Analytics BIOC Informational
✕

Quarantined email released to recipients

This message was previously quarantined by vendor and has now been released and delivered to the intended recipients.

Module:
Email Security
Licensed by:
Email Security
Data source:
Microsoft 365 Emails
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Phishing (T1566)
Attacker's goals:

Achieve financial gain, distribute malware, or phish for sensitive information through mass unsolicited emails.

Investigative actions:

Examine email headers to trace origins and check for signs of spoofing. Analyze the email content for spam indicators like suspicious links and aggressive marketing language. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Test period:
N/A (single event)
Deduplication:
1 Hour 30 Minutes
3 variations:
  • Repeated quarantine releases to mailbox from previously quarantined sender Low (parent: Informational)
  • Repeated quarantine releases from previously quarantined sender Low (parent: Informational)
  • Repeated quarantine-released emails received by mailbox Low (parent: Informational)