Outbound email includes an external BCC recipient observed for the first time

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Microsoft 365 Emails
Detection Modules	Email
Detector Tags	Exfiltration
ATT&CK Tactic	Execution (TA0002), Credential Access (TA0006)
ATT&CK Technique	User Execution (T1204), Brute Force: Password Cracking (T1110.002)
Severity	Informational

Description

Internal sender BCC'd an external recipient whose address has not been observed in prior communications.

Attacker's Goals

Use BCC to covertly exfiltrate data to an unusual external recipient without visibility to other recipients or monitoring systems.

Investigative actions

• Review headers and content for anomalies or potential exposure of sensitive data.
• Assess the email's context and attack techniques to determine the potential risk.
• Investigate if similar patterns have occurred recently across the organization.

Variations

Outbound email sent to an unknown external BCC recipient with no To or CC addresses

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Credential Access (TA0006)
ATT&CK Technique	User Execution (T1204), Brute Force: Password Cracking (T1110.002)
Severity	Low

Description

Internal sender BCC'd an external recipient whose address has not been observed in prior communications.

Attacker's Goals

Use BCC to covertly exfiltrate data to an unusual external recipient without visibility to other recipients or monitoring systems.

Investigative actions

• Review headers and content for anomalies or potential exposure of sensitive data.
• Assess the email's context and attack techniques to determine the potential risk.
• Investigate if similar patterns have occurred recently across the organization.