Analytics BIOC
Informational
✕
Usage of homograph characters detected in an email attachment(s) name
Detected characters resembling Latin letters within an email attachment(s) name. This method could be used as a method to evade text or file scanners and analyzers.
- Module:
- Email Security
- Licensed by:
- Email Security
- Data source:
- Microsoft 365 Emails
ATT&CK tactics: Execution (TA0002) Credential Access (TA0006)
ATT&CK techniques: User Execution (T1204) Brute Force: Password Cracking (T1110.002)
Detector tags: Evasion Phishing
Attacker's goals:
Evade file scanner defenses, tricking recipients into running malicious attachments.
Investigative actions:
Examine the sender's IP address and reputation. Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable. Check the domain the email came from, and if this domain is recognized within the organization. Scrutinize the attachments related to the email message. Monitor file-related actions taken related to the attachment.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- Usage of homograph characters detected in an email attachment(s) extension Low (parent: Informational)