WitFoo-Artifact ::: emailTo=reese@stark.com ::: severityLabel=informational ::: messageType=malicious_session ::: tags=[Emails with malicious URL that were delivered and later removed -V1.0.0.3,Email messages containing malicious URL removed after delivery​] ::: application=ThreatManagement ::: severityCode=5 ::: program=azure_security ::: serverIP=178.253.75.121 ::: startTimeUTC=2024-07-18T14:29:38.2219749Z ::: emailFrom=ian.moorehjnnc@ftefg.webmaster.mk ::: endTimeUTC=2024-07-18T16:09:43.9966667Z ::: created_at=2024-07-18T14:29:38.2219749Z ::: message={"activityGroupName":null,"alertDetections":[],"assignedTo":null,"azureSubscriptionId":null,"azureTenantId":"4055bd5f-b117-4bb4-befa-de484bd06de8","category":"ThreatManagement","closedDateTime":null,"cloudAppStates":[],"comments":["New alert"],"confidence":null,"createdDateTime":"2024-07-18T14:35:43.1333333Z","description":"Emails with malicious URL that were delivered and later removed -V1.0.0.3","detectionIds":[],"eventDateTime":"2024-07-18T14:29:38.2219749Z","feedback":null,"fileStates":[],"historyStates":[],"hostStates":[],"id":"fc03c85b-405d-818c-9e00-08dca735f711","incidentIds":[],"investigationSecurityStates":[],"lastEventDateTime":null,"lastModifiedDateTime":"2024-07-18T16:09:43.9966667Z","malwareStates":[{"category":null,"family":"0b1677f3-7e6d-4eb3-c1e4-08dca699f890-3600466711026277654-1","name":null,"severity":null,"wasRunning":null}],"messageSecurityStates":[],"networkConnections":[{"applicationName":null,"destinationAddress":null,"destinationDomain":null,"destinationLocation":null,"destinationPort":null,"destinationUrl":"chernobyl.digital","direction":null,"domainRegisteredDateTime":null,"localDnsName":null,"natDestinationAddress":null,"natDestinationPort":null,"natSourceAddress":null,"natSourcePort":null,"protocol":null,"riskScore":null,"sourceAddress":null,"sourceLocation":null,"sourcePort":null,"status":null,"urlParameters":null}],"processes":[],"recommendedActions":[],"registryKeyStates":[],"riskScore":null,"securityResources":[],"severity":"informational","sourceMaterials":["https://security.microsoft.com/viewalerts?id=fc03c85b-405d-818c-9e00-08dca735f711"],"status":"resolved","tags":[],"title":"Email messages containing malicious URL removed after delivery​","triggers":[],"uriClickSecurityStates":[],"userStates":[{"aadUserId":null,"accountName":"ian.moorehjnnc","domainName":"ftefg.webmaster.mk","emailRole":"sender","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":"178.253.75.121","logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"ian.moorehjnnc@ftefg.webmaster.mk"},{"aadUserId":null,"accountName":"reese","domainName":"stark.com","emailRole":"recipient","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"reese@stark.com"}],"vendorInformation":{"provider":"Office 365 Security and Compliance","providerVersion":null,"subProvider":null,"vendor":"Microsoft"},"vulnerabilityStates":[]} ::: streamName=azure_security_alert
Product: Azure Security
Vendor: Microsoft