Analytics BIOC
Informational
✕
Outbound email to an address hosted by a public email service provider
Internal sender emailed to an address hosted by a public email service provider.
- Module:
- Email Security
- Licensed by:
- Email Security
- Data source:
- Microsoft 365 Emails
ATT&CK tactics: Execution (TA0002) Credential Access (TA0006)
ATT&CK techniques: User Execution (T1204) Brute Force: Password Cracking (T1110.002)
Detector tags: Exfiltration Account Takeover
Attacker's goals:
Extracting valuable information outside the company.
Investigative actions:
Check the content of the email that was sent. Review the external recipient address and assess its reputation. Review past emails sent from this mailbox for any suspicious activity. Check for unusual emails sent to this recipient's address. Monitor further action taken, such as accessing to private keys, API tokens and sensitive data.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- Outbound email to a single address hosted by a public email service provider Informational