Analytics BIOC
Informational
✕
External email with a single internal recipient hidden in BCC
External email with mailbox owner hidden in BCC as the only internal recipient.
- Module:
- Email Security
- Licensed by:
- Email Security
- Data source:
- Microsoft 365 Emails
ATT&CK tactics: Execution (TA0002) Credential Access (TA0006)
ATT&CK techniques: User Execution (T1204) Brute Force: Password Cracking (T1110.002)
Attacker's goals:
BCC enables sending the same email to multiple hidden recipients without revealing them to each other.
Investigative actions:
Review the headers and content for patterns or anomalies. Assess the email's context and attack techniques to determine the potential risk. Investigate if similar patterns have occurred recently across the organization.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Hour 30 Minutes
1 variation:
- External email with only a hidden internal BCC recipient Informational