General

This rule compares emails in Office365 with the data in your MISP source. If an email is flagged with an attachment that is known in MISP, an alarm is raised.

Rationale

The MISP source serves as a repository of indicators that indicate malicious behavior. Such details are obtained from research into previous attacks on other organizations. Exchanging that data ensures that new similar attacks are detected in a timely manner. By mixing the data with logs in the Microsoft tenant, detection is active and Attic helps with rapid incident handling.

Attic currently supports the following MISP sources:

Z-CERT

IBD from VNG

FERM Rotterdam

Use of these sources is only permitted for the intended target group, which Attic will validate per customer. 

Manual follow-up

Follow these steps to follow up on this detection. If you have an Attic IR Strip card, you can call on our experts for this.

1. Open the Exchange admin portal https://admin.exchange.microsoft.com/
2. Go to Mail Flow > Message Trace
3. Start a new Trace
4. Enter the NetworkMessageID from the Attic alarm in the Message ID field
5. Click on Search
6. Examine the email.
   1. Check whether the email has been delivered to the mailbox. If yes: Assess whether the recipient opened the attachment. If yes: Check the system on which this happened for malware and take appropriate action.
   2. Collect data about the email to see if more similar emails have been received that require action.

More information

1. https://atticsecurity.com/misp2sentinel/