Email with URL shortener detected
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Hour 30 Minutes
Required Data
Microsoft 365 Emails
Detection Modules
Detector Tags
Malicious URLs
ATT&CK Tactic
Stealth (TA0005)
ATT&CK Technique
Hide Artifacts (T1564)
Severity
Informational
Description
A URL shortener was detected in the email body.
Attacker's Goals
Attackers use URL shorteners to hide the true destination of a link, making it easier to trick recipients into clicking on it.
Investigative actions
Examine the sender's IP ֿֿaddress and reputation.
Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable.
If the message contains attachments or links, scrutinize them for any suspicious indications.
Monitor further actions taken, such as file downloads or access to potentially malicious links.
Was this helpful?