Initial person-to-person email contact

Analytics BIOC Informational

Initial person-to-person email contact

Identifies when a sender initiates contact with individuals with no prior history of interaction in the last 30 days.

Module:: Email Security
Licensed by:: Email Security
Data source:: Microsoft 365 Emails

ATT&CK tactics: Execution (TA0002) Credential Access (TA0006)

ATT&CK techniques: User Execution (T1204) Brute Force: Password Cracking (T1110.002)

Detector tags: Phishing

Attacker's goals:

Trick the user on clicking the link, while avoiding detection.

Investigative actions:

Examine the sender's IP address and reputation. Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable. If the message contains attachments/links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Test period:: N/A (single event)
Deduplication:: 1 Day