Alert for Attack Pattern

Question

Alert for Attack Pattern

Hasan Bozkurt 25

Hello guys,

I have searched a solution which is about a email attack.

My scenario is very simple.

Setting an alert for an email attack that is in the particular time period (for ex last 24 hour) an email sender sends sequentially to different email address of a domain.

Consider that one email address ******@gmail.com sends different 30 email address of a domain in one day.

We want to detect this type of behaviour easliy but MS support says no way to do this.

JimmyYang-MSFT 58,781 Reputation points Moderator

2024-03-07T02:14:34.54+00:00

@Hasan Bozkurt

We will check it.

1 answer

Your answer

JimmyYang-MSFT 58,781 Reputation points Moderator

2024-03-07T02:14:34.54+00:00

@Hasan Bozkurt

We will check it.

Answer 1

JimmyYang-MSFT 58,781 Moderator

@Hasan Bozkurt

According to your description, do you mean you want to set an alert to this email attack for your organization?

Based on my knowledge, Microsoft is not providing this option to help you detect this email attack.

However, If you always receive this spam email from this specific sender, I would suggest you create an mailflow rule that would automatically delete emails from recipients that contains his email address or specific subject on their email address. To do that, you could refer to this article’s step.

如何使用 Office 365 中的邮件流规则阻止传出电子邮件 (codetwo.com)

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Hasan Bozkurt 25 Reputation points

2024-03-07T08:52:10+00:00

In somehow the attacker can get the email adresses. And they send email behalf on our companyowner and he sends the same emails like robot sequentially. It is not a spam and it is phishing. And AI could not detect two times. And luckily no one clicked it.

So that is the pattern that we want the Microsoft to implement or allow us to do this.

I think this type of a feature can be useful for many companies.

We cannot disallow all incoming email from outside organization. This makes no sense.

And also we do not want to block this behaviour. We want to detect it.

Because a normal user would send this email most likely with bulk list. But this sends seperately and sequentially.
JimmyYang-MSFT 58,781 Reputation points Moderator

2024-03-14T09:58:10.32+00:00

In somehow the attacker can get the email adresses. And they send email behalf on our companyowner and he sends the same emails like robot sequentially. It is not a spam and it is phishing.

It is really terrible. Unfortunately, there is no effectivity settings could detect these phishing emails in Exchange Server. To help you get these requirements, we recommend you give the feedback in this UserVoice link.Microsoft will always focus on customer’s feedback and experience. Some new features would be added to the services based on customers' feedback in the future, and your good ideas will be very helpful for them to improve the service.
JimmyYang-MSFT 58,781 Reputation points Moderator

2024-03-28T05:17:58.8033333+00:00

@Hasan Bozkurt

Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.

Share via

Alert for Attack Pattern

1 answer

Your answer