Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Hour 30 Minutes |
Required Data |
|
Detection Modules |
Email |
Detector Tags |
|
ATT&CK Tactic |
Initial Access (TA0001) |
ATT&CK Technique |
Phishing (T1566) |
Severity |
Informational |
Description
This message was previously quarantined by vendor and has now been released and delivered to the intended recipients.
Attacker's Goals
Achieve financial gain, distribute malware, or phish for sensitive information through mass unsolicited emails.
Investigative actions
- Examine email headers to trace origins and check for signs of spoofing.
- Analyze the email content for spam indicators like suspicious links and aggressive marketing language.
- Monitor further actions taken, such as file downloads or access to potentially malicious links.
Variations
Repeated quarantine releases to mailbox from previously quarantined sender
Synopsis
Description
This message was previously quarantined by vendor and later released and delivered to the intended recipients, while the mailbox has received multiple quarantined messages and the sender has been quarantined several times over the past 30 days.
Attacker's Goals
Achieve financial gain, distribute malware, or phish for sensitive information through mass unsolicited emails.
Investigative actions
- Examine email headers to trace origins and check for signs of spoofing.
- Analyze the email content for spam indicators like suspicious links and aggressive marketing language.
- Monitor further actions taken, such as file downloads or access to potentially malicious links.
Repeated quarantine releases from previously quarantined sender
Synopsis
Description
This message was previously quarantined by vendor and later released and delivered to the intended recipients, while the sender has been quarantined multiple times over the past 30 days.
Attacker's Goals
Achieve financial gain, distribute malware, or phish for sensitive information through mass unsolicited emails.
Investigative actions
- Examine email headers to trace origins and check for signs of spoofing.
- Analyze the email content for spam indicators like suspicious links and aggressive marketing language.
- Monitor further actions taken, such as file downloads or access to potentially malicious links.
Repeated quarantine-released emails received by mailbox
Synopsis
Description
This mailbox has repeatedly received messages over the past 30 days that were quarantined by vendor and later released and delivered to the recipient.
Attacker's Goals
Achieve financial gain, distribute malware, or phish for sensitive information through mass unsolicited emails.
Investigative actions
- Examine email headers to trace origins and check for signs of spoofing.
- Analyze the email content for spam indicators like suspicious links and aggressive marketing language.
- Monitor further actions taken, such as file downloads or access to potentially malicious links.