Sensitive Exchange mail sent to external users

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2024-12-03

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Requires: Office 365 Audit
Detection Modules	Identity Threat Module
Detector Tags	O365 DLP Analytics
ATT&CK Tactic	Collection (TA0009) Exfiltration (TA0010)
ATT&CK Technique	Email Collection (T1114) Exfiltration Over Alternative Protocol (T1048)
Severity	Informational

A user sent sensitive email messages to external users.

An attacker is attempting to collect sensitive email information.

Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
Follow further actions done by the account.
Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).
Examine the user's email activity history for suspicious behavior.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

A user sent sensitive email messages to external users.

An attacker is attempting to collect sensitive email information.

Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
Follow further actions done by the account.
Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).
Examine the user's email activity history for suspicious behavior.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

A user sent sensitive email messages to external users.

An attacker is attempting to collect sensitive email information.

Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
Follow further actions done by the account.
Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).
Examine the user's email activity history for suspicious behavior.