Abnormal Security - Newly observed vendor domains

Lists vendor domains that first appear in Abnormal Security vendor cases within the hunting window. A newly observed vendor domain tied to a case can be an early signal of vendor email compromise or impersonation.

Detection logic

Detection requirements

Platform: Identity Provider Linux macOS Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: abnormalsecuritypush
Log source service: abnormal_security_vendor_case_cl

Detection rules

Abnormal Security - Newly observed vendor domains

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules