Unrecognized internal address (AAD mismatch)

Analytics BIOC Informational

Unrecognized internal address (AAD mismatch)

An email was received from an address using an internal domain, but the sender is not found in Active Directory. This may indicate an impersonation attempt or domain spoofing.

Module:: Email Security
Licensed by:: Email Security
Data source:: Microsoft 365 Emails

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: Phishing (T1566)

Detector tags: Employee Impersonation Spear Phishing

Attacker's goals:

The attacker aims to impersonate an internal user to gain trust, bypass security controls, and potentially extract sensitive information or distribute malicious content through internal-looking emails.

Investigative actions:

Verify if the sender address exists in Active Directory. Check historical email activity from the spoofed address. Review email headers for spoofing indicators (SPF, DKIM, DMARC failures). Identify if recipients engaged with the email (clicked links, downloaded attachments). Correlate with other alerts involving the same sender or domain.

Test period:: N/A (single event)
Deduplication:: 1 Hour 30 Minutes