Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
13 detectors match the current filters. tactic: TA0005 ✕ technique: T1656 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | External email display name impersonation of internal personnel Potential email attempting to impersonate an internal user has been detected. The sender's email address appears unusual in relation to the provided display name, suggesting a possible impersonation attempt targeting an internal user. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Potential spoofing of internal domain spotted An external sender is possibly impersonating an employee by spoofing the company's internal address. | Informational | Email Security | Microsoft 365 Emails | Initial Access, Defense Evasion |
| Analytics BIOC | Suspicious brand affiliation detected The sender's name or address suggests association with a recognized brand, but the email address doesn't match established patterns for that brand. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Suspicious DKIM Result The email contains a suspicious DKIM entry, showing either an unexpected verification result (none, fail, or policy) or a mismatched signing domain, which may indicate potential tampering or spoofing activity. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Suspicious DMARC result The email has a suspicious DMARC result of either fail or none, which may indicate a potential domain misconfiguration or spoofing. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Suspicious SPF Result The email has a suspicious SPF result of fail, soft fail, or policy, which may indicate a potential domain misconfiguration or spoofing. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Suspicious Unicode character detected in email Unicode characters can be used for obfuscation, allowing malicious actors to disguise harmful intent, URLs or attachments By embedding non-printing Unicode characters, attackers can bypass security filters and evade detection mechanisms Such characters may also be used for phishing attempts that appear legitimate to both users and security systems. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Unusual hostname for the sending mail server in the email headers The detected mail server hostname had not been observed in the organization's emails in the past 30 days. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Unusual sender IP subnet This IP address has not been observed in correlation with the sender's fully qualified domain name within the last 30 days. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Usage of homograph characters detected in an email Detected characters resembling Latin letters within an email's subject and/or body. This could indicate an attempt to impersonate a well-known brand or impersonate someone's identity. This could also be used as a method to evade text scanners and analyzers. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Usage of homograph characters detected in an email's from header Detected characters resembling Latin letters within an email's From header. This could indicate an attempt to impersonate a well-known brand or impersonate someone's identity. This could also be used as a method to evade text scanners and analyzers. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Well-known brand in sender headers with header inconsistencies Sender headers include a well-known brand with header inconsistencies indicating possible impersonation. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | X-Forefront-Antispam-Report has flagged this email as a potential threat This email has been categorized by X-Forefront-Antispam-Report as a threat, suggesting it is likely malicious in nature (e.g., spam, phishing, impersonation, etc.). | Informational | Email Security | Microsoft 365 Emails | Initial Access, Defense Evasion, Execution |