AN0147
Analytic 0147
Windows
Sequence of internal email sent from a recently compromised user account (preceded by abnormal logon or device activity), with attachments or links leading to execution or credential harvesting. Defender observes: internal mail delivery to peers with high entropy attachments, followed by click events, process initiation, or credential prompts.
WinEventLog:Security
EventCode=4624, 4648
WinEventLog:Security
EventCode=4625
WinEventLog:Security
EventCode=4672
m365:unified
SendOnBehalf, MessageSend, ClickThrough, MailItemsAccessed
WinEventLog:Sysmon
EventCode=1
[TimeWindow]
Expected time between internal email and link execution or file dropper
[UserContext]
Baseline logon locations and device usage for sender accounts
[AttachmentEntropyThreshold]
Entropy value over which attachment is considered suspicious
AN0148
Analytic 0148
Linux
Delivery of suspicious internal communication (e.g., Thunderbird, Evolution) using compromised internal accounts. Sequence of: unexpected user activity + mail transfer logs + download or execution of attachments.
auditd:SYSCALL
execve
Application:Mail
smtpd$.*$: .*from=[.*@internaldomain.com](mailto:.*@internaldomain.com) to=[.*@internaldomain.com](mailto:.*@internaldomain.com)
linux:syslog
curl|wget|python .*http
[SubjectLineAnomaly]
Deviation from typical internal email subjects
[AttachmentType]
Executable types allowed or flagged by mail relay
AN0149
Analytic 0149
macOS
Abnormal Apple Mail use, including internal email relays followed by file execution or script events (e.g., attachments launched via Preview, terminal triggered from Mail.app)
macos:unifiedlog
com.apple.mail.* exec.*
macos:unifiedlog
curl|osascript.*open location
[ExecutionChainDepth]
Number of child processes stemming from Mail.app
[MailScriptFlag]
Toggle on scripting detection within mail context
AN0150
Analytic 0150
SaaS
Internal spearphishing via SaaS applications (e.g., Slack, Teams, Gmail): message sent from compromised user with attachment or URL, followed by click and credential access behavior.
saas:slack
file_upload, message_send, message_click
[UserAnomalyThreshold]
Volume or timing of messages sent after compromise
[FileRiskScoring]
Whether SaaS DLP assigns risk scores to attachments
AN0151
Analytic 0151
Office Suite
Outlook or Word used to forward suspicious internal attachments with macro content. Defender observes attachment forwarding, auto-opening behaviors, or macro prompt interactions.
m365:unified
SendOnBehalf, MessageSend, AttachmentPreviewed
WinEventLog:Security
EventCode=4103, 4104, 4105, 4106
[MacroExecutionWindow]
Timing between mail open and macro invocation
[AttachmentNameHeuristics]
Patterns of known internal spearphishing lures (e.g., invoice, HR_policy)