Rarely seen sender domain in the organization

Analytics BIOC Informational

Rarely seen sender domain in the organization

An email was received from a domain that has not been observed in the organization in the last 30 days.

Module:: Email Security
Licensed by:: Email Security
Data source:: Microsoft 365 Emails

ATT&CK tactics: Reconnaissance (TA0043) Initial Access (TA0001)

ATT&CK techniques: Phishing for Information (T1598) Phishing (T1566)

Attacker's goals:

Aim to steal sensitive information Trick recipients into downloading harmful payloads Aim to gain unauthorized access to the organization's systems.

Investigative actions:

Check the email address for any unusual spellings, missing letters, or unknown domains. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Test period:: N/A (single event)
Deduplication:: 1 Day