AN0188
Analytic 0188
Windows
Unusual inbound email activity where attachments or embedded URLs are delivered to users followed by execution of new processes or suspicious document behavior. Detection involves correlating email metadata, file creation, and network activity after a phishing message is received.
m365:unified
Send/Receive: Emails with suspicious sender domains, spoofed headers, or anomalous attachment types
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
[SuspiciousFileTypes]
Attachment types considered high risk (e.g., .exe, .js, .vbs, .scr, macro-enabled docs).
[AllowedSenders]
Whitelist of known trusted senders to reduce false positives.
AN0189
Analytic 0189
Linux
Monitor for malicious payload delivery through phishing where attachments or URLs in email clients (e.g., Thunderbird, mutt) result in unusual file creation or outbound network connections. Focus on correlation between mail logs, file writes, and execution activity.
Application:Mail
Inbound messages with anomalous headers, spoofed SPF/DKIM failures
auditd:SYSCALL
execve: Execution of scripts or binaries sourced from mail directories (/var/mail, ~/Maildir)
[MonitoredMailPaths]
System or user directories where emails/attachments are stored.
[AttachmentHashBaseline]
Known good hashes for common business document templates.
AN0190
Analytic 0190
macOS
Detection of phishing through anomalous Mail app activity, such as attachments saved to disk and immediately executed, or Safari/Preview launching URLs and files linked from email messages. Correlate UnifiedLogs events with subsequent process execution.
macos:unifiedlog
Inbound email activity with suspicious domains or mismatched sender information
macos:unifiedlog
Preview.app, Safari.app, or Mail.app spawning new processes outside normal patterns
[SuspiciousDomains]
List of domains known for phishing activity or suspicious sender infrastructure.
[ExecutionDelayWindow]
Time threshold between file save and execution considered suspicious.
AN0191
Analytic 0191
Office Suite
Phishing via Office documents containing embedded macros or links that spawn processes. Detection relies on correlating Office application logs with suspicious child process execution and outbound network connections.
m365:unified
FileAccessed: Access of email attachments by Office applications
WinEventLog:Sysmon
EventCode=1
[ParentProcessList]
Parent processes expected to execute child processes (e.g., Office apps).
[MacroExecutionThreshold]
Threshold for number of macros executed before raising alerts.
AN0192
Analytic 0192
Identity Provider
Phishing attempts targeting IdPs often manifest as anomalous login attempts from suspicious email invitations or fake SSO prompts. Detection correlates login flows, MFA bypass attempts, and anomalous geographic patterns following phishing email delivery.
azure:signinlogs
Failed MFA attempts, unusual conditional access triggers, login attempts from unexpected IP ranges
[GeoAnomalyThreshold]
Allowed distance/time delta between user sign-ins.
[MFABypassIndicators]
Signals of repeated or anomalous MFA failures linked to phishing campaigns.
AN0193
Analytic 0193
SaaS
Phishing delivered via SaaS services (chat, collaboration platforms) where messages contain malicious URLs or attachments. Detect anomalous link clicks, suspicious file uploads, or token misuse after SaaS-based phishing attempts.
saas:collaboration
MessagePosted: Suspicious links or attachment delivery via collaboration tools (Slack, Teams, Zoom)
[MonitoredSaaSApps]
Scope of SaaS platforms under phishing monitoring.
[LinkInspectionPolicy]
Threshold for auto-expansion and detonation of URLs sent in SaaS messages.