Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
6 detectors match the current filters. technique: T1566 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | Email sent using an automated system or script detected The message contains X-PHP-Script or X-PHP-Originating-Script headers, indicating it was generated by an automated PHP script or web application. While often legitimate, this behavior is frequently associated with shared hosting abuse, phishing kits, and compromised web applications. | Informational | Email Security | Microsoft 365 Emails | Initial Access |
| Analytics | Numerous emails sent by a single sender to multiple internal recipients Numerous emails were sent to multiple internal recipients. This may indicate spam or any other malicious attempt. | Informational | Email Security | Microsoft 365 Emails | Initial Access |
| Analytics | Potential Phishing has been detected This email contains multiple indicators consistent with a phishing attack. The message likely attempts to steal credentials, distribute malware, or trick recipients into performing actions that compromise security through deceptive content or suspicious technical characteristics. | Medium | Email Security | Box Audit Log, DropBox, Google Workspace Audit Logs, Microsoft 365 Emails, Office 365 Audit, Okta Audit Log | Initial Access |
| Analytics | Suspicious sender exhibiting automated sending patterns Multiple messages from a single sender were observed over a short period, all having the same subject and differing body content. This repetitive pattern may indicate automated or scripted behavior. | Informational | Email Security | Microsoft 365 Emails | Initial Access |
| Analytics | Suspicious sending domain with sender address randomization Multiple messages from a single sender domain were observed over a short period, each using a unique sender address. This per-message sender randomization is uncommon for legitimate senders and suggests automated behavior. | Informational | Email Security | Microsoft 365 Emails | Initial Access |
| Analytics BIOC | Training simulation email detected This email was flagged as part of a training simulation. | Low | Email Security | Microsoft 365 Emails | Initial Access |