Exchange Inbound Attachment From First-Seen Remote Server
Detects inbound mail carrying an attachment from a sending server not previously seen. Most legitimate correspondence arrives from infrastructure with history; first-contact plus attachment is the shape of a targeted delivery attempt. Pair with the recipient list: a single first-seen sender reaching many recipients at once is a campaign rather than a one-off. Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=email-gateway where sourcename='MS-EXCHANGE' and action='EMAIL_RECEIVED' and file != '' | groupby remoteip, sender, file, recipient
Sigma
