Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
5 detectors match the current filters. technique: T1656 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | Suspicious DKIM Result The email contains a suspicious DKIM entry, showing either an unexpected verification result (none, fail, or policy) or a mismatched signing domain, which may indicate potential tampering or spoofing activity. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Suspicious DMARC result The email has a suspicious DMARC result of either fail or none, which may indicate a potential domain misconfiguration or spoofing. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Suspicious SPF Result The email has a suspicious SPF result of fail, soft fail, or policy, which may indicate a potential domain misconfiguration or spoofing. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Unusual hostname for the sending mail server in the email headers The detected mail server hostname had not been observed in the organization's emails in the past 30 days. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |
| Analytics BIOC | Unusual sender IP subnet This IP address has not been observed in correlation with the sender's fully qualified domain name within the last 30 days. | Informational | Email Security | Microsoft 365 Emails | Defense Evasion |