First-time attachment exchange

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Hour 30 Minutes
Required Data	Microsoft 365 Emails
Detection Modules	Email
Detector Tags	Phishing
ATT&CK Tactic	Execution (TA0002), Credential Access (TA0006)
ATT&CK Technique	User Execution (T1204), Brute Force: Password Cracking (T1110.002)
Severity	Informational

Description

Detects when an attachment is sent between individuals for the first time in 30 days.

Attacker's Goals

Trick the user on clicking the link or opening attachments, while avoiding detection.

Investigative actions

• Examine the sender's IP address and reputation.
• Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable.
• Scrutinize the attachments for any suspicious indications or malicious content.
• Check if the attachments have been seen before in the organization.
• Monitor further actions taken, such as file downloads or execution of attachment content.