Check Point Harmony Email & Collaboration - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/check-point-harmony-email--collaboration/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 18:29:00 +0000Elastic Defend and Email Alerts Correlationhttps://feed.craftedsignal.io/briefs/2024-01-elastic-defend-email-correlation/Wed, 03 Jan 2024 18:29:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-elastic-defend-email-correlation/This rule correlates Elastic Defend alerts with email security alerts by target username, potentially indicating a successful phishing attack and subsequent endpoint compromise.This Elastic detection rule, released on April 10, 2026, aims to identify potentially successful phishing attacks by correlating alerts from Elastic Defend (endpoint) and Check Point Harmony Email & Collaboration (email security). The rule focuses on identifying instances where the same target username is present in both endpoint and email-related alerts, suggesting that a user who received a malicious email may have also triggered an endpoint security alert due to the email's payload or a subsequent action. This correlation helps security teams prioritize investigations by highlighting users who are potentially compromised and require immediate attention. The rule uses a 45-minute interval, searching for alerts within the last hour. This approach provides a streamlined method for pinpointing potential phishing campaign successes that bypass initial email security measures.

Attack Chain

  1. A threat actor sends a spearphishing email to a target user containing a malicious attachment or link.
  2. The email bypasses initial email security controls (e.g., Check Point Harmony Email & Collaboration) and is delivered to the user's inbox.
  3. The user opens the malicious attachment or clicks the link, initiating the download or execution of malware on the endpoint.
  4. The malware executes, leading to suspicious behavior on the endpoint, such as unauthorized process creation or file modifications.
  5. Elastic Defend detects the suspicious endpoint activity and generates an alert, including the affected user's username.
  6. The Elastic detection rule identifies both an email alert and an Elastic Defend alert associated with the same target username.
  7. The detection rule triggers an alert, indicating a potential successful phishing attack and endpoint compromise.
  8. Security analysts investigate the correlated alerts to determine the scope of the compromise and initiate remediation actions.

Impact

A successful attack can lead to malware infection, data exfiltration, or ransomware deployment. The impact can range from a single compromised endpoint to a broader network breach, depending on the attacker's objectives and the organization's security posture. Correlating endpoint and email alerts reduces the time to detection and response, limiting the potential damage. Failure to detect these correlated events can result in significant financial losses, reputational damage, and operational disruption. The rule assigns a risk score of 73, indicating a high level of concern.

Recommendation

  • Deploy the provided ESQL rule to your Elastic environment and tune the from and interval parameters for your environment.
  • Enable Elastic Defend and Check Point Harmony Email & Collaboration integrations to ingest relevant logs (Data Source: Elastic Defend, Data Source: Check Point Harmony Email & Collaboration).
  • Investigate alerts generated by this rule by reviewing the alert details, related emails, and endpoint activity to identify the source and scope of the potential compromise (note section).
  • Configure automated response actions to isolate affected hosts and initiate incident response workflows when this rule triggers (note section).
]]>highadvisorythreat-detectionphishingendpointemail