Mimecast Alert: user responded to impersonation message

This rule is part of a beta feature. To learn more, contact Support.
mimecast

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1566-phishing

Set up the mimecast integration.

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

To identify and alert on emails that contain user responses to impersonation messages, indicating a successful impersonation attempt.

Strategy

This rule detects an email which contains impersonation attempts that have been flagged as external and malicious but have not been blocked or taken any action upon.

Triage and response

  1. Verify the nature of the user’s response to the impersonation email and assess the potential impact.
  2. Examine the sender’s details using {{@senderIPAddress}} to determine the source and legitimacy.
  3. Execute the company’s incident response protocol, which may include:
    • Alerting the affected user and providing education on recognizing impersonation attempts.
    • Revoking any credentials or access provided in response to the phishing email.
    • Strengthening email security measures to prevent similar incidents.