Analytics
Informational
✕
Suspicious sender exhibiting automated sending patterns
Multiple messages from a single sender were observed over a short period, all having the same subject and differing body content. This repetitive pattern may indicate automated or scripted behavior.
- Module:
- Email Security
- Licensed by:
- Email Security
- Data source:
- Microsoft 365 Emails
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Phishing (T1566)
Detector tags: Phishing
Attacker's goals:
Trick the user into clicking a link, while avoiding detection.
Investigative actions:
Examine the sender's IP address and reputation. Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.
- Test period:
- 30 Minutes
- Deduplication:
- 1 Day
1 variation:
- Suspicious sender with high-volume automated sending patterns Informational