Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
2 detectors match the current filters. technique: T1656 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | External email display name impersonation of internal personnel Potential email attempting to impersonate an internal user has been detected. The sender's email address appears unusual in relation to the provided display name, suggesting a possible impersonation attempt targeting an internal user. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Potential spoofing of internal domain spotted An external sender is possibly impersonating an employee by spoofing the company's internal address. | Informational | Email Security | Microsoft 365 Emails | Initial Access, Defense Evasion |