Cloud email service activity

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Internal Spearphishing (T1534)
Severity	Informational

A cloud Identity performed an email service operation.

Abuse the cloud email service for sending phishing emails.

Check for any following actions related to this activity.
Verify that the identity did not abuse the email service to send phishing emails to victims.

A cloud Identity performed an email service operation for the first time in the tenant.

Abuse the cloud email service for sending phishing emails.

Check for any following actions related to this activity.
Verify that the identity did not abuse the email service to send phishing emails to victims.

A cloud Identity created a new cloud email identity.

Abuse the cloud email service for sending phishing emails.

Check for any following actions related to this activity.
Verify that the identity did not abuse the email service to send phishing emails to victims.