WitFoo-Artifact ::: severityLabel=informational ::: application=ThreatManagement ::: startTimeUTC=2024-07-08T20:15:03.2925699Z ::: severityCode=5 ::: created_at=2024-07-08T20:15:03.2925699Z ::: message={"activityGroupName":null,"alertDetections":[],"assignedTo":null,"azureSubscriptionId":null,"azureTenantId":"4055bd5f-b117-4bb4-befa-de484bd06de8","category":"ThreatManagement","closedDateTime":null,"cloudAppStates":[],"comments":["New alert"],"confidence":null,"createdDateTime":"2024-07-08T20:20:44Z","description":"Emails with malicious URL that were delivered and later removed -V1.0.0.3","detectionIds":[],"eventDateTime":"2024-07-08T20:15:03.2925699Z","feedback":null,"fileStates":[],"historyStates":[],"hostStates":[],"id":"94ad01f2-a28f-3307-ba00-08dc9f8aa4dc","incidentIds":[],"investigationSecurityStates":[],"lastEventDateTime":null,"lastModifiedDateTime":"2024-07-08T20:42:04.7466667Z","malwareStates":[{"category":null,"family":"6eff4d0b-dc6b-4187-d49e-08dc9f7ba934-7067053706471445382-1","name":null,"severity":null,"wasRunning":null}],"messageSecurityStates":[],"networkConnections":[{"applicationName":null,"destinationAddress":null,"destinationDomain":null,"destinationLocation":null,"destinationPort":null,"destinationUrl":"www.bestdeals.today/api/v1/redirect?url=ahr0cdovl3d3dy5pc2fkyxrhbgfilmnvbs9yzwrpcmvjdd9jbgllbnrjzd1lztvhnjrlms0znzqzltlingmtzdkymy02ztzkmdkyywu0mdkmyxbwswq9njkmdmfsdwu9jtvcru1wjtiwrklfteqlnurftufjtcu1qkvnviuymc9gsuvmrcu1rczjyxq9vgvjag5pcxvlcytjdwx0dxjhbgvzjnvybd1odhrwoi8vdtq1ntg4mjyylmn0lnnlbmrncmlklm5ldcuyrmxzjtjgy2xpy2slm0z1cg4lm0r1mdaxlk4zyjgtmkzkeudasg5nbdy1tdkwek5ivtbonuk2bs0yqju3unhhwmd1uunqr0o5wlhlrffjbvp0whjhvxp2mva1ulzoqunsyln2b1lmumxprgxsn21zvzbqblhwukt2shh6djk4ltjgohhnuw5qufnvrvnkrfetmkzfedvxagfpvtrzy1ngwxpdnjmtmkjvvkdqdvzbqmfqnnvzbzr2qmzrdzzxrnhsulvpltjcmki4envjafduqmtwltjgcxyxmdgwnwrhylpnslpisgpzrdr2nutralllcldidg5irgxp","direction":null,"domainRegisteredDateTime":null,"localDnsName":null,"natDestinationAddress":null,"natDestinationPort":null,"natSourceAddress":null,"natSourcePort":null,"protocol":null,"riskScore":null,"sourceAddress":null,"sourceLocation":null,"sourcePort":null,"status":null,"urlParameters":null}],"processes":[],"recommendedActions":[],"registryKeyStates":[],"riskScore":null,"securityResources":[],"severity":"informational","sourceMaterials":["https://security.microsoft.com/viewalerts?id=94ad01f2-a28f-3307-ba00-08dc9f8aa4dc"],"status":"resolved","tags":[],"title":"Email messages containing malicious URL removed after delivery​","triggers":[],"uriClickSecurityStates":[],"userStates":[{"aadUserId":null,"accountName":"ycdreply","domainName":"mycalling.awsapps.com","emailRole":"sender","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":"133.122.149.238","logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"ycdreply@mycalling.awsapps.com"},{"aadUserId":null,"accountName":"charles","domainName":"umbrella.com","emailRole":"recipient","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"charles@umbrella.com"}],"vendorInformation":{"provider":"Office 365 Security and Compliance","providerVersion":null,"subProvider":null,"vendor":"Microsoft"},"vulnerabilityStates":[]} ::: emailTo=charles@umbrella.com ::: messageType=malicious_session ::: tags=[Emails with malicious URL that were delivered and later removed -V1.0.0.3,Email messages containing malicious URL removed after delivery​] ::: program=azure_security ::: endTimeUTC=2024-07-08T20:42:04.7466667Z ::: streamName=azure_security_alert ::: serverIP=133.122.149.238 ::: emailFrom=ycdreply@mycalling.awsapps.com
Product: Azure Security
Vendor: Microsoft