Analytics BIOC
Informational
✕
Moniker link detected in URL(s)
A Moniker link was detected within the email's body. The link has the convention of a Moniker link (CVE-2024-21413) correlated to a suspicious URL scheme.
- Module:
- Email Security
- Licensed by:
- Email Security
- Data source:
- Microsoft 365 Emails
ATT&CK tactics: Execution (TA0002) Credential Access (TA0006)
ATT&CK techniques: User Execution (T1204) Brute Force: Password Cracking (T1110.002)
Detector tags: Malicious URLs
Attacker's goals:
Trick the user on clicking the link, while avoiding detection.
Investigative actions:
Examine the sender's IP address and reputation. Verify whether the sender's IP address has appeared in different log sources before and if it is recognizable. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Hour 30 Minutes
2 variations:
- A suspicious Moniker link, SMB and suspicious extension detected Medium (parent: Informational)
- A suspicious Moniker link pointing to SMB detected Low (parent: Informational)