Email with spam category opened by user

This rule is part of a beta feature. To learn more, contact Support.
abnormal-security

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1566-phishing

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect when a spam email is opened.

Strategy

This rule monitors Abnormal logs to detect when a spam email is opened by a user.

Triage and response

  1. Investigate the user, {{@messages.toAddresses}}, who was impacted by the email.
  2. If confirmed as a threat, implement measures to block or limit the impact of the suspicious activity.
  3. Follow company procedures for handling malicious files, including isolating the endpoint, running antivirus/antimalware scans, analyzing logs, and updating security policies.