Cisco Secure Email Threat Defense high number of threat emails sent by an internal user

Documentos > Datadog Security > OOTB Rules > Cisco Secure Email Threat Defense high number of threat emails sent by an internal user

This rule is part of a beta feature. To learn more, contact Support.

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1566-phishing

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal:

Detects when a high volume of threat emails are sent by an internal user.

Strategy:

This rule monitors emails to detect multiple threat emails sent by an internal user. This includes the mail sent within your Microsoft 365 tenant or mail sent to recipients outside of your Microsoft 365 tenant.

Triage & Response:

Investigate suspicious emails sent from the user {{@fromAddress}}.
Identify the internal user(s) responsible for sending the threat emails. Determine if the emails were intentional or due to compromised credentials.
Disable the internal user’s email account to prevent further sending of threat emails, if necessary.
If possible, notify recipients who received the threat emails, advising them not to interact with any suspicious content and providing guidance on what to do if they have already done so.
Take the required steps in accordance with company policies.