Analytics BIOC Informational
✕

First-seen email from mailbox owner to external recipient's address in the last 30 days

Internal sender initiated first-time communication with an external recipient in the last 30 days.

Module:
Email Security
Licensed by:
Email Security
Data source:
Microsoft 365 Emails
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Exfiltration Over Alternative Protocol (T1048)
Detector tags: Exfiltration Account Takeover
Attacker's goals:

Extracting valuable information outside the company.

Investigative actions:

Check the content of the email that was sent. Review the external recipient address and assess its reputation. Review past emails sent from this mailbox for any suspicious activity. Check for unusual emails sent to this recipient's address. Monitor further action taken, such as accessing to private keys, API tokens and sensitive data.

Test period:
N/A (single event)
Deduplication:
1 Day
6 variations:
  • First-time email to the disposable domain Low (parent: Informational)
  • First-time email from organization's domain with the external recipient's domain in the last 30 days Informational
  • First-time email from organization with the external recipient in the last 30 days Informational
  • First-time email from organization's domain to the external recipient in the last 30 days Informational
  • First-time email from mailbox owner to the external recipient's domain in the last 30 days Informational
  • First-time outbound email from mailbox owner to multiple external recipients without any internal recipients in the last 30 days Informational