Analytics BIOC
Informational
✕
Punycode characters detected in URL(s)
Punycode character(s) detected within URL(s) in email content.
- Module:
- Email Security
- Licensed by:
- Email Security
- Data source:
- Microsoft 365 Emails
ATT&CK tactics: Defense Evasion (TA0005) Execution (TA0002)
ATT&CK techniques: Masquerading (T1036) User Execution (T1204)
Detector tags: Malicious URLs
Attacker's goals:
Cause a different URL to be presented to the user as a legitimate URL, prompting user engagement.
Investigative actions:
Examine the sender's IP address and reputation. Check the email address and content for any unusual spellings, missing letters, or unknown domains. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Hour 30 Minutes