Cisco Secure Email Threat Defense high number of threat emails sent by an internal user

Docs > Datadog Security > OOTB Rules > Cisco Secure Email Threat Defense high number of threat emails sent by an internal user

This rule is part of a beta feature. To learn more, contact Support.

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1566-phishing

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal:

Detects when a high volume of threat emails are sent by an internal user.

Strategy:

This rule monitors emails to detect multiple threat emails sent by an internal user. This includes the mail sent within your Microsoft 365 tenant or mail sent to recipients outside of your Microsoft 365 tenant.

Triage & Response:

Investigate suspicious emails sent from the user {{@fromAddress}}.
Identify the internal user(s) responsible for sending the threat emails. Determine if the emails were intentional or due to compromised credentials.
Disable the internal user’s email account to prevent further sending of threat emails, if necessary.
If possible, notify recipients who received the threat emails, advising them not to interact with any suspicious content and providing guidance on what to do if they have already done so.
Take the required steps in accordance with company policies.