Suspicious brand affiliation detected

Analytics BIOC Informational

Suspicious brand affiliation detected

The sender's name or address suggests association with a recognized brand, but the email address doesn't match established patterns for that brand.

Module:: Email Security
Licensed by:: Email Security
Data source:: Microsoft 365 Emails

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Impersonation (T1656)

Detector tags: Brand Impersonation

Attacker's goals:

Trick the user on clicking the link, while avoiding detection.

Investigative actions:

Examine the sender's IP address and reputation. Verify whether the sender's IP address has appeared in different log sources before and if it is recognizable. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Test period:: N/A (single event)
Deduplication:: 1 Hour 30 Minutes