Analytics BIOC Informational
✕

Usage of homograph characters detected in an email

Detected characters resembling Latin letters within an email's subject and/or body. This could indicate an attempt to impersonate a well-known brand or impersonate someone's identity. This could also be used as a method to evade text scanners and analyzers.

Module:
Email Security
Licensed by:
Email Security
Data source:
Microsoft 365 Emails
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impersonation (T1656) Masquerading (T1036)
Detector tags: Evasion
Attacker's goals:

Impersonate known legitimate brands or evade defenses, tricking recipients into clicking on malicious links or attachments.

Investigative actions:

Check the characters in the email address for any characters that might look slightly different. Examine the sender's IP address and reputation. Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable. Check the domain the email came from, and if this domain is recognized within the organization. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Test period:
N/A (single event)
Deduplication:
1 Hour 30 Minutes