Check Point Harmony Email & Collaboration multiple phishing emails from external sender

This rule is part of a beta feature. To learn more, contact Support.
checkpoint-harmony-email-and-collaboration

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1566-phishing

이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detects when multiple phishing emails are received from an external sender within a short period, which may indicate an ongoing phishing campaign targeting users.

Strategy

This rule monitors inbound emails and raises an alert when multiple phishing emails originate from an external sender, potentially signalling a coordinated attack or a compromised sender account. Emails that are quarantined or deleted do not raise an alert.

Triage and Response

  1. Review the sender email address {{@event.entity.entity_payload.from_email}} to determine legitimacy.
  2. Quarantine or delete the detected phishing emails to prevent user interaction.
  3. Investigate if the sender is a compromised legitimate account or part of a larger phishing campaign.
  4. If confirmed malicious, begin the security incident response process.