EMAIL BETA - Well-known brand impersonation within an email's from address domain

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2025-04-21

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: Microsoft 365 Emails
Detection Modules	Email
Detector Tags
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Impersonation (T1656)
Severity	Informational

Description

Email with a domain similar to a well-known brand's name was detected.
An inbound email's domain mimics a known legitimate brand, aiming to deceive users.

Attacker's Goals

Impersonate known legitimate brands to trick recipients into clicking on malicious links or attachments.

Investigative actions

Check the email address for any unusual spellings, missing letters, or unknown domains.
Examine the sender's IP address and reputation.
Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable.
If the message contains attachments/links, scrutinize them for any suspicious indications.
Monitor further actions taken, such as file downloads or access to potentially malicious links.

Variations

EMAIL BETA - Well-known brand impersonation within an email's from address domain

Synopsis

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Impersonation (T1656)
Severity	Medium

Description

Email with a domain similar to a well-known brand's name was detected.
An inbound email's domain mimics a known legitimate brand, aiming to deceive users.

Attacker's Goals

Impersonate known legitimate brands to trick recipients into clicking on malicious links or attachments.

Investigative actions

Check the email address for any unusual spellings, missing letters, or unknown domains.
Examine the sender's IP address and reputation.
Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable.
If the message contains attachments/links, scrutinize them for any suspicious indications.
Monitor further actions taken, such as file downloads or access to potentially malicious links.

EMAIL BETA - Well-known brand impersonation within an email's from address domain

Synopsis

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Impersonation (T1656)
Severity	Low

Description

Email with a domain similar to a well-known brand's name was detected.
An inbound email's domain mimics a known legitimate brand, aiming to deceive users.

Attacker's Goals

Impersonate known legitimate brands to trick recipients into clicking on malicious links or attachments.

Investigative actions

Check the email address for any unusual spellings, missing letters, or unknown domains.
Examine the sender's IP address and reputation.
Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable.
If the message contains attachments/links, scrutinize them for any suspicious indications.
Monitor further actions taken, such as file downloads or access to potentially malicious links.