AN0298
Analytic 0298
Windows
Correlation of inbound emails with embedded links followed by user-driven browser navigation to suspicious or obfuscated domains. Detection chain includes malicious URL in email → user click recorded in Office logs → browser process spawning unusual child processes (e.g., PowerShell, cmd) or download activity.
m365:unified
Send/Receive: Inbound emails containing embedded or shortened URLs
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=3, 22
[SuspiciousTLDs]
List of monitored top-level domains commonly abused in phishing (e.g., .xyz, .top, .tk).
[URLShortenerDomains]
Domains like bit.ly, tinyurl.com flagged for deeper expansion/inspection.
[ClickToExecutionWindow]
Time threshold between URL click and suspicious process execution.
AN0299
Analytic 0299
Linux
Detection of spearphishing links through mail logs and browser activity. Behavior includes email with suspicious URLs → user click recorded in mail/web proxy logs → shell or interpreter launched from browser process.
Application:Mail
Inbound emails containing hyperlinks from suspicious sources
auditd:SYSCALL
execve: Execution of scripts or binaries spawned from browser processes
NSM:Flow
Outbound requests to domains not previously resolved or associated with phishing campaigns
[MonitoredBrowsers]
List of browser processes to monitor (e.g., firefox, chrome, chromium).
[PhishingIndicators]
Custom regex patterns for detecting obfuscated or IDN homograph URLs.
AN0300
Analytic 0300
macOS
Correlation of Mail.app logs with Safari/Chrome activity. Suspicious behavior includes email links → Safari/Chrome accessing newly registered or lookalike domains → osascript or Terminal spawned unexpectedly.
macos:unifiedlog
Received messages with embedded or shortened URLs
macos:unifiedlog
Browser processes launching unexpected interpreters (osascript, bash)
macos:unifiedlog
Connections to suspicious domains with mismatched certificate or unusual patterns
[CertificateAnomalies]
Flag self-signed or mismatched TLS certificates from spearphishing domains.
[ExecutionDelayThreshold]
Suspicious delay between URL click and malicious process spawn.
AN0301
Analytic 0301
Identity Provider
Detection of OAuth consent phishing or malicious login attempts initiated through spearphishing links. Behavior chain includes inbound email with OAuth URL → consent page visited → unusual token grants logged in IdP logs.
azure:signinlogs
ConsentGrant: Suspicious consent grants to non-approved or unknown applications
[AllowedApps]
Whitelisted apps permitted for OAuth consent grants.
[AnomalousConsentPatterns]
Patterns of consent from unusual geographies, devices, or unapproved applications.