Analytics
Informational
✕
Suspicious sending domain with sender address randomization
Multiple messages from a single sender domain were observed over a short period, each using a unique sender address. This per-message sender randomization is uncommon for legitimate senders and suggests automated behavior.
- Module:
- Email Security
- Licensed by:
- Email Security
- Data source:
- Microsoft 365 Emails
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Phishing (T1566)
Detector tags: Phishing
Attacker's goals:
Trick the user into clicking a link, while avoiding detection.
Investigative actions:
Examine the sender's IP address and reputation. Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.
- Test period:
- 30 Minutes
- Deduplication:
- 1 Day
1 variation:
- High-volume sender domain with per-message sender randomization Informational