External email with a single internal recipient hidden in BCC

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Hour 30 Minutes
Required Data	Microsoft 365 Emails
Detection Modules	Email
ATT&CK Tactic	Execution (TA0002), Credential Access (TA0006)
ATT&CK Technique	User Execution (T1204), Brute Force: Password Cracking (T1110.002)
Severity	Informational

Description

External email with mailbox owner hidden in BCC as the only internal recipient.

Attacker's Goals

BCC enables sending the same email to multiple hidden recipients without revealing them to each other.

Investigative actions

• Review the headers and content for patterns or anomalies.
• Assess the email's context and attack techniques to determine the potential risk.
• Investigate if similar patterns have occurred recently across the organization.

Variations

External email with only a hidden internal BCC recipient

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Credential Access (TA0006)
ATT&CK Technique	User Execution (T1204), Brute Force: Password Cracking (T1110.002)
Severity	Informational

Description

External email with no visible recipients, mailbox owner is hidden in BCC.

Attacker's Goals

BCC enables sending the same email to multiple hidden recipients without revealing them to each other.

Investigative actions

• Review the headers and content for patterns or anomalies.
• Assess the email's context and attack techniques to determine the potential risk.
• Investigate if similar patterns have occurred recently across the organization.