Trend Micro DDEI Email Recipient Changed in Transit
Detects a message having its recipient altered during processing. Recipient rewriting redirects mail away from its intended reader, and is a quiet way to intercept correspondence or to suppress a notification that would otherwise reveal an ongoing compromise. Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=email-gateway where sourcename='TREND-MICRO-DDEI' and action='EMAIL_RECIPIENT_CHANGED' | groupby sender, recipient, direction, remoteip
Sigma
