Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

6 detectors match the current filters. tactic: TA0043 ✕ technique: T1566 ✕

Download CSV
Type Name Severity Module Data source / event ATT&CK
Analytics BIOC Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values The Spam Confidence Level (SCL) and Bulk Complaint Level (BCL) values, detected in the email's antispam headers, indicate that a message is more likely to be spam. Informational Email Security Microsoft 365 Emails Reconnaissance, Initial Access
Analytics BIOC Email was received from an unknown address using a public provider domain The email was received from an unknown address, that was seen for the first time in the organization in the past month, and registered under a public provider. Informational Email Security Microsoft 365 Emails Reconnaissance, Initial Access
Analytics BIOC Email was received from an unknown sender using a disposable domain The email was received from an unknown sender using a disposable email provider, first seen in the organization in the past month. Low Email Security Microsoft 365 Emails Reconnaissance, Initial Access
Analytics BIOC Rarely seen sender address in the organization An email was received from a sender that has not been observed in the organization in the last 30 days. Informational Email Security Microsoft 365 Emails Reconnaissance, Initial Access
Analytics BIOC Rarely seen sender domain in the organization An email was received from a domain that has not been observed in the organization in the last 30 days. Informational Email Security Microsoft 365 Emails Reconnaissance, Initial Access
Analytics BIOC Unusual display name in From header An email was detected with an unusual display name in the From header. Informational Email Security Microsoft 365 Emails Reconnaissance, Initial Access