AN1008: Analytic 1008
Detect abnormally high volume of inbound email messages or repetitive attachments being delivered to a single mailbox within a short time window. Defenders should look for anomalous spikes in message counts and repetitive attachment file creation events correlated with targeted users.
Analyst context for executives and security teams
AN1008 is a detection analytic for spotting unusual bursts of inbound email to one mailbox, especially when the same or repetitive attachments appear in a short time window. For leaders, the value is early recognition of mailbox-focused disruption or suspicious delivery patterns before SOC and incident response teams lose time separating normal business spikes from abnormal targeting.
Executive priority
Prioritize this analytic where email availability, executive mailboxes, shared operational mailboxes, or high-volume business workflows are material to continuity. The key management question is whether the organization can prove it collects enough mail-flow and endpoint evidence to distinguish expected campaigns from abnormal mailbox targeting and repetitive attachment delivery. This also supports audit and incident readiness by showing whether email security monitoring is measurable, tuned, and reviewable.
Technical view
Validate coverage on Windows environments by correlating inbound email message counts with attachment-related file creation events tied to the same targeted user or mailbox over short time windows. Because ATT&CK provides no tactic mapping, relationship context, or formal detection logic for this object, teams should treat AN1008 as a behavioral analytic pattern rather than a complete rule. SOC teams should baseline normal mailbox volume and attachment repetition for users, shared mailboxes, and business processes before alerting on spikes.
Likely telemetry
- Email gateway or mail-flow logs showing inbound message counts, recipients, timestamps, sender metadata, and attachment metadata
- Mailbox audit or message tracking data for per-mailbox delivery volume over short time windows
- Windows endpoint file creation telemetry for attachment downloads or saved attachments associated with the targeted user
- User and mailbox identity context to distinguish individual, shared, service, or high-volume operational mailboxes
- Alert enrichment data linking repetitive attachment names, hashes, sizes, or creation events to the same recipient
Detection direction
- Establish per-mailbox baselines for normal inbound volume and expected attachment repetition before defining anomaly thresholds.
- Correlate email delivery spikes with Windows attachment file creation events for the same user to reduce noise from mail-only volume changes.
- Tune separately for shared mailboxes, distribution-list effects, business campaigns, automated notifications, and other legitimate high-volume workflows.
- Review false positives from marketing blasts, ticketing systems, billing workflows, scans, or business processes that deliver repeated attachments.
- Because no official detection logic is supplied, document local threshold choices, time windows, and enrichment requirements as part of detection engineering evidence.
Mitigation priorities
- Ensure email and Windows endpoint telemetry needed for this analytic is retained, searchable, and linked to user or mailbox identity.
- Prioritize baselining of critical, executive, shared, and operational mailboxes where abnormal delivery volume could affect response decisions or business continuity.
- Use mail security controls, attachment handling policies, and endpoint monitoring together rather than relying on message counts alone.
- Create an incident triage procedure for abnormal mailbox delivery spikes that includes user context, attachment repetition, and endpoint file creation review.
- Periodically test whether SOC workflows can correlate mail-flow evidence with Windows attachment creation evidence within the required investigation timeframe.
Analyst notes and limits
This object is a detection analytic, not a technique or adversary behavior description. The supplied ATT&CK fields identify Windows as the platform and describe an analytic for abnormal inbound email volume and repetitive attachments to one mailbox. No tactics, relationships, aliases, labels, or formal detection content were provided, so implementation must be locally engineered and validated.
The source data does not provide ATT&CK tactic mapping, related techniques, concrete queries, data sources, thresholds, or known adversary usage. Any assessment of exposure, active exploitation, impact, or detection coverage requires local email, identity, and Windows endpoint evidence.
Analytic 1008
Detect abnormally high volume of inbound email messages or repetitive attachments being delivered to a single mailbox within a short time window. Defenders should look for anomalous spikes in message counts and repetitive attachment file creation events correlated with targeted users.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | d3f1eba54c7b… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN1008Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.