Cisco Secure Email Threat Defense unusual spike found for emails having `Rare sender domain` detection technique

This rule is part of a beta feature. To learn more, contact Support.
cisco-secure-email-threat-defense

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1566-phishing

Set up the cisco-secure-email-threat-defense integration.

Esta página aún no está disponible en español. Estamos trabajando en su traducción.
Si tienes alguna pregunta o comentario sobre nuestro actual proyecto de traducción, no dudes en ponerte en contacto con nosotros.

Goal

Detects emails when there is a unusual spike in emails having Rare sender domain detection technique.

Strategy

This rule monitors emails to detect spike in emails with Rare sender domain detection technique.

Triage and response

  1. Investigate emails metadata that are: sender, receiver, sender domain to further evaluate the impact.
  2. Determine the severity - {{@verdict.techniques.severity}} of the threat based emails and the potential impact on the organization.
  3. Block these domains according to company policy if required.
  4. Analyse if any sensitive data has been shared with these rare sender domain emails.