Cisco Secure Email Threat Defense high number of threat emails sent by an internal user

문서 > Datadog 보안 > OOTB Rules > Cisco Secure Email Threat Defense high number of threat emails sent by an internal user

This rule is part of a beta feature. To learn more, contact Support.

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1566-phishing

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal:

Detects when a high volume of threat emails are sent by an internal user.

Strategy:

This rule monitors emails to detect multiple threat emails sent by an internal user. This includes the mail sent within your Microsoft 365 tenant or mail sent to recipients outside of your Microsoft 365 tenant.

Triage & Response:

Investigate suspicious emails sent from the user {{@fromAddress}}.
Identify the internal user(s) responsible for sending the threat emails. Determine if the emails were intentional or due to compromised credentials.
Disable the internal user’s email account to prevent further sending of threat emails, if necessary.
If possible, notify recipients who received the threat emails, advising them not to interact with any suspicious content and providing guidance on what to do if they have already done so.
Take the required steps in accordance with company policies.