← Back to SOC feed Coverage →

Automated email notifications and suspicious sign-in activity

kql MEDIUM Azure-Sentinel
T1566
EmailEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-10T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use automated email notifications to mask malicious sign-in activity and exfiltrate data undetected. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential credential compromise and lateral movement attempts.

KQL Query

let usersWithSuspiciousEmails = EmailEvents
| where SenderFromAddress in ("no-reply@notify.microsoft.com", "no-reply@dropbox.com") or InternetMessageId startswith "<OneTimePasscode"
| where isnotempty(RecipientObjectId)
| distinct RecipientObjectId;
AADSignInEventsBeta
| where AccountObjectId in (usersWithSuspiciousEmails)
| where RiskLevelDuringSignIn == 100

Analytic Rule Definition

id: a7acfaf4-e03e-409d-a16e-dcde33f7dba3
name: Automated email notifications and suspicious sign-in activity
description: |
  This query helps hunting for Automated email notifications and suspicious sign-in activity
description-detailed: |
  This query helps hunting for Automated email notifications and suspicious sign-in activity. 
  By correlating the email from the Microsoft notification service or Dropbox automated notification service with a suspicious sign-in activity, we can identify compromises, especially from securely shared SharePoint or Dropbox files.
  Shared by Microsoft Threat Intelligence: https://www.microsoft.com/en-us/security/blog/2024/10/08/file-hosting-services-misused-for-identity-phishing/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - AADSignInEventsBeta
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
 let usersWithSuspiciousEmails = EmailEvents
 | where SenderFromAddress in ("no-reply@notify.microsoft.com", "no-reply@dropbox.com") or InternetMessageId startswith "<OneTimePasscode"
 | where isnotempty(RecipientObjectId)
 | distinct RecipientObjectId;
 AADSignInEventsBeta
 | where AccountObjectId in (usersWithSuspiciousEmails)
 | where RiskLevelDuringSignIn == 100
version: 1.0.0

Required Data Sources

Sentinel TableNotes
EmailEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Hunting/Automated email notifications and suspicious sign-in activity.yaml