Email with spam category opened by user

This rule is part of a beta feature. To learn more, contact Support.

Classification:

attack

Tactic:

Technique:

Goal

Detect when a spam email is opened.

This rule monitors Abnormal logs to detect when a spam email is opened by a user.

Investigate the user, {{@messages.toAddresses}}, who was impacted by the email.
If confirmed as a threat, implement measures to block or limit the impact of the suspicious activity.
Follow company procedures for handling malicious files, including isolating the endpoint, running antivirus/antimalware scans, analyzing logs, and updating security policies.