Cisco Secure Email Threat Defense unusual spike found for emails having `Rare sender domain` detection technique

Docs > Plateforme de sécurité Datadog > OOTB Rules > Cisco Secure Email Threat Defense unusual spike found for emails having `Rare sender domain` detection technique

This rule is part of a beta feature. To learn more, contact Support.

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1566-phishing

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detects emails when there is a unusual spike in emails having Rare sender domain detection technique.

Strategy

This rule monitors emails to detect spike in emails with Rare sender domain detection technique.

Triage and response

Investigate emails metadata that are: sender, receiver, sender domain to further evaluate the impact.
Determine the severity - {{@verdict.techniques.severity}} of the threat based emails and the potential impact on the organization.
Block these domains according to company policy if required.
Analyse if any sensitive data has been shared with these rare sender domain emails.