Analytics Informational
✕

Sudden spike in outbound email volume

Unusual amount of emails sent by an internal sender to one or more external recipients within a short timeframe.

Module:
Email Security
Licensed by:
Email Security
Data source:
Microsoft 365 Emails
ATT&CK tactics: Execution (TA0002) Credential Access (TA0006)
ATT&CK techniques: User Execution (T1204) Brute Force: Password Cracking (T1110.002)
Attacker's goals:

Extracting valuable information outside the company. Bypass Data Loss Prevention (DLP) by splitting data across multiple emails.

Investigative actions:

Check the content of the email that was sent. Review the external recipient address and assess its reputation. Review past emails sent from this mailbox for any suspicious activity. Check for unusual emails sent to this recipient's address. Monitor further action taken, such as accessing to private keys, API tokens and sensitive data.

Test period:
1 Hour
Deduplication:
2 Hours
2 variations:
  • Sudden spike in outbound emails sent to external recipients Informational
  • Sudden spike in outbound emails sent to internal recipients Informational