← Back to SOC feed Coverage →

Admin Submissions by Submission Type (FP)

kql MEDIUM Azure-Sentinel
T1566
CloudAppEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-18T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may exploit admin submission mechanisms to bypass authentication and gain unauthorized access by submitting crafted false positives. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential credential stuffing or privilege escalation attempts masked as legitimate admin actions.

KQL Query

CloudAppEvents
| where ActionType contains "Submission"
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
| extend Admin_SubmissionType=
iff(SubmissionType == "3" and ActionType == "AdminSubmissionSubmitted" and SubmissionContentType=="Mail","Admin_Email_FP",
iff(SubmissionType == "3" and ActionType == "AdminSubmissionSubmitted" and SubmissionContentType=="URL","Admin_URL_FP",
iff(SubmissionType == "3" and ActionType == "AdminSubmissionSubmitted" and SubmissionContentType=="Attachment","Admin_Attach_FP",
"Other")))
| where Admin_SubmissionType!="Other"
| summarize count() by Admin_SubmissionType
| render piechart

Analytic Rule Definition

id: 6f45e3cc-e810-43ce-a8df-289aaa2e0ca2
name: Admin Submissions by Submission Type (FP)
description: |
  This query visualises the total amount of admin false positive submission by submission type.
description-detailed: |
  This query visualises the total amount of admin false positive submission by submission type in Defender for Office 365
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType contains "Submission"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
  | extend Admin_SubmissionType=
  iff(SubmissionType == "3" and ActionType == "AdminSubmissionSubmitted" and SubmissionContentType=="Mail","Admin_Email_FP",
  iff(SubmissionType == "3" and ActionType == "AdminSubmissionSubmitted" and SubmissionContentType=="URL","Admin_URL_FP",
  iff(SubmissionType == "3" and ActionType == "AdminSubmissionSubmitted" and SubmissionContentType=="Attachment","Admin_Attach_FP",
  "Other")))
  | where Admin_SubmissionType!="Other"
  | summarize count() by Admin_SubmissionType
  | render piechart
version: 1.0.0

Required Data Sources

Sentinel TableNotes
CloudAppEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Submissions/Admin Submissions by Submission Type - FP.yaml