SignalHunt
← All rules

EMAIL-8003

high

Mass Phishing Campaign From a Single External Sender

Detects the same external sender address triggering the gateway's phishing verdict across many messages in a short window - a mass phishing campaign targeting the organization, as opposed to a single one-off flagged message.

T1566

Detection logic

{
  "detection_type": "threshold",
  "selection": {
    "direction": "inbound",
    "verdict": "phish"
  },
  "groupby": "sender",
  "timeframe_minutes": 10,
  "threshold": 8,
  "condition": "gte"
}

Log source: category=email_gateway · Event ID(s): email_verdict

Required log fields

  • direction
  • verdict
  • sender
  • timestamp

Enabling this in your environment

Where: Email gateway anti-phishing verdict logging

Ensure the gateway logs its per-message verdict (clean/spam/phish/ malware/bulk) for every processed message, not only for messages it blocked - a message quarantined can still be logged as "phish" while the action taken is separately "quarantined."

groupby is sender (a single mailbox/address), which undercounts a campaign that rotates through many different sending addresses from the same infrastructure - pair with sender-domain or sending-IP reputation correlation for broader campaigns.

False positives

  • A phishing-simulation/security-awareness training campaign run by the organization's own security team, sent from a lookalike test domain
  • A misconfigured internal system whose outbound notification emails get misclassified as phishing by a downstream forwarder

References