Email was received from an unknown address using a public provider domain

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Hour 30 Minutes
Required Data	Microsoft 365 Emails
Detection Modules	Email
ATT&CK Tactic	Reconnaissance (TA0043), Initial Access (TA0001)
ATT&CK Technique	Phishing for Information (T1598), Phishing (T1566)
Severity	Informational

Description

The email was received from an unknown address, that was seen for the first time in the organization in the past month, and registered under a public provider.

Attacker's Goals

Aim to steal sensitive information

• Trick recipients into downloading harmful payloads
• Aim to gain unauthorized access to the organization's systems.

Investigative actions

• Check the email address for any unusual spellings, missing letters, or unknown domains.
• If the message contains attachments or links, scrutinize them for any suspicious indications.
• Monitor further actions taken, such as file downloads or access to potentially malicious links.