Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1566-phishing

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects email when unusual spike occur in emails for Domain brand impersonation detection technique.

Strategy

This rule monitors emails to detect unusual spike in email events for Domain brand impersonation detection technique.

Triage and response

1. Investigate emails with Domain brand impersonation detection technique.
2. Identify the domains being impersonated and the potential impact on your organization. This detection technique have severity {{@verdict.techniques.severity}}.
3. Take required actions according to company policy to block these impersonated domains.
4. Evaluate whether any sensitive information or credentials might have been compromised.
5. Notify users within your organization about the domain brand impersonation incidents.