Unusual URL(s) sent by a brand were observed in the email
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
Microsoft 365 Emails
Detection Modules
ATT&CK Tactic
Execution (TA0002), Credential Access (TA0006)
ATT&CK Technique
User Execution (T1204), Brute Force: Password Cracking (T1110.002)
Severity
Informational
Description
A URL that is not usually associated with the brand has been detected.
Attacker's Goals
Trick the user into clicking a link while avoiding detection.
Investigative actions
Examine the sender's IP address and reputation.
Verify whether the sender's IP address has appeared in different log sources before and if it is recognizable.
If the message contains attachments or links, scrutinize them for any suspicious indications.
Monitor further actions taken, such as file downloads or access to potentially malicious links.
Was this helpful?