Unpopular domains detected in email URLs for a recipient

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2026-02-09

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: Microsoft 365 Emails
Detection Modules	Email
Detector Tags	Malicious URLs
ATT&CK Tactic	Initial Access (TA0001) Execution (TA0002)
ATT&CK Technique	Phishing (T1566) User Execution (T1204)
Severity	Informational

We have identified unpopular domain(s) within these email URLs.

Trick the user into clicking a link, while avoiding detection.

Examine the sender's IP address and reputation.
Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable.
If the message contains attachments/links, scrutinize them for any suspicious indications.
Monitor further actions taken, such as file downloads or access to potentially malicious links.

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

We have identified unpopular domain(s) within these email URLs.

Trick the user into clicking a link, while avoiding detection.

Examine the sender's IP address and reputation.
Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable.
If the message contains attachments/links, scrutinize them for any suspicious indications.
Monitor further actions taken, such as file downloads or access to potentially malicious links.