Analytics Informational
✕

Numerous emails sent by a single sender to multiple internal recipients

Numerous emails were sent to multiple internal recipients. This may indicate spam or any other malicious attempt.

Module:
Email Security
Licensed by:
Email Security
Data source:
Microsoft 365 Emails
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Phishing (T1566)
Detector tags: Phishing Spam
Attacker's goals:

Trick the user into clicking a link, while avoiding detection.

Investigative actions:

Examine the sender's IP address and reputation. Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Test period:
10 Minutes
Deduplication:
1 Day