AN0655
Analytic 0655
Windows
Detection of spearphishing attachments by correlating suspicious email delivery with subsequent file creation and abnormal process execution (e.g., Office spawning PowerShell or CMD). Behavior chain includes inbound email metadata → attachment stored on disk → process execution → outbound network activity.
m365:unified
Send/Receive: Inbound emails with attachments from suspicious or spoofed senders
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=3, 22
[AttachmentExtensions]
List of high-risk extensions to monitor (e.g., .exe, .js, .vbs, .docm, .xlsm).
[SuspiciousParentChildPairs]
Process lineage patterns considered malicious (e.g., winword.exe → powershell.exe).
[TimeWindow]
Correlation window between email receipt, file creation, and process execution.
AN0656
Analytic 0656
Linux
Phishing attachments executed on Linux systems are detected by linking email logs to file creation in mail directories and subsequent suspicious process execution. Look for unexpected binaries or scripts spawned from user mail directories and anomalous outbound network activity.
Application:Mail
Inbound email attachments logged from MTAs with suspicious metadata
auditd:SYSCALL
execve: Execution of files saved in mail or download directories
NSM:Flow
Outbound traffic from suspicious new processes post-attachment execution
[AttachmentStoragePaths]
Monitored directories for email attachments (e.g., /var/mail, ~/Maildir, ~/Downloads).
[ScriptInterpreters]
List of interpreters to monitor when spawned by mail clients (e.g., bash, python, perl).
AN0657
Analytic 0657
macOS
Phishing attachment detection on macOS through correlation of Mail app logs, file creation in user directories, and abnormal process execution (e.g., Preview.app or Mail.app spawning Terminal or scripting binaries). Network traffic after attachment interaction is also monitored.
macos:unifiedlog
Inbound messages with attachments from suspicious domains
macos:unifiedlog
Execution of Terminal, osascript, or other interpreters originating from Mail or Preview
macos:unifiedlog
Attachment files written to ~/Downloads or temporary folders
[ExecutionDelayThreshold]
Time delay between attachment download and execution considered suspicious.
[SuspiciousParentApps]
Parent processes expected to rarely spawn child processes (e.g., Mail.app, Preview.app).