Red Sift - New email with URL from previously unseen sender

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Detects email forensics events that contain one or more URLs where the sender in the from field has not been seen in the previous 14 days, which may indicate phishing activity or a newly observed sender.

Attribute	Value
Type	Analytic Rule
Solution	Red Sift
ID	6e0b70d4-0ab8-480e-9707-8ad45fc21a65
Severity	Medium
Status	Available
Kind	Scheduled
Tactics	InitialAccess
Techniques	T1566
Required Connectors	RedSiftPush
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
RedSiftEmailForensics_CL	✗	✓	✗

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules · Back to Red Sift