Suspicious theme and sentiment in email

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Hour 30 Minutes
Required Data	Requires one of the following data sources: Box Audit Log OR DropBox OR Google Workspace Audit Logs OR Microsoft 365 Emails OR Office 365 Audit OR Okta Audit Log
Detection Modules	Email
Detector Tags	Phishing
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Financial Theft (T1657)
Severity	Informational

Description

The email's body has a theme and sentiment that may indicate a malicious attempt.

Attacker's Goals

Trick recipients into revealing sensitive information, hijack the organization, or obtain money through deception.

Investigative actions

• Review the email headers and metadata of to identify potential spoofing techniques or unusual routing patterns.
• Analyze any URLs or attachments in a secure sandbox environment to detect possible malware or phishing attempts.
• Correlate findings with recent alerts in the SIEM to assess whether similar accumulation patterns are forming.
• Engage potentially affected users to understand if any actions were taken in response to this email, which could increase the overall risk.
• Document and escalate findings if the accumulation of warnings suggests a broader phishing campaign.