Forum Discussion

My-atix's avatar
My-atix
Tin Contributor
Aug 18, 2023

Malicious Emails from old employee

Hi All,

 

I have a challenge with regards to a large number of executives and users within a specific region being targeted with treat emails from an ex-employee. The ex-employee is using multiple email addresses from public email providers to send treat emails to internal recipients within the region and to certain executive management employees. Is there any way I can stop this using Microsoft Defender???

 

We do not have the possibility to block the users ip address range as this will block all emails from EG: Gmail.com/ outlook.com etc???

 

Any advice would be much appreciated.

1 Reply

  • ExMSW4319's avatar
    ExMSW4319
    Steel Contributor
    Aug 23, 2023
    If you mean threats then those might be actionable through local law enforcement or private legal action. If the ex-employee is rotating through many freemail addresses then you would need to show a pattern and provide convincing reasoning as to why you suspect a particular person.

    If the threat content is repetitive then you might have to resort to content detection where certain phrases match a pattern that triggers a mail flow rule. If you know that only certain freemail sending addresses are likely to be used then you can include those as a factor in the rule.