Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1566-phishing

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when TrendAI Email Security identifies a threat-related email.

Strategy

Monitor TrendAI Email Security logs for specific threat detection events. This rule aims to identify and respond to potential email threats promptly, ensuring the security of the email infrastructure and recipients.

Triage and Response

1. Threat event of {{@eventType}} type detected.
2. Review the email’s headers, body, and attachments for any indicators of malicious activity.
3. If malicious activity is confirmed, block the sender’s email address and quarantine the affected email(s) to prevent further access and distribution of harmful content.

Changelog

• 8 July 2026 - Rebranded Trend Micro to TrendAI and broadened the query to also match the @vendor.endpoint attribute.