AN0320
Analytic 0320
Windows
Inbound spearphishing attempts delivered via third-party services (e.g., Gmail, LinkedIn messages) leading to malicious file downloads or browser-initiated script execution. Defender view includes correlation of external service logins, unexpected file write operations, and suspicious descendant processes spawned from productivity or browser applications.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=3, 22
[MonitoredServices]
List of third-party services (e.g., Gmail, LinkedIn, Dropbox) relevant to the organization’s threat profile.
[SuspiciousProcessPatterns]
Process lineage and parent-child execution relationships considered abnormal (e.g., outlook.exe → powershell.exe).
[TimeWindow]
Correlates file creation and outbound connection activity within a tunable time period after message receipt.
AN0321
Analytic 0321
Linux
Use of non-enterprise email or messaging services in Thunderbird, Evolution, or browsers leading to suspicious file downloads and subsequent execution. Defender view includes browser-initiated downloads of unexpected content and shell or interpreter processes launched post-download.
auditd:SYSCALL
execve: Execution of bash, python, or perl processes spawned by browser/email client
linux:syslog
Inbound messages from webmail services containing attachments or URLs
NSM:Flow
Outbound traffic to domains/IPs not previously resolved, occurring shortly after attachment download or link click
[BrowserProcesses]
Configured list of browsers or email clients to monitor (e.g., firefox, chromium, thunderbird).
[PhishingIndicators]
Custom regex rules for suspicious URL patterns, file extensions, or encoded links.
AN0322
Analytic 0322
macOS
Phishing attempts via iCloud Mail, Gmail, or social media apps accessed on macOS systems. Defender view includes Mail.app or Safari downloads of files followed by osascript, Terminal, or abnormal child process execution.
macos:unifiedlog
Received messages containing embedded links or attachments from non-enterprise services
macos:unifiedlog
Execution of osascript, bash, or Terminal initiated from Mail.app or Safari
macos:unifiedlog
Suspicious outbound HTTPS requests to domains flagged as newly registered or untrusted after spearphishing message interaction
[CertificateChecks]
Flagging mismatched or self-signed certificates during outbound connections initiated after spearphishing messages.
[ExecutionDelay]
Window of time between attachment download and subsequent suspicious execution.