Attack Surface: Email
Email attack surface
The gateway missed the phishing email. The user clicked the link. ManySignal detected the suspicious authentication 90 seconds later, correlated it to the email click event, and suspended the session before credential use.
Email is the most common initial access vector — and the hardest to monitor post-delivery
Phishing and spear phishing
T1566.001Credential harvest, malware delivery, AiTM proxy attacks
BEC and CEO fraud
T1534Wire transfer fraud, payroll redirect, vendor fraud
Mailbox forwarding rules
T1114.003Silent email copy to external attacker-controlled address
OAuth consent phishing
T1550.001Third-party app granted access to mailbox content
Mailbox access via legacy auth
T1110IMAP/POP3 access bypassing MFA, credential stuffing
Email-borne malware
T1566.001Attachment delivery of loader, ransomware, RAT
Top 5 detection rules
trigger: email_link_click (from gateway click-tracking log)
OR suspicious_email_reported (user submission)
correlate_post_delivery:
- authentication_events: next_60_minutes from same user
- file_access: downloaded files matching attachment names
- process_execution: new processes from browser context
- network_connections: connections to email-linked domains
response_actions:
if credential_harvest_detected:
- suspend_session: immediately
- reset_mfa: enqueue for user
- investigate: full timeline
if gateway_missed_bulk_campaign:
- recall_messages: via M365 purview / google vault
- identify_recipients: all users who received same email
- check_interactions: which recipients clicked / opened
- user_verification: automated Slack check for clickersRelated use cases
Email attack surface FAQ
How does ManySignal analyze phishing emails differently from email security gateways?
Email security gateways evaluate messages at receipt time using reputation and signature matching. ManySignal adds a behavioral correlation layer: when a user clicks a link from an email, ManySignal correlates the click with the user's subsequent authentication events, file accesses, and network connections. This post-click visibility catches attacks that bypass gateway inspection and enables rapid response when a user has interacted with a malicious message.
Does ManySignal detect mailbox forwarding rules used in BEC attacks?
Yes. ManySignal monitors Microsoft 365 and Google Workspace admin audit logs for inbox rule creation, particularly rules that forward email to external addresses or mark messages as read/delete without the user's interaction. Rules created shortly after authentication from unusual locations or after credential reset events are flagged as high priority for BEC investigation.
How does ManySignal detect when a user's mailbox has been accessed by a threat actor?
Mailbox access from an IP address not matching the user's authenticated session, access via legacy protocols (IMAP/POP3) when the user normally uses modern authentication, and access patterns inconsistent with the user's time zone are all flagged. ManySignal correlates mailbox access events with authentication events to identify sessions that aren't tied to a legitimate user login.
Can ManySignal block malicious emails or is it detection-only?
ManySignal is detection and response-focused, not a replacement for email security gateways. When a malicious email campaign is confirmed, ManySignal can trigger a response workflow: recall the message from all recipient mailboxes (via Microsoft Purview or Google Vault API), block the sender domain across the email gateway, and initiate user verification for all recipients who interacted with the message.
How does ManySignal detect OAuth consent phishing and malicious third-party app grants?
ManySignal monitors Microsoft 365 and Google Workspace OAuth consent logs for grants to third-party applications requesting broad mailbox permissions (Mail.ReadWrite, offline_access). Grants made after suspicious authentication events, grants to newly registered applications, or grants to apps with low reputation signals are flagged. Automated response can revoke the OAuth token and notify the affected user.
Does ManySignal integrate with existing email security gateways like Proofpoint or Microsoft Defender for Office 365?
Yes. ManySignal ingests alert feeds from Proofpoint TAP, Microsoft Defender for Office 365, Abnormal Security, and Mimecast. When the email gateway fires an alert, ManySignal enriches it with the post-delivery behavioral context — whether the user interacted with the message, what authentication events followed, and whether any associated file downloads occurred. The gateway provides the pre-delivery signal; ManySignal adds the post-delivery behavioral layer.
What does ManySignal do when it detects a Business Email Compromise wire transfer request?
ManySignal doesn't monitor email message content for wire transfer language — that's the domain of email security gateways with natural language processing. ManySignal detects the upstream compromise that enables BEC: the mailbox access anomaly, the inbox rule creation, the authentication from an unusual location. By detecting the mailbox compromise before the fraudulent email is sent, ManySignal enables response before the financial harm occurs.
How does ManySignal handle large phishing campaigns targeting hundreds of users simultaneously?
ManySignal correlates simultaneous phishing interactions across users into a single campaign case. Rather than generating one alert per user who clicked a link, the Triage agent groups all affected users under a campaign indicator and generates a single high-priority case. The analyst sees: campaign scope (all affected users), interaction status (who clicked, who entered credentials, who is at risk), and a single recommended response workflow covering all affected accounts.
Detect phishing attacks at the click, not the gateway
Post-delivery behavioral correlation catches credential harvesting within 90 seconds of the user interaction.