": "CS", "group_name": "Content scanners", "stride": [ "I" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-54" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-201", "CWE-203" ] } } }, { "type": "course-of-action", "id": "course-of-action--a188e5cc-d45c-51e2-91c6-bcde2e69687a", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CS·6 Verdict Oracle", "description": "An attacker cannot learn what the scanner decided or why, whether by probing it or by reading what it wrote.\n\n(1) Strip verdict, score, rule-name and diagnostic headers before delivery and keep them in the platform's own logs, so they never travel with delivered, forwarded or replied mail.\n(2) Detect repeated near-identical submissions from one source, including trial and free-tier accounts, and degrade the signal they receive.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·6", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·6", "mitigation_principle": "An attacker cannot learn what the scanner decided or why, whether by probing it or by reading what it wrote.", "design_measures": [ "Strip verdict, score, rule-name and diagnostic headers before delivery and keep them in the platform's own logs, so they never travel with delivered, forwarded or replied mail.", "Detect repeated near-identical submissions from one source, including trial and free-tier accounts, and degrade the signal they receive." ] } } }, { "type": "relationship", "id": "relationship--732f6d3c-4766-5ac8-ae7d-9bd458611389", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a188e5cc-d45c-51e2-91c6-bcde2e69687a", "target_ref": "attack-pattern--a188e5cc-d45c-51e2-91c6-bcde2e69687a" }, { "type": "attack-pattern", "id": "attack-pattern--109ad8b4-1f67-5749-a3af-2c467eeae9a5", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Novelty Window", "description": "Detection relies on known-bad indicators, so new domains and new payloads pass until the lists catch up.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·5", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-5" }, { "source_name": "cwe", "external_id": "CWE-184", "url": "https://cwe.mitre.org/data/definitions/184.html", "description": "Incomplete List of Disallowed Inputs" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "content-scanners" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·5", "group_code": "CS", "group_name": "Content scanners", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Direct", "cwe_ids": [ "CWE-184" ] } } }, { "type": "course-of-action", "id": "course-of-action--109ad8b4-1f67-5749-a3af-2c467eeae9a5", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CS·5 Novelty Window", "description": "What is new is treated as unknown, and unknown has a policy.\n\n(1) Apply extra scrutiny to domains registered within a configurable window and to never-seen file types or senders.\n(2) Re-judge delivered mail when intelligence arrives (see Remediation Race) so the novelty window closes retroactively.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·5", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·5", "mitigation_principle": "What is new is treated as unknown, and unknown has a policy.", "design_measures": [ "Apply extra scrutiny to domains registered within a configurable window and to never-seen file types or senders.", "Re-judge delivered mail when intelligence arrives (see Remediation Race) so the novelty window closes retroactively." ] } } }, { "type": "relationship", "id": "relationship--3e438b4b-3912-594a-8ba3-7836bae35d62", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--109ad8b4-1f67-5749-a3af-2c467eeae9a5", "target_ref": "attack-pattern--109ad8b4-1f67-5749-a3af-2c467eeae9a5" }, { "type": "attack-pattern", "id": "attack-pattern--fa6cbc2f-e4b8-58f7-b5f2-c65855a622ad", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Modality Gap", "description": "The payload is in a form the scanner does not analyse: image text, audio, QR codes, links inside documents.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·4", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-4" }, { "source_name": "capec", "external_id": "CAPEC-636", "url": "https://capec.mitre.org/data/definitions/636.html", "description": "Hiding Malicious Data or Code within Files" }, { "source_name": "cwe", "external_id": "CWE-437", "url": "https://cwe.mitre.org/data/definitions/437.html", "description": "Incomplete Model of Endpoint Features" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "content-scanners" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·4", "group_code": "CS", "group_name": "Content scanners", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-636" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-437" ] } } }, { "type": "course-of-action", "id": "course-of-action--fa6cbc2f-e4b8-58f7-b5f2-c65855a622ad", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CS·4 Modality Gap", "description": "Every modality a user can act on is a modality the scanner inspects.\n\n(1) Extract and analyse links and text from images, QR codes, PDFs, documents and calendar items.\n(2) Add scanning coverage to the definition of done for every new client feature that displays content.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·4", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·4", "mitigation_principle": "Every modality a user can act on is a modality the scanner inspects.", "design_measures": [ "Extract and analyse links and text from images, QR codes, PDFs, documents and calendar items.", "Add scanning coverage to the definition of done for every new client feature that displays content." ] } } }, { "type": "relationship", "id": "relationship--9e523f2d-ad66-52b2-afb5-a589abdf1cfe", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fa6cbc2f-e4b8-58f7-b5f2-c65855a622ad", "target_ref": "attack-pattern--fa6cbc2f-e4b8-58f7-b5f2-c65855a622ad" }, { "type": "attack-pattern", "id": "attack-pattern--ef8c36c5-9e64-53ae-8d8a-0cb2b0735164", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Scanned Data Exposure", "description": "Mail sent to third-party engines, cloud sandboxes or model APIs leaks, or cached verdicts and samples cross tenants.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·3", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-3" }, { "source_name": "capec", "external_id": "CAPEC-204", "url": "https://capec.mitre.org/data/definitions/204.html", "description": "Lifting Sensitive Data Embedded in Cache" }, { "source_name": "cwe", "external_id": "CWE-524", "url": "https://cwe.mitre.org/data/definitions/524.html", "description": "Use of Cache Containing Sensitive Information" }, { "source_name": "cwe", "external_id": "CWE-201", "url": "https://cwe.mitre.org/data/definitions/201.html", "description": "Insertion of Sensitive Information Into Sent Data" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "content-scanners" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·3", "group_code": "CS", "group_name": "Content scanners", "stride": [ "I" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-204" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-524", "CWE-201" ] } } }, { "type": "course-of-action", "id": "course-of-action--ef8c36c5-9e64-53ae-8d8a-0cb2b0735164", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CS·3 Scanned Data Exposure", "description": "Content leaves the platform only under contract, and verdicts never cross tenants.\n\n(1) Restrict third-party engines to hash lookups by default and require tenant opt-in for sample submission, with retention terms in the contract.\n(2) Namespace verdict caches and samples per tenant so a cache hit reveals nothing about another tenant's mail.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·3", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·3", "mitigation_principle": "Content leaves the platform only under contract, and verdicts never cross tenants.", "design_measures": [ "Restrict third-party engines to hash lookups by default and require tenant opt-in for sample submission, with retention terms in the contract.", "Namespace verdict caches and samples per tenant so a cache hit reveals nothing about another tenant's mail." ] } } }, { "type": "relationship", "id": "relationship--1dd60ccf-6200-58da-be16-dd24189ae0fa", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ef8c36c5-9e64-53ae-8d8a-0cb2b0735164", "target_ref": "attack-pattern--ef8c36c5-9e64-53ae-8d8a-0cb2b0735164" }, { "type": "attack-pattern", "id": "attack-pattern--fa347b18-d201-50ca-b4ad-3a83bc978c7d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Exemption Abuse", "description": "Allow lists, trusted-sender rules and skip conditions exempt content from scanning altogether.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·2", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-2" }, { "source_name": "capec", "external_id": "CAPEC-554", "url": "https://capec.mitre.org/data/definitions/554.html", "description": "Functionality Bypass" }, { "source_name": "cwe", "external_id": "CWE-183", "url": "https://cwe.mitre.org/data/definitions/183.html", "description": "Permissive List of Allowed Inputs" }, { "source_name": "cwe", "external_id": "CWE-807", "url": "https://cwe.mitre.org/data/definitions/807.html", "description": "Reliance on Untrusted Inputs in a Security Decision" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "content-scanners" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·2", "group_code": "CS", "group_name": "Content scanners", "stride": [ "E" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-554" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-183", "CWE-807" ] } } }, { "type": "course-of-action", "id": "course-of-action--fa347b18-d201-50ca-b4ad-3a83bc978c7d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for CS·2 Exemption Abuse", "description": "Exemptions are scoped, verified, time-limited and reviewed.\n\n(1) Bind exemptions to a verified property (DKIM-aligned domain, authenticated connector), never to a header or address the sender controls.\n(2) Expire exemptions by default and show tenant admins a periodic review of active exemptions.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS·2", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "CS·2", "mitigation_principle": "Exemptions are scoped, verified, time-limited and reviewed.", "design_measures": [ "Bind exemptions to a verified property (DKIM-aligned domain, authenticated connector), never to a header or address the sender controls.", "Expire exemptions by default and show tenant admins a periodic review of active exemptions." ] } } }, { "type": "relationship", "id": "relationship--2322ae99-812a-5dcb-a15f-235819185f87", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fa347b18-d201-50ca-b4ad-3a83bc978c7d", "target_ref": "attack-pattern--fa347b18-d201-50ca-b4ad-3a83bc978c7d" }, { "type": "grouping", "id": "grouping--a8901405-cd3e-5615-9c65-941b6916d8a7", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Layer 07: Content scanners (CS)", "description": "A scanner is a probabilistic control that an attacker can study, evade and attack directly. These entries cover URL analysis, malware detection, sandboxes, machine learning (ML) and large language model (LLM) classifiers, and data loss prevention (DLP). Scope: URL, malware, sandbox, ML and LLM inspection engines.", "context": "unspecified", "object_refs": [ "attack-pattern--fef27589-a7f3-56d1-9e3b-62b9dca4bd0a", "course-of-action--fef27589-a7f3-56d1-9e3b-62b9dca4bd0a", "attack-pattern--3508ede9-fbf5-5ea4-9ee9-8c024d37b4e3", "course-of-action--3508ede9-fbf5-5ea4-9ee9-8c024d37b4e3", "attack-pattern--cb54e364-147f-587d-a782-fa1ae76babed", "course-of-action--cb54e364-147f-587d-a782-fa1ae76babed", "attack-pattern--3247e411-3a4c-5024-99ef-a0d83728c8fc", "course-of-action--3247e411-3a4c-5024-99ef-a0d83728c8fc", "attack-pattern--4b66952d-8017-55ee-b3be-2a29a0dbcd74", "course-of-action--4b66952d-8017-55ee-b3be-2a29a0dbcd74", "attack-pattern--a1bc919c-3e95-5a13-a297-7ffc1e8c9a1d", "course-of-action--a1bc919c-3e95-5a13-a297-7ffc1e8c9a1d", "attack-pattern--0c110976-0d65-5936-9d2a-282f6942e2bc", "course-of-action--0c110976-0d65-5936-9d2a-282f6942e2bc", "attack-pattern--c8d32865-4486-5d04-b5e8-ab70d8149493", "course-of-action--c8d32865-4486-5d04-b5e8-ab70d8149493", "attack-pattern--a188e5cc-d45c-51e2-91c6-bcde2e69687a", "course-of-action--a188e5cc-d45c-51e2-91c6-bcde2e69687a", "attack-pattern--109ad8b4-1f67-5749-a3af-2c467eeae9a5", "course-of-action--109ad8b4-1f67-5749-a3af-2c467eeae9a5", "attack-pattern--fa6cbc2f-e4b8-58f7-b5f2-c65855a622ad", "course-of-action--fa6cbc2f-e4b8-58f7-b5f2-c65855a622ad", "attack-pattern--ef8c36c5-9e64-53ae-8d8a-0cb2b0735164", "course-of-action--ef8c36c5-9e64-53ae-8d8a-0cb2b0735164", "attack-pattern--fa347b18-d201-50ca-b4ad-3a83bc978c7d", "course-of-action--fa347b18-d201-50ca-b4ad-3a83bc978c7d" ], "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "CS", "url": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--65baaf9f-d515-5a6b-9188-aef39ad6f730", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Display Name Deception", "description": "The interface shows the display name prominently and hides or truncates the address.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·A", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-a" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-98", "url": "https://capec.mitre.org/data/definitions/98.html", "description": "Phishing" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "human-facing-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·A", "group_code": "HF", "group_name": "Human-facing layer", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-148", "CAPEC-98" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-451" ] } } }, { "type": "course-of-action", "id": "course-of-action--65baaf9f-d515-5a6b-9188-aef39ad6f730", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for HF·A Display Name Deception", "description": "The address is as visible as the name, in every view.\n\n(1) Show the full sender address next to the display name in message lists, readers and notifications without extra taps.\n(2) Mark first-time senders and display names that look like addresses or match a known contact's name.\n(3) Keep the display name and address visually distinct (type, weight) so that an address-like display name cannot masquerade as the address.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·A", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·A", "mitigation_principle": "The address is as visible as the name, in every view.", "design_measures": [ "Show the full sender address next to the display name in message lists, readers and notifications without extra taps.", "Mark first-time senders and display names that look like addresses or match a known contact's name.", "Keep the display name and address visually distinct (type, weight) so that an address-like display name cannot masquerade as the address." ] } } }, { "type": "relationship", "id": "relationship--ff87272b-d696-5ecd-80f0-e27f20d80285", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--65baaf9f-d515-5a6b-9188-aef39ad6f730", "target_ref": "attack-pattern--65baaf9f-d515-5a6b-9188-aef39ad6f730" }, { "type": "attack-pattern", "id": "attack-pattern--2f962571-5288-5155-89b5-2191e664e30d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Lookalike Rendering", "description": "Homoglyph, internationalised and long-subdomain addresses are displayed without distinction from the genuine one.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·K", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-k" }, { "source_name": "capec", "external_id": "CAPEC-632", "url": "https://capec.mitre.org/data/definitions/632.html", "description": "Homograph Attack via Homoglyphs" }, { "source_name": "capec", "external_id": "CAPEC-630", "url": "https://capec.mitre.org/data/definitions/630.html", "description": "TypoSquatting" }, { "source_name": "cwe", "external_id": "CWE-1007", "url": "https://cwe.mitre.org/data/definitions/1007.html", "description": "Insufficient Visual Distinction of Homoglyphs Presented to User" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "human-facing-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·K", "group_code": "HF", "group_name": "Human-facing layer", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-632", "CAPEC-630" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-1007" ] } } }, { "type": "course-of-action", "id": "course-of-action--2f962571-5288-5155-89b5-2191e664e30d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for HF·K Lookalike Rendering", "description": "Confusable domains are displayed so that they do not look like the genuine one.\n\n(1) Render punycode and mixed-script domains in a distinct visual form and emphasise the registrable domain.\n(2) Compare the sender domain to the user's contacts and the tenant's domains, and flag close matches.\n(3) Apply the same rendering in notifications, previews and the compose window, not only in the reader.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·K", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·K", "mitigation_principle": "Confusable domains are displayed so that they do not look like the genuine one.", "design_measures": [ "Render punycode and mixed-script domains in a distinct visual form and emphasise the registrable domain.", "Compare the sender domain to the user's contacts and the tenant's domains, and flag close matches.", "Apply the same rendering in notifications, previews and the compose window, not only in the reader." ] } } }, { "type": "relationship", "id": "relationship--a403fa93-9c7b-5bc3-bed7-4e75a7f009df", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2f962571-5288-5155-89b5-2191e664e30d", "target_ref": "attack-pattern--2f962571-5288-5155-89b5-2191e664e30d" }, { "type": "attack-pattern", "id": "attack-pattern--aa480d46-7f58-530b-8c8f-9305df824d00", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Thread Hijack", "description": "An attacker's message is grouped into a trusted conversation and inherits its credibility.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-q" }, { "source_name": "capec", "external_id": "CAPEC-98", "url": "https://capec.mitre.org/data/definitions/98.html", "description": "Phishing" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" }, { "source_name": "cwe", "external_id": "CWE-1023", "url": "https://cwe.mitre.org/data/definitions/1023.html", "description": "Incomplete Comparison with Missing Factors" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "human-facing-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·Q", "group_code": "HF", "group_name": "Human-facing layer", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-98" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-451", "CWE-1023" ] } } }, { "type": "course-of-action", "id": "course-of-action--aa480d46-7f58-530b-8c8f-9305df824d00", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for HF·Q Thread Hijack", "description": "A thread groups only messages that provably belong together.\n\n(1) Thread on Message-ID, In-Reply-To and References, never on subject alone.\n(2) Show a visible break and a warning when a new sender or domain joins an existing thread.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·Q", "mitigation_principle": "A thread groups only messages that provably belong together.", "design_measures": [ "Thread on Message-ID, In-Reply-To and References, never on subject alone.", "Show a visible break and a warning when a new sender or domain joins an existing thread." ] } } }, { "type": "relationship", "id": "relationship--4335baf8-a584-58d6-abe7-52b01c1d0917", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--aa480d46-7f58-530b-8c8f-9305df824d00", "target_ref": "attack-pattern--aa480d46-7f58-530b-8c8f-9305df824d00" }, { "type": "attack-pattern", "id": "attack-pattern--846ac103-666b-5342-b50c-9716ff61849c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Indicator Spoofing", "description": "Banners, verified marks and \"scanned\" labels are imitated in the message body or suppressed by styling.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·J", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-j" }, { "source_name": "capec", "external_id": "CAPEC-222", "url": "https://capec.mitre.org/data/definitions/222.html", "description": "iFrame Overlay" }, { "source_name": "capec", "external_id": "CAPEC-173", "url": "https://capec.mitre.org/data/definitions/173.html", "description": "Action Spoofing" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" }, { "source_name": "cwe", "external_id": "CWE-1021", "url": "https://cwe.mitre.org/data/definitions/1021.html", "description": "Improper Restriction of Rendered UI Layers or Frames" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "human-facing-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·J", "group_code": "HF", "group_name": "Human-facing layer", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-222", "CAPEC-173" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-451", "CWE-1021" ] } } }, { "type": "course-of-action", "id": "course-of-action--846ac103-666b-5342-b50c-9716ff61849c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for HF·J Indicator Spoofing", "description": "Security indicators live where message content cannot draw.\n\n(1) Render banners, verified marks and warnings in client chrome outside the message body area.\n(2) Sanitise message styling so it cannot overlay, hide or imitate chrome elements, and never insert indicators into the body.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·J", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·J", "mitigation_principle": "Security indicators live where message content cannot draw.", "design_measures": [ "Render banners, verified marks and warnings in client chrome outside the message body area.", "Sanitise message styling so it cannot overlay, hide or imitate chrome elements, and never insert indicators into the body." ] } } }, { "type": "relationship", "id": "relationship--fb536298-70ca-5bcd-a958-5ada78b07d7c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--846ac103-666b-5342-b50c-9716ff61849c", "target_ref": "attack-pattern--846ac103-666b-5342-b50c-9716ff61849c" }, { "type": "attack-pattern", "id": "attack-pattern--1fba6bc1-84d9-5a5b-8bab-ad992ecd6f83", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Reply-Path Diversion", "description": "Replies go to an address different from the visible sender, and the interface does not surface it.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·10", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-10" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "human-facing-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·10", "group_code": "HF", "group_name": "Human-facing layer", "stride": [ "S", "I" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-148" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-451" ] } } }, { "type": "course-of-action", "id": "course-of-action--1fba6bc1-84d9-5a5b-8bab-ad992ecd6f83", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for HF·10 Reply-Path Diversion", "description": "The user sees where a reply will go before sending it.\n\n(1) Show the Reply-To address in the compose view when it differs from From, with a warning if the domain differs.\n(2) Treat a cross-domain Reply-To as a risk signal in scoring and in the reader's sender display.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·10", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·10", "mitigation_principle": "The user sees where a reply will go before sending it.", "design_measures": [ "Show the Reply-To address in the compose view when it differs from From, with a warning if the domain differs.", "Treat a cross-domain Reply-To as a risk signal in scoring and in the reader's sender display." ] } } }, { "type": "relationship", "id": "relationship--58b78932-0090-59a6-a51e-972ee7cda606", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1fba6bc1-84d9-5a5b-8bab-ad992ecd6f83", "target_ref": "attack-pattern--1fba6bc1-84d9-5a5b-8bab-ad992ecd6f83" }, { "type": "attack-pattern", "id": "attack-pattern--414752b0-419a-51fa-9bfd-d7999a9c90df", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Link Presentation Mismatch", "description": "The displayed link differs from its target, or rewriting hides the real destination from the user.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·9", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-9" }, { "source_name": "capec", "external_id": "CAPEC-173", "url": "https://capec.mitre.org/data/definitions/173.html", "description": "Action Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "human-facing-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·9", "group_code": "HF", "group_name": "Human-facing layer", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-173", "CAPEC-148" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-451" ] } } }, { "type": "course-of-action", "id": "course-of-action--414752b0-419a-51fa-9bfd-d7999a9c90df", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for HF·9 Link Presentation Mismatch", "description": "The user can see a link's true destination before following it.\n\n(1) Display the final destination domain on hover and long-press, including for rewritten links.\n(2) Flag link text that looks like a URL but points elsewhere.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·9", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·9", "mitigation_principle": "The user can see a link's true destination before following it.", "design_measures": [ "Display the final destination domain on hover and long-press, including for rewritten links.", "Flag link text that looks like a URL but points elsewhere." ] } } }, { "type": "relationship", "id": "relationship--b81008fa-f4f4-53bb-a55c-a4db8a1d08af", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--414752b0-419a-51fa-9bfd-d7999a9c90df", "target_ref": "attack-pattern--414752b0-419a-51fa-9bfd-d7999a9c90df" }, { "type": "attack-pattern", "id": "attack-pattern--4cdd6ee7-8673-5114-8286-ae22f29692c1", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Warning Fatigue", "description": "Warnings appear so often, or so indiscriminately, that users stop reading them.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·8", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-8" }, { "source_name": "capec", "external_id": "CAPEC-416", "url": "https://capec.mitre.org/data/definitions/416.html", "description": "Manipulate Human Behavior" }, { "source_name": "cwe", "external_id": "CWE-357", "url": "https://cwe.mitre.org/data/definitions/357.html", "description": "Insufficient UI Warning of Dangerous Operations" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "human-facing-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·8", "group_code": "HF", "group_name": "Human-facing layer", "stride": [ "S" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-416" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-357" ] } } }, { "type": "course-of-action", "id": "course-of-action--4cdd6ee7-8673-5114-8286-ae22f29692c1", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for HF·8 Warning Fatigue", "description": "Warnings are specific, rare and measured.\n\n(1) Replace the generic external banner with targeted warnings that say what is unusual and what to do.\n(2) Measure click-through after each warning type and retire the ones that do not change behaviour.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·8", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·8", "mitigation_principle": "Warnings are specific, rare and measured.", "design_measures": [ "Replace the generic external banner with targeted warnings that say what is unusual and what to do.", "Measure click-through after each warning type and retire the ones that do not change behaviour." ] } } }, { "type": "relationship", "id": "relationship--66c46f82-ebaf-5782-82f1-dc7436935c4c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4cdd6ee7-8673-5114-8286-ae22f29692c1", "target_ref": "attack-pattern--4cdd6ee7-8673-5114-8286-ae22f29692c1" }, { "type": "attack-pattern", "id": "attack-pattern--be56bb96-f860-5742-a390-5ad61310389b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Trusted Internal Sender", "description": "Mail from a compromised internal account carries no warning and receives more trust than external mail.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·7", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-7" }, { "source_name": "capec", "external_id": "CAPEC-163", "url": "https://capec.mitre.org/data/definitions/163.html", "description": "Spear Phishing" }, { "source_name": "cwe", "external_id": "CWE-424", "url": "https://cwe.mitre.org/data/definitions/424.html", "description": "Improper Protection of Alternate Path" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "human-facing-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·7", "group_code": "HF", "group_name": "Human-facing layer", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-163" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-424" ] } } }, { "type": "course-of-action", "id": "course-of-action--be56bb96-f860-5742-a390-5ad61310389b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for HF·7 Trusted Internal Sender", "description": "Internal mail earns no trust it has not been checked for.\n\n(1) Apply the same content scanning to internal and intra-platform mail as to external mail.\n(2) Surface behavioural anomalies for internal senders (new device, unusual volume, first-time recipients) in the recipient's view.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·7", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·7", "mitigation_principle": "Internal mail earns no trust it has not been checked for.", "design_measures": [ "Apply the same content scanning to internal and intra-platform mail as to external mail.", "Surface behavioural anomalies for internal senders (new device, unusual volume, first-time recipients) in the recipient's view." ] } } }, { "type": "relationship", "id": "relationship--c5f5f03e-e504-5fe4-8cf5-b9b3c5280acd", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--be56bb96-f860-5742-a390-5ad61310389b", "target_ref": "attack-pattern--be56bb96-f860-5742-a390-5ad61310389b" }, { "type": "attack-pattern", "id": "attack-pattern--ef9b52a1-1d16-553d-85ec-092a607bfc8c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Platform Feature Mimicry", "description": "Sharing invitations, calendar invites, quarantine digests and similar features deliver lures from genuine platform addresses.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·6", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-6" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" }, { "source_name": "cwe", "external_id": "CWE-424", "url": "https://cwe.mitre.org/data/definitions/424.html", "description": "Improper Protection of Alternate Path" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "human-facing-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·6", "group_code": "HF", "group_name": "Human-facing layer", "stride": [ "S" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-148" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-451", "CWE-424" ] } } }, { "type": "course-of-action", "id": "course-of-action--ef9b52a1-1d16-553d-85ec-092a607bfc8c", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for HF·6 Platform Feature Mimicry", "description": "Platform notifications carry no user-chosen content that could be a lure.\n\n(1) Scan sharing invitations, calendar invites and digests like any other mail, including user-supplied fields.\n(2) Render user-supplied text in notifications visibly separated from the platform's own text.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·6", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·6", "mitigation_principle": "Platform notifications carry no user-chosen content that could be a lure.", "design_measures": [ "Scan sharing invitations, calendar invites and digests like any other mail, including user-supplied fields.", "Render user-supplied text in notifications visibly separated from the platform's own text." ] } } }, { "type": "relationship", "id": "relationship--bdab6ca1-c7a7-5ec9-adce-a39fe46533d0", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ef9b52a1-1d16-553d-85ec-092a607bfc8c", "target_ref": "attack-pattern--ef9b52a1-1d16-553d-85ec-092a607bfc8c" }, { "type": "attack-pattern", "id": "attack-pattern--5361a3f2-d5c8-58da-987a-c963df65f59d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Auto-Added Content", "description": "Invites, contacts and autocomplete entries are created from unsolicited mail without the user's action.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·5", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-5" }, { "source_name": "cwe", "external_id": "CWE-356", "url": "https://cwe.mitre.org/data/definitions/356.html", "description": "Product UI does not Warn User of Unsafe Actions" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "human-facing-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·5", "group_code": "HF", "group_name": "Human-facing layer", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-356" ] } } }, { "type": "course-of-action", "id": "course-of-action--5361a3f2-d5c8-58da-987a-c963df65f59d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for HF·5 Auto-Added Content", "description": "Nothing is added to the user's calendar, contacts or autocomplete without their action.\n\n(1) Hold calendar invites from unknown senders as pending rather than adding tentative events.\n(2) Populate autocomplete only from addresses the user has sent to, not from inbound mail.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·5", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·5", "mitigation_principle": "Nothing is added to the user's calendar, contacts or autocomplete without their action.", "design_measures": [ "Hold calendar invites from unknown senders as pending rather than adding tentative events.", "Populate autocomplete only from addresses the user has sent to, not from inbound mail." ] } } }, { "type": "relationship", "id": "relationship--4fa9cf10-1fb6-54b3-93ea-f71ce292ed44", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5361a3f2-d5c8-58da-987a-c963df65f59d", "target_ref": "attack-pattern--5361a3f2-d5c8-58da-987a-c963df65f59d" }, { "type": "attack-pattern", "id": "attack-pattern--f32f1752-12e2-578a-ae32-9a8e8dc4eb8d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Assistant-Mediated Deception", "description": "AI summaries and suggested replies relay attacker content in the platform's own voice.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·4", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-4" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" }, { "source_name": "cwe", "external_id": "CWE-1427", "url": "https://cwe.mitre.org/data/definitions/1427.html", "description": "Improper Neutralization of Input Used for LLM Prompting" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "human-facing-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·4", "group_code": "HF", "group_name": "Human-facing layer", "stride": [ "S", "T" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-451", "CWE-1427" ] } } }, { "type": "course-of-action", "id": "course-of-action--f32f1752-12e2-578a-ae32-9a8e8dc4eb8d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for HF·4 Assistant-Mediated Deception", "description": "An assistant presents message content as the message's claim, never as the platform's.\n\n(1) Attribute every summarised statement to the message and exclude links and instructions from summaries.\n(2) Isolate message content from the assistant's instructions (see Scanner Prompt Injection) and give the assistant no actions beyond summarising.\n(3) Show the user the exact passage the assistant drew on for each claim, so that hidden or off-screen text is exposed when it is summarised.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·4", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·4", "mitigation_principle": "An assistant presents message content as the message's claim, never as the platform's.", "design_measures": [ "Attribute every summarised statement to the message and exclude links and instructions from summaries.", "Isolate message content from the assistant's instructions (see Scanner Prompt Injection) and give the assistant no actions beyond summarising.", "Show the user the exact passage the assistant drew on for each claim, so that hidden or off-screen text is exposed when it is summarised." ] } } }, { "type": "relationship", "id": "relationship--553b699c-dcd6-56d4-82bc-23b15622ec2e", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f32f1752-12e2-578a-ae32-9a8e8dc4eb8d", "target_ref": "attack-pattern--f32f1752-12e2-578a-ae32-9a8e8dc4eb8d" }, { "type": "attack-pattern", "id": "attack-pattern--395486c0-10f6-58ed-bbf9-5071e6c1b702", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Signal Loss in Compact Views", "description": "Mobile and condensed views drop the indicators the desktop design relies on.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·3", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-3" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "human-facing-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·3", "group_code": "HF", "group_name": "Human-facing layer", "stride": [ "S" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Direct", "cwe_ids": [ "CWE-451" ] } } }, { "type": "course-of-action", "id": "course-of-action--395486c0-10f6-58ed-bbf9-5071e6c1b702", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for HF·3 Signal Loss in Compact Views", "description": "Every surface a user can act from shows the signals the decision needs.\n\n(1) Define a minimum indicator set (sender address, external marker, warning) required on every surface, including notifications and quick replies.\n(2) Disable actions such as quick reply from surfaces that cannot show the minimum set.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·3", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·3", "mitigation_principle": "Every surface a user can act from shows the signals the decision needs.", "design_measures": [ "Define a minimum indicator set (sender address, external marker, warning) required on every surface, including notifications and quick replies.", "Disable actions such as quick reply from surfaces that cannot show the minimum set." ] } } }, { "type": "relationship", "id": "relationship--ea5754cd-c9f9-55e8-a366-20d4d56bd53f", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--395486c0-10f6-58ed-bbf9-5071e6c1b702", "target_ref": "attack-pattern--395486c0-10f6-58ed-bbf9-5071e6c1b702" }, { "type": "attack-pattern", "id": "attack-pattern--86097492-38a4-5a1a-af3e-1a1bf619a8b3", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Misdirected Send", "description": "Autocomplete, reply-all and group expansion lead the user to send to unintended recipients.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·2", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-2" }, { "source_name": "cwe", "external_id": "CWE-356", "url": "https://cwe.mitre.org/data/definitions/356.html", "description": "Product UI does not Warn User of Unsafe Actions" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "human-facing-layer" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·2", "group_code": "HF", "group_name": "Human-facing layer", "stride": [ "I" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-356", "CWE-451" ] } } }, { "type": "course-of-action", "id": "course-of-action--86097492-38a4-5a1a-af3e-1a1bf619a8b3", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for HF·2 Misdirected Send", "description": "The user sees who will receive a message before it leaves.\n\n(1) Warn on external, first-time and recently added recipients before sending.\n(2) Expand group recipients to a visible count and membership, and offer a short undo window after send.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF·2", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "HF·2", "mitigation_principle": "The user sees who will receive a message before it leaves.", "design_measures": [ "Warn on external, first-time and recently added recipients before sending.", "Expand group recipients to a visible count and membership, and offer a short undo window after send." ] } } }, { "type": "relationship", "id": "relationship--a54975a9-0192-5a83-83bc-08af63fa5dbb", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--86097492-38a4-5a1a-af3e-1a1bf619a8b3", "target_ref": "attack-pattern--86097492-38a4-5a1a-af3e-1a1bf619a8b3" }, { "type": "grouping", "id": "grouping--54941fb2-8310-57e2-8837-06e54e5079f3", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Layer 08: Human-facing layer (HF)", "description": "The interface decides which facts about a message a person sees before they act on it. These entries cover what the client and the platform present, and the decisions the design leaves to the user. Scope: What the client and platform present to the person reading or sending.", "context": "unspecified", "object_refs": [ "attack-pattern--65baaf9f-d515-5a6b-9188-aef39ad6f730", "course-of-action--65baaf9f-d515-5a6b-9188-aef39ad6f730", "attack-pattern--2f962571-5288-5155-89b5-2191e664e30d", "course-of-action--2f962571-5288-5155-89b5-2191e664e30d", "attack-pattern--aa480d46-7f58-530b-8c8f-9305df824d00", "course-of-action--aa480d46-7f58-530b-8c8f-9305df824d00", "attack-pattern--846ac103-666b-5342-b50c-9716ff61849c", "course-of-action--846ac103-666b-5342-b50c-9716ff61849c", "attack-pattern--1fba6bc1-84d9-5a5b-8bab-ad992ecd6f83", "course-of-action--1fba6bc1-84d9-5a5b-8bab-ad992ecd6f83", "attack-pattern--414752b0-419a-51fa-9bfd-d7999a9c90df", "course-of-action--414752b0-419a-51fa-9bfd-d7999a9c90df", "attack-pattern--4cdd6ee7-8673-5114-8286-ae22f29692c1", "course-of-action--4cdd6ee7-8673-5114-8286-ae22f29692c1", "attack-pattern--be56bb96-f860-5742-a390-5ad61310389b", "course-of-action--be56bb96-f860-5742-a390-5ad61310389b", "attack-pattern--ef9b52a1-1d16-553d-85ec-092a607bfc8c", "course-of-action--ef9b52a1-1d16-553d-85ec-092a607bfc8c", "attack-pattern--5361a3f2-d5c8-58da-987a-c963df65f59d", "course-of-action--5361a3f2-d5c8-58da-987a-c963df65f59d", "attack-pattern--f32f1752-12e2-578a-ae32-9a8e8dc4eb8d", "course-of-action--f32f1752-12e2-578a-ae32-9a8e8dc4eb8d", "attack-pattern--395486c0-10f6-58ed-bbf9-5071e6c1b702", "course-of-action--395486c0-10f6-58ed-bbf9-5071e6c1b702", "attack-pattern--86097492-38a4-5a1a-af3e-1a1bf619a8b3", "course-of-action--86097492-38a4-5a1a-af3e-1a1bf619a8b3" ], "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "HF", "url": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--dc11a52f-e5ce-5b9a-976f-ce9323b71c43", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Support Access", "description": "Platform staff can open, search or export any tenant's mailbox for troubleshooting, with no ticket, no tenant consent, no time limit and no record the tenant can see.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·A", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-a" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "operations-and-storage" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·A", "group_code": "OP", "group_name": "Operations and storage", "stride": [ "E", "I" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-122" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-1220", "CWE-778" ] } } }, { "type": "course-of-action", "id": "course-of-action--dc11a52f-e5ce-5b9a-976f-ce9323b71c43", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for OP·A Support Access", "description": "Support access to tenant data is consented, scoped, time-limited and visible to the tenant.\n\n(1) Require a ticket and the tenant's approval (or a documented emergency path with after-the-fact notice) before a support engineer can open a mailbox, and expire the access automatically.\n(2) Log every support access to an append-only store outside the admin console, and show tenants an access report they can audit.\n(3) Give support tooling the minimum view needed (headers, routing, logs) and make reading message bodies a separate, rarer privilege.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·A", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·A", "mitigation_principle": "Support access to tenant data is consented, scoped, time-limited and visible to the tenant.", "design_measures": [ "Require a ticket and the tenant's approval (or a documented emergency path with after-the-fact notice) before a support engineer can open a mailbox, and expire the access automatically.", "Log every support access to an append-only store outside the admin console, and show tenants an access report they can audit.", "Give support tooling the minimum view needed (headers, routing, logs) and make reading message bodies a separate, rarer privilege." ] } } }, { "type": "relationship", "id": "relationship--44cb4b2a-9a71-5dc4-88cb-89cf25719c87", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--dc11a52f-e5ce-5b9a-976f-ce9323b71c43", "target_ref": "attack-pattern--dc11a52f-e5ce-5b9a-976f-ce9323b71c43" }, { "type": "attack-pattern", "id": "attack-pattern--a53ce561-eba0-52a4-bbdf-6e93d6803c0d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Bulk Export", "description": "Compliance search, eDiscovery and mailbox export move whole mailboxes or tenants out of the platform in one action, under weaker controls than the mailbox itself.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·K", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-k" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-424", "url": "https://cwe.mitre.org/data/definitions/424.html", "description": "Improper Protection of Alternate Path" }, { "source_name": "cwe", "external_id": "CWE-799", "url": "https://cwe.mitre.org/data/definitions/799.html", "description": "Improper Control of Interaction Frequency" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "operations-and-storage" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·K", "group_code": "OP", "group_name": "Operations and storage", "stride": [ "I" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-122" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-424", "CWE-799" ] } } }, { "type": "course-of-action", "id": "course-of-action--a53ce561-eba0-52a4-bbdf-6e93d6803c0d", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for OP·K Bulk Export", "description": "Bulk export is a privileged, approved, rate-limited and visible operation.\n\n(1) Require a second approver or a step-up factor for any export of a whole mailbox or tenant, and notify the mailbox owner and tenant admin when it happens.\n(2) Deliver exports only to an authenticated, short-lived location, scanned and watermarked, and log who downloaded them.\n(3) Cap export volume per actor and per day, and alert on exports that do not match the actor's history.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·K", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·K", "mitigation_principle": "Bulk export is a privileged, approved, rate-limited and visible operation.", "design_measures": [ "Require a second approver or a step-up factor for any export of a whole mailbox or tenant, and notify the mailbox owner and tenant admin when it happens.", "Deliver exports only to an authenticated, short-lived location, scanned and watermarked, and log who downloaded them.", "Cap export volume per actor and per day, and alert on exports that do not match the actor's history." ] } } }, { "type": "relationship", "id": "relationship--58bb97ef-a1dc-5141-9b25-556a39293ebb", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a53ce561-eba0-52a4-bbdf-6e93d6803c0d", "target_ref": "attack-pattern--a53ce561-eba0-52a4-bbdf-6e93d6803c0d" }, { "type": "attack-pattern", "id": "attack-pattern--b40d19c7-a81f-50f1-b050-92099a14a747", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Archive as Second Mailbox", "description": "A journal or archive holds a copy of every message, indefinitely, under its own access model, outside remediation, retention and the mailbox's permissions.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-q" }, { "source_name": "capec", "external_id": "CAPEC-150", "url": "https://capec.mitre.org/data/definitions/150.html", "description": "Collect Data from Common Resource Locations" }, { "source_name": "cwe", "external_id": "CWE-424", "url": "https://cwe.mitre.org/data/definitions/424.html", "description": "Improper Protection of Alternate Path" }, { "source_name": "cwe", "external_id": "CWE-1250", "url": "https://cwe.mitre.org/data/definitions/1250.html", "description": "Improper Preservation of Consistency Between Independent Representations of Shared State" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "operations-and-storage" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·Q", "group_code": "OP", "group_name": "Operations and storage", "stride": [ "I" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-150" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-424", "CWE-1250" ] } } }, { "type": "course-of-action", "id": "course-of-action--b40d19c7-a81f-50f1-b050-92099a14a747", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for OP·Q Archive as Second Mailbox", "description": "Every copy of a message is under the same access, remediation and retention model as the mailbox.\n\n(1) Enforce mailbox-level permissions on archive search, so that no one can read in the archive what they cannot read in the mailbox.\n(2) Make remediation, deletion and legal hold propagate to the archive in the same transaction, and reconcile the two stores on a schedule.\n(3) Put the archive on the platform's threat model and data-flow diagram as a store in its own right.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·Q", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·Q", "mitigation_principle": "Every copy of a message is under the same access, remediation and retention model as the mailbox.", "design_measures": [ "Enforce mailbox-level permissions on archive search, so that no one can read in the archive what they cannot read in the mailbox.", "Make remediation, deletion and legal hold propagate to the archive in the same transaction, and reconcile the two stores on a schedule.", "Put the archive on the platform's threat model and data-flow diagram as a store in its own right." ] } } }, { "type": "relationship", "id": "relationship--d2f012ee-9209-5a8c-a10c-e0fcef993d59", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b40d19c7-a81f-50f1-b050-92099a14a747", "target_ref": "attack-pattern--b40d19c7-a81f-50f1-b050-92099a14a747" }, { "type": "attack-pattern", "id": "attack-pattern--465740ba-7b3d-5a9d-a3a1-6affa0d1d9a8", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Backup Exposure", "description": "Backups and snapshots hold mail, keys and credentials under a different key, a different access model and a different lifetime, and a restore reintroduces what remediation removed.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·J", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-j" }, { "source_name": "capec", "external_id": "CAPEC-150", "url": "https://capec.mitre.org/data/definitions/150.html", "description": "Collect Data from Common Resource Locations" }, { "source_name": "cwe", "external_id": "CWE-530", "url": "https://cwe.mitre.org/data/definitions/530.html", "description": "Exposure of Backup File to an Unauthorized Control Sphere" }, { "source_name": "cwe", "external_id": "CWE-1250", "url": "https://cwe.mitre.org/data/definitions/1250.html", "description": "Improper Preservation of Consistency Between Independent Representations of Shared State" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "operations-and-storage" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·J", "group_code": "OP", "group_name": "Operations and storage", "stride": [ "I" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-150" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-530", "CWE-1250" ] } } }, { "type": "course-of-action", "id": "course-of-action--465740ba-7b3d-5a9d-a3a1-6affa0d1d9a8", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for OP·J Backup Exposure", "description": "Backups are encrypted, restore is privileged, and a restore re-applies every control the live store enforces.\n\n(1) Encrypt backups with keys held outside the backup service, require two people to restore, and log every restore.\n(2) Run remediation, retention and legal hold against restored data before it becomes visible, and restore into a quarantined store by default.\n(3) Apply the live store's access model and lifetime to snapshots, and delete them on schedule.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·J", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·J", "mitigation_principle": "Backups are encrypted, restore is privileged, and a restore re-applies every control the live store enforces.", "design_measures": [ "Encrypt backups with keys held outside the backup service, require two people to restore, and log every restore.", "Run remediation, retention and legal hold against restored data before it becomes visible, and restore into a quarantined store by default.", "Apply the live store's access model and lifetime to snapshots, and delete them on schedule." ] } } }, { "type": "relationship", "id": "relationship--289f8a94-2f5d-5953-bb4e-44f8b6de1236", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--465740ba-7b3d-5a9d-a3a1-6affa0d1d9a8", "target_ref": "attack-pattern--465740ba-7b3d-5a9d-a3a1-6affa0d1d9a8" }, { "type": "attack-pattern", "id": "attack-pattern--b9a839dc-0b74-51ec-a379-7b1670a06971", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unreviewed Configuration Change", "description": "Platform-wide security configuration (policies, scanner thresholds, allow lists, connectors, TLS settings) is edited live, with no review, no diff and no record of the intended state.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·10", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-10" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "operations-and-storage" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·10", "group_code": "OP", "group_name": "Operations and storage", "stride": [ "T", "R" ], "stride_fit": "Clean", "capec_match": "Direct", "capec_ids": [ "CAPEC-176" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-778" ] } } }, { "type": "course-of-action", "id": "course-of-action--b9a839dc-0b74-51ec-a379-7b1670a06971", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for OP·10 Unreviewed Configuration Change", "description": "Security configuration is declared, reviewed, versioned and reconciled.\n\n(1) Keep the intended configuration as versioned code with a required reviewer, and apply it through a pipeline rather than by hand in a console.\n(2) Reconcile the live configuration against the declared state continuously and alert on drift, including changes made through break-glass paths.\n(3) Rehearse rollback of every security control's configuration and keep the last known-good state available.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·10", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·10", "mitigation_principle": "Security configuration is declared, reviewed, versioned and reconciled.", "design_measures": [ "Keep the intended configuration as versioned code with a required reviewer, and apply it through a pipeline rather than by hand in a console.", "Reconcile the live configuration against the declared state continuously and alert on drift, including changes made through break-glass paths.", "Rehearse rollback of every security control's configuration and keep the last known-good state available." ] } } }, { "type": "relationship", "id": "relationship--382f9593-bf49-542d-a1f3-19e9e40bc517", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b9a839dc-0b74-51ec-a379-7b1670a06971", "target_ref": "attack-pattern--b9a839dc-0b74-51ec-a379-7b1670a06971" }, { "type": "attack-pattern", "id": "attack-pattern--9499cd59-d2e0-5112-89d4-0d77fa326733", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Connector Credentials", "description": "Credentials for connectors, partner APIs, cloud storage and internal services sit in configuration, are shared across tenants or services, and are never rotated or scoped.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·9", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-9" }, { "source_name": "capec", "external_id": "CAPEC-555", "url": "https://capec.mitre.org/data/definitions/555.html", "description": "Remote Services with Stolen Credentials" }, { "source_name": "capec", "external_id": "CAPEC-560", "url": "https://capec.mitre.org/data/definitions/560.html", "description": "Use of Known Domain Credentials" }, { "source_name": "cwe", "external_id": "CWE-260", "url": "https://cwe.mitre.org/data/definitions/260.html", "description": "Password in Configuration File" }, { "source_name": "cwe", "external_id": "CWE-522", "url": "https://cwe.mitre.org/data/definitions/522.html", "description": "Insufficiently Protected Credentials" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "operations-and-storage" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·9", "group_code": "OP", "group_name": "Operations and storage", "stride": [ "S", "E" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-555", "CAPEC-560" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-260", "CWE-522" ] } } }, { "type": "course-of-action", "id": "course-of-action--9499cd59-d2e0-5112-89d4-0d77fa326733", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for OP·9 Connector Credentials", "description": "Each credential is scoped to one purpose and one tenant, held in a secrets store, and rotated.\n\n(1) Store connector and partner credentials in a secrets manager with per-service access, never in configuration files or environment variables shared across services.\n(2) Issue one credential per tenant and per integration, scoped to the narrowest API permission, and rotate on a schedule and on staff departure.\n(3) Monitor the use of each credential and revoke on anomalous use.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·9", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·9", "mitigation_principle": "Each credential is scoped to one purpose and one tenant, held in a secrets store, and rotated.", "design_measures": [ "Store connector and partner credentials in a secrets manager with per-service access, never in configuration files or environment variables shared across services.", "Issue one credential per tenant and per integration, scoped to the narrowest API permission, and rotate on a schedule and on staff departure.", "Monitor the use of each credential and revoke on anomalous use." ] } } }, { "type": "relationship", "id": "relationship--ce0e7b9f-a986-5a3c-ae40-7d3e2d730d13", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9499cd59-d2e0-5112-89d4-0d77fa326733", "target_ref": "attack-pattern--9499cd59-d2e0-5112-89d4-0d77fa326733" }, { "type": "attack-pattern", "id": "attack-pattern--6e9add88-4c2f-5351-aec3-d2130122c6d1", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Retention and Deletion Gap", "description": "Deletion, retention and legal hold are applied to the mailbox and not to its copies (cache, index, archive, backup, quarantine), so mail persists where it should not or vanishes where it must be kept.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·8", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-8" }, { "source_name": "cwe", "external_id": "CWE-1250", "url": "https://cwe.mitre.org/data/definitions/1250.html", "description": "Improper Preservation of Consistency Between Independent Representations of Shared State" }, { "source_name": "cwe", "external_id": "CWE-459", "url": "https://cwe.mitre.org/data/definitions/459.html", "description": "Incomplete Cleanup" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "operations-and-storage" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·8", "group_code": "OP", "group_name": "Operations and storage", "stride": [ "I", "R" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-1250", "CWE-459" ] } } }, { "type": "course-of-action", "id": "course-of-action--6e9add88-4c2f-5351-aec3-d2130122c6d1", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for OP·8 Retention and Deletion Gap", "description": "Deletion, retention and hold are enforced across every copy, and the platform can prove it.\n\n(1) Maintain an inventory of every store that holds message copies, and drive deletion, retention and hold from one service that reaches all of them.\n(2) Treat a copy that cannot be reached by hold or deletion as a defect, and reconcile stores against the inventory on a schedule.\n(3) Produce a deletion certificate per request that lists each store and the time the copy was removed.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·8", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·8", "mitigation_principle": "Deletion, retention and hold are enforced across every copy, and the platform can prove it.", "design_measures": [ "Maintain an inventory of every store that holds message copies, and drive deletion, retention and hold from one service that reaches all of them.", "Treat a copy that cannot be reached by hold or deletion as a defect, and reconcile stores against the inventory on a schedule.", "Produce a deletion certificate per request that lists each store and the time the copy was removed." ] } } }, { "type": "relationship", "id": "relationship--d6a71ae7-8127-5ad7-822c-31181af9acf0", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6e9add88-4c2f-5351-aec3-d2130122c6d1", "target_ref": "attack-pattern--6e9add88-4c2f-5351-aec3-d2130122c6d1" }, { "type": "attack-pattern", "id": "attack-pattern--76f5f586-0f04-52b5-b395-f535aec6b4c4", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Content in Logs", "description": "Message content, addresses, subjects, URLs, tokens and headers end up in logs, traces, crash dumps, metrics labels and support tickets, often shipped to a third party.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·7", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-7" }, { "source_name": "capec", "external_id": "CAPEC-37", "url": "https://capec.mitre.org/data/definitions/37.html", "description": "Retrieve Embedded Sensitive Data" }, { "source_name": "cwe", "external_id": "CWE-532", "url": "https://cwe.mitre.org/data/definitions/532.html", "description": "Insertion of Sensitive Information into Log File" }, { "source_name": "cwe", "external_id": "CWE-528", "url": "https://cwe.mitre.org/data/definitions/528.html", "description": "Exposure of Core Dump File to an Unauthorized Control Sphere" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "operations-and-storage" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·7", "group_code": "OP", "group_name": "Operations and storage", "stride": [ "I" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-37" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-532", "CWE-528" ] } } }, { "type": "course-of-action", "id": "course-of-action--76f5f586-0f04-52b5-b395-f535aec6b4c4", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for OP·7 Content in Logs", "description": "Logs carry identifiers, never content, and leave the platform only under contract.\n\n(1) Define an allow list of loggable fields (message ID, tenant, sizes, verdicts, timings) and strip or hash everything else at the logging library, not in each service.\n(2) Keep logs that must carry content (forensics) in a separate store with its own access control and retention, inside the platform.\n(3) Test with messages whose content is a canary string and alert when it appears in any log, trace or ticket.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·7", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·7", "mitigation_principle": "Logs carry identifiers, never content, and leave the platform only under contract.", "design_measures": [ "Define an allow list of loggable fields (message ID, tenant, sizes, verdicts, timings) and strip or hash everything else at the logging library, not in each service.", "Keep logs that must carry content (forensics) in a separate store with its own access control and retention, inside the platform.", "Test with messages whose content is a canary string and alert when it appears in any log, trace or ticket." ] } } }, { "type": "relationship", "id": "relationship--eed62ac6-1f8a-5264-b2fb-8667736bd7c6", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--76f5f586-0f04-52b5-b395-f535aec6b4c4", "target_ref": "attack-pattern--76f5f586-0f04-52b5-b395-f535aec6b4c4" }, { "type": "attack-pattern", "id": "attack-pattern--de6c328a-d3e7-5ed4-b8a1-8b8b90003372", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Search Index Leakage", "description": "Search and indexing services hold message content with their own access model, so a query can return what the mailbox permissions would refuse, or another tenant's mail.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·6", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-6" }, { "source_name": "capec", "external_id": "CAPEC-1", "url": "https://capec.mitre.org/data/definitions/1.html", "description": "Accessing Functionality Not Properly Constrained by ACLs" }, { "source_name": "capec", "external_id": "CAPEC-180", "url": "https://capec.mitre.org/data/definitions/180.html", "description": "Exploiting Incorrectly Configured Access Control Security Levels" }, { "source_name": "cwe", "external_id": "CWE-1230", "url": "https://cwe.mitre.org/data/definitions/1230.html", "description": "Exposure of Sensitive Information Through Metadata" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "operations-and-storage" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·6", "group_code": "OP", "group_name": "Operations and storage", "stride": [ "I", "E" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-1", "CAPEC-180" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-1230" ] } } }, { "type": "course-of-action", "id": "course-of-action--de6c328a-d3e7-5ed4-b8a1-8b8b90003372", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for OP·6 Search Index Leakage", "description": "The index enforces the same tenancy and permissions as the mailbox store, at query time.\n\n(1) Partition the index per tenant with the tenant identity enforced in the index service from the authenticated session, not from a caller-supplied field.\n(2) Apply mailbox permissions at query time by joining against the authorisation source, rather than by rebuilding the index on a schedule.\n(3) Treat suggestions, autocomplete and result counts as content and subject them to the same checks.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·6", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·6", "mitigation_principle": "The index enforces the same tenancy and permissions as the mailbox store, at query time.", "design_measures": [ "Partition the index per tenant with the tenant identity enforced in the index service from the authenticated session, not from a caller-supplied field.", "Apply mailbox permissions at query time by joining against the authorisation source, rather than by rebuilding the index on a schedule.", "Treat suggestions, autocomplete and result counts as content and subject them to the same checks." ] } } }, { "type": "relationship", "id": "relationship--5235c614-7e8f-5dbd-9559-517c9d1175c0", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--de6c328a-d3e7-5ed4-b8a1-8b8b90003372", "target_ref": "attack-pattern--de6c328a-d3e7-5ed4-b8a1-8b8b90003372" }, { "type": "attack-pattern", "id": "attack-pattern--9663d6a3-9c1a-5e76-b605-2e53384347f3", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Audit Gap", "description": "Security-relevant actions (quarantine release, rule and allow-list changes, support access, exports, key operations) are unlogged, logged mutably, or logged without the person who acted.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·5", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-5" }, { "source_name": "capec", "external_id": "CAPEC-268", "url": "https://capec.mitre.org/data/definitions/268.html", "description": "Audit Log Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-571", "url": "https://capec.mitre.org/data/definitions/571.html", "description": "Block Logging to Central Repository" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "cwe", "external_id": "CWE-223", "url": "https://cwe.mitre.org/data/definitions/223.html", "description": "Omission of Security-relevant Information" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "operations-and-storage" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·5", "group_code": "OP", "group_name": "Operations and storage", "stride": [ "R" ], "stride_fit": "Clean", "capec_match": "Partial", "capec_ids": [ "CAPEC-268", "CAPEC-571" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-778", "CWE-223" ] } } }, { "type": "course-of-action", "id": "course-of-action--9663d6a3-9c1a-5e76-b605-2e53384347f3", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for OP·5 Audit Gap", "description": "Every security-relevant action is logged, immutably, and attributed to a person.\n\n(1) Enumerate security-relevant actions from the threat model and fail the release of any feature that performs one without logging it.\n(2) Write audit records to an append-only store that platform operators cannot alter, with retention set by policy.\n(3) Require individual authentication for privileged actions, so no audit record points at a shared role or a service account.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·5", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·5", "mitigation_principle": "Every security-relevant action is logged, immutably, and attributed to a person.", "design_measures": [ "Enumerate security-relevant actions from the threat model and fail the release of any feature that performs one without logging it.", "Write audit records to an append-only store that platform operators cannot alter, with retention set by policy.", "Require individual authentication for privileged actions, so no audit record points at a shared role or a service account." ] } } }, { "type": "relationship", "id": "relationship--9e66f29b-bc1c-58b9-91ae-2eef9acd12b4", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9663d6a3-9c1a-5e76-b605-2e53384347f3", "target_ref": "attack-pattern--9663d6a3-9c1a-5e76-b605-2e53384347f3" }, { "type": "attack-pattern", "id": "attack-pattern--0ef1d95b-a77e-51ab-8e68-0a4ea41b9742", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Offboarding Residue", "description": "When a tenant, user or integration leaves, its data, domains, keys, connectors, tokens and archive copies linger, and whoever acquires its name inherits them.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·4", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-4" }, { "source_name": "cwe", "external_id": "CWE-226", "url": "https://cwe.mitre.org/data/definitions/226.html", "description": "Sensitive Information in Resource Not Removed Before Reuse" }, { "source_name": "cwe", "external_id": "CWE-672", "url": "https://cwe.mitre.org/data/definitions/672.html", "description": "Operation on a Resource after Expiration or Release" }, { "source_name": "cwe", "external_id": "CWE-459", "url": "https://cwe.mitre.org/data/definitions/459.html", "description": "Incomplete Cleanup" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "operations-and-storage" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·4", "group_code": "OP", "group_name": "Operations and storage", "stride": [ "E", "S" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-226", "CWE-672", "CWE-459" ] } } }, { "type": "course-of-action", "id": "course-of-action--0ef1d95b-a77e-51ab-8e68-0a4ea41b9742", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for OP·4 Offboarding Residue", "description": "Offboarding is a defined procedure that removes or neutralises everything the departed party was given.\n\n(1) Keep an inventory of what each tenant, user and integration owns (data, domains, keys, connectors, tokens, grants) and drive offboarding from it, with a verifiable end state.\n(2) Hold departed tenants' domains and names in a cooling-off state that no new tenant can claim, and revoke every token, session and delegation at user departure.\n(3) Delete or quarantine residual data on a schedule and report what remains.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·4", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·4", "mitigation_principle": "Offboarding is a defined procedure that removes or neutralises everything the departed party was given.", "design_measures": [ "Keep an inventory of what each tenant, user and integration owns (data, domains, keys, connectors, tokens, grants) and drive offboarding from it, with a verifiable end state.", "Hold departed tenants' domains and names in a cooling-off state that no new tenant can claim, and revoke every token, session and delegation at user departure.", "Delete or quarantine residual data on a schedule and report what remains." ] } } }, { "type": "relationship", "id": "relationship--d8007ebc-8440-5dd5-a4ba-08e03a797d5b", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0ef1d95b-a77e-51ab-8e68-0a4ea41b9742", "target_ref": "attack-pattern--0ef1d95b-a77e-51ab-8e68-0a4ea41b9742" }, { "type": "attack-pattern", "id": "attack-pattern--2f944677-b326-55d6-9c19-6e9d8242e8fd", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Alert Flood", "description": "Monitoring raises one alert per event, so attacker-generated volume buries the alert that matters, and the on-call learns to ignore the channel.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·3", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-3" }, { "source_name": "capec", "external_id": "CAPEC-125", "url": "https://capec.mitre.org/data/definitions/125.html", "description": "Flooding" }, { "source_name": "cwe", "external_id": "CWE-779", "url": "https://cwe.mitre.org/data/definitions/779.html", "description": "Logging of Excessive Data" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "operations-and-storage" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·3", "group_code": "OP", "group_name": "Operations and storage", "stride": [ "R", "D" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-125" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-779" ] } } }, { "type": "course-of-action", "id": "course-of-action--2f944677-b326-55d6-9c19-6e9d8242e8fd", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for OP·3 Alert Flood", "description": "Alerts are rate-limited, grouped by cause, and the ones about people and privilege have their own channel.\n\n(1) Aggregate message-level alerts by campaign and source, and cap the rate at which any one cause can raise alerts.\n(2) Route alerts about privileged actions (support access, exports, configuration changes, key operations) to a separate, low-volume channel with a named owner.\n(3) Measure alert volume and response, and remove any alert that has not led to action in a defined period.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·3", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·3", "mitigation_principle": "Alerts are rate-limited, grouped by cause, and the ones about people and privilege have their own channel.", "design_measures": [ "Aggregate message-level alerts by campaign and source, and cap the rate at which any one cause can raise alerts.", "Route alerts about privileged actions (support access, exports, configuration changes, key operations) to a separate, low-volume channel with a named owner.", "Measure alert volume and response, and remove any alert that has not led to action in a defined period." ] } } }, { "type": "relationship", "id": "relationship--bdde1174-2ad6-55d3-bed2-cb34752fa7e0", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2f944677-b326-55d6-9c19-6e9d8242e8fd", "target_ref": "attack-pattern--2f944677-b326-55d6-9c19-6e9d8242e8fd" }, { "type": "attack-pattern", "id": "attack-pattern--01c5d2dc-9f5c-554d-aa76-2a4fa9f71bf9", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Production Data Elsewhere", "description": "Copies of production mail are used in staging, test, analytics and model training, under weaker credentials, broader access and no retention.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·2", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-2" }, { "source_name": "cwe", "external_id": "CWE-212", "url": "https://cwe.mitre.org/data/definitions/212.html", "description": "Improper Removal of Sensitive Information Before Storage or Transfer" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "operations-and-storage" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·2", "group_code": "OP", "group_name": "Operations and storage", "stride": [ "I" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-212" ] } } }, { "type": "course-of-action", "id": "course-of-action--01c5d2dc-9f5c-554d-aa76-2a4fa9f71bf9", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for OP·2 Production Data Elsewhere", "description": "Real mail exists only in production, and anything derived from it is minimised and controlled.\n\n(1) Generate synthetic mail for staging and test, and forbid restores of production data into any other environment.\n(2) Where analytics or model training needs real content, minimise it at source, process it inside production's controls, and delete it on schedule.\n(3) Treat every non-production environment that holds tenant data as production for access control and monitoring.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP·2", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "OP·2", "mitigation_principle": "Real mail exists only in production, and anything derived from it is minimised and controlled.", "design_measures": [ "Generate synthetic mail for staging and test, and forbid restores of production data into any other environment.", "Where analytics or model training needs real content, minimise it at source, process it inside production's controls, and delete it on schedule.", "Treat every non-production environment that holds tenant data as production for access control and monitoring." ] } } }, { "type": "relationship", "id": "relationship--ae64e780-5252-5513-9801-9368b35c1999", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--01c5d2dc-9f5c-554d-aa76-2a4fa9f71bf9", "target_ref": "attack-pattern--01c5d2dc-9f5c-554d-aa76-2a4fa9f71bf9" }, { "type": "grouping", "id": "grouping--207c74cb-0eab-5fd0-afda-281e695331cd", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Layer 09: Operations and storage (OP)", "description": "The operational plane holds more copies of every message than the mailbox store does, each under a weaker access model. These entries cover archive, backup, search and logs, support and export tooling, configuration, credentials and offboarding. Scope: The operational plane: archive, backup, search, logs, support access, configuration, offboarding.", "context": "unspecified", "object_refs": [ "attack-pattern--dc11a52f-e5ce-5b9a-976f-ce9323b71c43", "course-of-action--dc11a52f-e5ce-5b9a-976f-ce9323b71c43", "attack-pattern--a53ce561-eba0-52a4-bbdf-6e93d6803c0d", "course-of-action--a53ce561-eba0-52a4-bbdf-6e93d6803c0d", "attack-pattern--b40d19c7-a81f-50f1-b050-92099a14a747", "course-of-action--b40d19c7-a81f-50f1-b050-92099a14a747", "attack-pattern--465740ba-7b3d-5a9d-a3a1-6affa0d1d9a8", "course-of-action--465740ba-7b3d-5a9d-a3a1-6affa0d1d9a8", "attack-pattern--b9a839dc-0b74-51ec-a379-7b1670a06971", "course-of-action--b9a839dc-0b74-51ec-a379-7b1670a06971", "attack-pattern--9499cd59-d2e0-5112-89d4-0d77fa326733", "course-of-action--9499cd59-d2e0-5112-89d4-0d77fa326733", "attack-pattern--6e9add88-4c2f-5351-aec3-d2130122c6d1", "course-of-action--6e9add88-4c2f-5351-aec3-d2130122c6d1", "attack-pattern--76f5f586-0f04-52b5-b395-f535aec6b4c4", "course-of-action--76f5f586-0f04-52b5-b395-f535aec6b4c4", "attack-pattern--de6c328a-d3e7-5ed4-b8a1-8b8b90003372", "course-of-action--de6c328a-d3e7-5ed4-b8a1-8b8b90003372", "attack-pattern--9663d6a3-9c1a-5e76-b605-2e53384347f3", "course-of-action--9663d6a3-9c1a-5e76-b605-2e53384347f3", "attack-pattern--0ef1d95b-a77e-51ab-8e68-0a4ea41b9742", "course-of-action--0ef1d95b-a77e-51ab-8e68-0a4ea41b9742", "attack-pattern--2f944677-b326-55d6-9c19-6e9d8242e8fd", "course-of-action--2f944677-b326-55d6-9c19-6e9d8242e8fd", "attack-pattern--01c5d2dc-9f5c-554d-aa76-2a4fa9f71bf9", "course-of-action--01c5d2dc-9f5c-554d-aa76-2a4fa9f71bf9" ], "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "OP", "url": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--5ccd4709-6cd7-5cdf-b138-cb3aef4cefa0", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Envelope and Header Duality", "description": "The identity used for routing and the identity shown to the user are independent, and every control must choose which one it checks.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T8", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t8" }, { "source_name": "capec", "external_id": "CAPEC-43", "url": "https://capec.mitre.org/data/definitions/43.html", "description": "Exploiting Multiple Input Interpretation Layers" }, { "source_name": "cwe", "external_id": "CWE-348", "url": "https://cwe.mitre.org/data/definitions/348.html", "description": "Use of Less Trusted Source" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T8", "group_code": "T", "group_name": "Structural hazards", "stride": [ "S" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-43" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-348" ] } } }, { "type": "course-of-action", "id": "course-of-action--5ccd4709-6cd7-5cdf-b138-cb3aef4cefa0", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for T8 Envelope and Header Duality", "description": "One sender identity is resolved at ingress, and it is the identity every control checks and every user sees.\n\n(1) Resolve a single canonical sender identity at the edge, reject messages where envelope and header identities are ambiguous, and carry the resolved identity in metadata.\n(2) Display only the resolved identity in clients, and make every control document which identity it evaluates.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T8", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T8", "mitigation_principle": "One sender identity is resolved at ingress, and it is the identity every control checks and every user sees.", "design_measures": [ "Resolve a single canonical sender identity at the edge, reject messages where envelope and header identities are ambiguous, and carry the resolved identity in metadata.", "Display only the resolved identity in clients, and make every control document which identity it evaluates." ] } } }, { "type": "relationship", "id": "relationship--9540d7a7-a997-5627-a03f-c21770e67484", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5ccd4709-6cd7-5cdf-b138-cb3aef4cefa0", "target_ref": "attack-pattern--5ccd4709-6cd7-5cdf-b138-cb3aef4cefa0" }, { "type": "attack-pattern", "id": "attack-pattern--5e1b0c5e-e70a-5483-9af4-78220b8c53d4", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Hop-by-Hop Trust", "description": "There is no end-to-end guarantee; each hop trusts the last, so the path is as strong as its weakest hop.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T7", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t7" }, { "source_name": "capec", "external_id": "CAPEC-21", "url": "https://capec.mitre.org/data/definitions/21.html", "description": "Exploitation of Trusted Identifiers" }, { "source_name": "cwe", "external_id": "CWE-807", "url": "https://cwe.mitre.org/data/definitions/807.html", "description": "Reliance on Untrusted Inputs in a Security Decision" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T7", "group_code": "T", "group_name": "Structural hazards", "stride": [ "S", "T" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-21" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-807" ] } } }, { "type": "course-of-action", "id": "course-of-action--5e1b0c5e-e70a-5483-9af4-78220b8c53d4", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for T7 Hop-by-Hop Trust", "description": "The platform verifies for itself what it needs to trust, independent of what earlier hops claim.\n\n(1) Strip inbound trust assertions at every ingress and re-derive them from what the platform can verify.\n(2) Identify the hop whose compromise would be believed by all the others, and remove that single point of trust.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T7", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T7", "mitigation_principle": "The platform verifies for itself what it needs to trust, independent of what earlier hops claim.", "design_measures": [ "Strip inbound trust assertions at every ingress and re-derive them from what the platform can verify.", "Identify the hop whose compromise would be believed by all the others, and remove that single point of trust." ] } } }, { "type": "relationship", "id": "relationship--240a9ff1-5f00-53c3-850d-a4ff9b8be3e6", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5e1b0c5e-e70a-5483-9af4-78220b8c53d4", "target_ref": "attack-pattern--5e1b0c5e-e70a-5483-9af4-78220b8c53d4" }, { "type": "attack-pattern", "id": "attack-pattern--a9fa2c12-4834-5bac-928e-017375a5ca36", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Legitimate Mutation", "description": "Forwarders, lists, gateways and the platform itself rewrite messages in transit for legitimate reasons, so no integrity control can tell an authorised change from an attack.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T6", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t6" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T6", "group_code": "T", "group_name": "Structural hazards", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "None" } } }, { "type": "course-of-action", "id": "course-of-action--a9fa2c12-4834-5bac-928e-017375a5ca36", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for T6 Legitimate Mutation", "description": "The platform verifies what arrives, not what was sent, and knows which of its own components change messages.\n\n(1) Inventory every component that rewrites messages and the authentication results each one breaks, and have each sign what it changed (ARC seal or DKIM) so the change is attributable.\n(2) Design integrity checks on what the platform itself observed at ingress rather than assuming the original sender's signature survives to the mailbox.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T6", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T6", "mitigation_principle": "The platform verifies what arrives, not what was sent, and knows which of its own components change messages.", "design_measures": [ "Inventory every component that rewrites messages and the authentication results each one breaks, and have each sign what it changed (ARC seal or DKIM) so the change is attributable.", "Design integrity checks on what the platform itself observed at ingress rather than assuming the original sender's signature survives to the mailbox." ] } } }, { "type": "relationship", "id": "relationship--8fc4373d-2192-53ad-868f-6e260da98048", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a9fa2c12-4834-5bac-928e-017375a5ca36", "target_ref": "attack-pattern--a9fa2c12-4834-5bac-928e-017375a5ca36" }, { "type": "attack-pattern", "id": "attack-pattern--b0cf4425-a658-53e9-942f-4983310b4091", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Interpretation Differential", "description": "Any two components reading the same bytes may disagree, and attacks live in the disagreement.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T5", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t5" }, { "source_name": "capec", "external_id": "CAPEC-43", "url": "https://capec.mitre.org/data/definitions/43.html", "description": "Exploiting Multiple Input Interpretation Layers" }, { "source_name": "cwe", "external_id": "CWE-436", "url": "https://cwe.mitre.org/data/definitions/436.html", "description": "Interpretation Conflict" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T5", "group_code": "T", "group_name": "Structural hazards", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "Direct", "capec_ids": [ "CAPEC-43" ], "cwe_match": "Direct", "cwe_ids": [ "CWE-436" ] } } }, { "type": "course-of-action", "id": "course-of-action--b0cf4425-a658-53e9-942f-4983310b4091", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for T5 Interpretation Differential", "description": "A message is interpreted once, canonically, and ambiguity is rejected rather than guessed.\n\n(1) Canonicalise at ingress and pass the canonical form to every scanner and client.\n(2) Reject ambiguous input at the edge and maintain a differential test corpus across every parser in the path.\n(3) Treat parser disagreement as a release blocker: any message on which two components in the path differ is rejected until the parsers agree.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T5", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T5", "mitigation_principle": "A message is interpreted once, canonically, and ambiguity is rejected rather than guessed.", "design_measures": [ "Canonicalise at ingress and pass the canonical form to every scanner and client.", "Reject ambiguous input at the edge and maintain a differential test corpus across every parser in the path.", "Treat parser disagreement as a release blocker: any message on which two components in the path differ is rejected until the parsers agree." ] } } }, { "type": "relationship", "id": "relationship--fb1cd5ef-5fba-5cbe-b408-d6fa096213ca", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b0cf4425-a658-53e9-942f-4983310b4091", "target_ref": "attack-pattern--b0cf4425-a658-53e9-942f-4983310b4091" }, { "type": "attack-pattern", "id": "attack-pattern--596fbd74-334f-5429-9057-16ecb0a42d99", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Authentication Is Not Trust", "description": "The protocols prove which domain sent a message, never that the domain is benign.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T4", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t4" }, { "source_name": "cwe", "external_id": "CWE-654", "url": "https://cwe.mitre.org/data/definitions/654.html", "description": "Reliance on a Single Factor in a Security Decision" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T4", "group_code": "T", "group_name": "Structural hazards", "stride": [ "S" ], "stride_fit": "Loose", "capec_match": "None", "cwe_match": "Partial", "cwe_ids": [ "CWE-654" ] } } }, { "type": "course-of-action", "id": "course-of-action--596fbd74-334f-5429-9057-16ecb0a42d99", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for T4 Authentication Is Not Trust", "description": "Identity and trust are separate inputs, and an authentication pass never relaxes another control.\n\n(1) Keep authentication results out of scoring, bypass and badge decisions, using them only for DMARC disposition and domain-level reputation.\n(2) Make reputation and intent explicit controls with their own evidence, separate from authentication.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T4", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T4", "mitigation_principle": "Identity and trust are separate inputs, and an authentication pass never relaxes another control.", "design_measures": [ "Keep authentication results out of scoring, bypass and badge decisions, using them only for DMARC disposition and domain-level reputation.", "Make reputation and intent explicit controls with their own evidence, separate from authentication." ] } } }, { "type": "relationship", "id": "relationship--b8c88337-d6b0-57a9-a069-40f5f72d31e1", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--596fbd74-334f-5429-9057-16ecb0a42d99", "target_ref": "attack-pattern--596fbd74-334f-5429-9057-16ecb0a42d99" }, { "type": "attack-pattern", "id": "attack-pattern--4b45e6e3-6aec-539e-8c32-3397ceeda453", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Legacy Fail-Open", "description": "Interoperability with every legacy sender means an absent security feature is treated as acceptable.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T3", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t3" }, { "source_name": "capec", "external_id": "CAPEC-620", "url": "https://capec.mitre.org/data/definitions/620.html", "description": "Drop Encryption Level" }, { "source_name": "cwe", "external_id": "CWE-757", "url": "https://cwe.mitre.org/data/definitions/757.html", "description": "Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely ('Failing Open')" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T3", "group_code": "T", "group_name": "Structural hazards", "stride": [ "I", "T" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-620" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-757", "CWE-636" ] } } }, { "type": "course-of-action", "id": "course-of-action--4b45e6e3-6aec-539e-8c32-3397ceeda453", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for T3 Legacy Fail-Open", "description": "Every opportunistic protection has a path and a date to become mandatory.\n\n(1) Publish and enforce policies (MTA-STS, DMARC reject, implicit TLS) for the platform's own domains and defaults.\n(2) Track each opportunistic protection with a tightening schedule, telemetry on what would break, and a per-tenant strict mode.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T3", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T3", "mitigation_principle": "Every opportunistic protection has a path and a date to become mandatory.", "design_measures": [ "Publish and enforce policies (MTA-STS, DMARC reject, implicit TLS) for the platform's own domains and defaults.", "Track each opportunistic protection with a tightening schedule, telemetry on what would break, and a per-tenant strict mode." ] } } }, { "type": "relationship", "id": "relationship--805d723b-1718-5f79-881f-545e1847b190", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4b45e6e3-6aec-539e-8c32-3397ceeda453", "target_ref": "attack-pattern--4b45e6e3-6aec-539e-8c32-3397ceeda453" }, { "type": "attack-pattern", "id": "attack-pattern--d6c56f73-9b3b-55b8-8b24-62d9b7c11e26", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Shared Infrastructure, Shared Fate", "description": "Multi-tenant platforms pool identity, reputation and trust across customers who do not trust each other.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T2", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t2" }, { "source_name": "capec", "external_id": "CAPEC-124", "url": "https://capec.mitre.org/data/definitions/124.html", "description": "Shared Resource Manipulation" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T2", "group_code": "T", "group_name": "Structural hazards", "stride": [ "E", "I" ], "stride_fit": "Loose", "capec_match": "Partial", "capec_ids": [ "CAPEC-124" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-653" ] } } }, { "type": "course-of-action", "id": "course-of-action--d6c56f73-9b3b-55b8-8b24-62d9b7c11e26", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for T2 Shared Infrastructure, Shared Fate", "description": "The tenant boundary is enforced in the data layer and identity layer, not only in configuration.\n\n(1) Bind tenant identity at ingress and enforce it in every store, cache, queue and key store by construction.\n(2) Give each tenant its own keys, cache namespace, sending identity and verification tokens.\n(3) Test the boundary adversarially with a tenant that attempts to read, write, send as and configure another, and keep that test in the release pipeline.\n(4) Separate tenants' operational copies too (archive, index, backup, logs), not only their live mailboxes.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T2", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T2", "mitigation_principle": "The tenant boundary is enforced in the data layer and identity layer, not only in configuration.", "design_measures": [ "Bind tenant identity at ingress and enforce it in every store, cache, queue and key store by construction.", "Give each tenant its own keys, cache namespace, sending identity and verification tokens.", "Test the boundary adversarially with a tenant that attempts to read, write, send as and configure another, and keep that test in the release pipeline.", "Separate tenants' operational copies too (archive, index, backup, logs), not only their live mailboxes." ] } } }, { "type": "relationship", "id": "relationship--a0d1737a-c0c8-5a79-a1b8-c94937666547", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d6c56f73-9b3b-55b8-8b24-62d9b7c11e26", "target_ref": "attack-pattern--d6c56f73-9b3b-55b8-8b24-62d9b7c11e26" }, { "type": "attack-pattern", "id": "attack-pattern--ac5abefd-5531-5bb1-9742-0fc88300de04", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Check Once, Use Later", "description": "Store-and-forward separates the moment of inspection from the moment of use, and content or context can change in between.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T1", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t1" }, { "source_name": "capec", "external_id": "CAPEC-29", "url": "https://capec.mitre.org/data/definitions/29.html", "description": "Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions" }, { "source_name": "cwe", "external_id": "CWE-367", "url": "https://cwe.mitre.org/data/definitions/367.html", "description": "Time-of-check Time-of-use (TOCTOU) Race Condition" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-email-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T1", "group_code": "T", "group_name": "Structural hazards", "stride": [ "T" ], "stride_fit": "Loose", "capec_match": "Direct", "capec_ids": [ "CAPEC-29" ], "cwe_match": "Partial", "cwe_ids": [ "CWE-367" ] } } }, { "type": "course-of-action", "id": "course-of-action--ac5abefd-5531-5bb1-9742-0fc88300de04", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for T1 Check Once, Use Later", "description": "There is a control at the moment of use, not only at the moment of receipt.\n\n(1) Evaluate links at click, re-scan on release and re-judge delivered mail when intelligence changes.\n(2) Re-verify standing conditions (domain ownership, session validity, sender reputation) periodically and on change events.\n(3) Record for every decision the conditions it depended on, so that a change in any of them can trigger re-evaluation of the decisions that relied on it.", "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T1", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t1" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Email Infrastructure Threat Taxonomy", "reference": "T1", "mitigation_principle": "There is a control at the moment of use, not only at the moment of receipt.", "design_measures": [ "Evaluate links at click, re-scan on release and re-judge delivered mail when intelligence changes.", "Re-verify standing conditions (domain ownership, session validity, sender reputation) periodically and on change events.", "Record for every decision the conditions it depended on, so that a change in any of them can trigger re-evaluation of the decisions that relied on it." ] } } }, { "type": "relationship", "id": "relationship--885ecfea-2c57-5f4b-91c7-58d484564464", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ac5abefd-5531-5bb1-9742-0fc88300de04", "target_ref": "attack-pattern--ac5abefd-5531-5bb1-9742-0fc88300de04" }, { "type": "grouping", "id": "grouping--5c3e789b-2fdd-5dd6-b7c9-9382ff7d1296", "spec_version": "2.1", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-10-26T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--faaf2157-67c7-5ca3-859f-f0d0d5058d27", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Structural hazards (T)", "description": "These eight hazards are properties of email itself, so no single component can fix them. Apply them to the whole design after the layers. Scope: Hazards of email itself.", "context": "unspecified", "object_refs": [ "attack-pattern--5ccd4709-6cd7-5cdf-b138-cb3aef4cefa0", "course-of-action--5ccd4709-6cd7-5cdf-b138-cb3aef4cefa0", "attack-pattern--5e1b0c5e-e70a-5483-9af4-78220b8c53d4", "course-of-action--5e1b0c5e-e70a-5483-9af4-78220b8c53d4", "attack-pattern--a9fa2c12-4834-5bac-928e-017375a5ca36", "course-of-action--a9fa2c12-4834-5bac-928e-017375a5ca36", "attack-pattern--b0cf4425-a658-53e9-942f-4983310b4091", "course-of-action--b0cf4425-a658-53e9-942f-4983310b4091", "attack-pattern--596fbd74-334f-5429-9057-16ecb0a42d99", "course-of-action--596fbd74-334f-5429-9057-16ecb0a42d99", "attack-pattern--4b45e6e3-6aec-539e-8c32-3397ceeda453", "course-of-action--4b45e6e3-6aec-539e-8c32-3397ceeda453", "attack-pattern--d6c56f73-9b3b-55b8-8b24-62d9b7c11e26", "course-of-action--d6c56f73-9b3b-55b8-8b24-62d9b7c11e26", "attack-pattern--ac5abefd-5531-5bb1-9742-0fc88300de04", "course-of-action--ac5abefd-5531-5bb1-9742-0fc88300de04" ], "external_references": [ { "source_name": "ostering-email-infrastructure-threat-taxonomy", "external_id": "T", "url": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/" } ] } ] }