Analytics BIOC
Informational
✕
Uncommon URL domain(s) in your organization detected in email
We have identified unpopular domain(s) in URL(s) within this email.
- Module:
- Email Security
- Licensed by:
- Email Security
- Data source:
- Microsoft 365 Emails
ATT&CK tactics: Initial Access (TA0001) Execution (TA0002)
ATT&CK techniques: Phishing (T1566) User Execution (T1204)
Detector tags: Malicious URLs
Attacker's goals:
Trick the user into engaging with a URL(s), aiming to extract information or establish access to the network.
Investigative actions:
Examine the sender's IP address and reputation. Verify whether the sender's IP address has appeared in different log sources before and if it is recognizable. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
3 variations:
- External email with a first-seen URL domain(s) in your organization in the last 30 days Informational
- Internal email with a first-seen URL domain(s) in your organization in the last 30 days Informational
- Outbound email with a first-seen URL domain(s) in your organization in the last 30 days Informational