Cisco Secure Email Threat Defense unusual spike found for emails having `Rare sender domain` detection technique

This rule is part of a beta feature. To learn more, contact Support.

Classification:

attack

Tactic:

Technique:

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detects emails when there is a unusual spike in emails having Rare sender domain detection technique.

This rule monitors emails to detect spike in emails with Rare sender domain detection technique.

Investigate emails metadata that are: sender, receiver, sender domain to further evaluate the impact.
Determine the severity - {{@verdict.techniques.severity}} of the threat based emails and the potential impact on the organization.
Block these domains according to company policy if required.
Analyse if any sensitive data has been shared with these rare sender domain emails.