Email mimics replies or forwards without an actual ongoing conversation

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Hour 30 Minutes
Required Data	Microsoft 365 Emails
Detection Modules	Email
Detector Tags	Spoofing
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Phishing (T1566), Trusted Relationship (T1199)
Severity	Informational

Description

An email with a subject line or body that includes signs of a reply or forward without an actual ongoing conversation.

Attacker's Goals

Create the illusion of being part of an existing email conversation to build trust and reduce the target's suspicion, mislead recipients by concealing harmful intents such as phishing or malware distribution.

Investigative actions

• Analyze the full set of email headers to confirm the absence of legitimate References and In-Reply-To headers and verify if the email was altered or forged.
• Investigate if the sender's domain is known, flagged, or associated with suspicious activity to detect possible impersonation.
• If the message contains attachments or links, scrutinize them for any suspicious indications.
• Monitor further actions taken, such as file downloads or access to potentially malicious links.